Merge char-misc-next into staging-next

This resolves the merge issues and confusions people were having with
the goldfish drivers due to changes for them showing up in two different
trees.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

254 files changed, 10376 insertions, 6215 deletions

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index f080a8b7659b..796301a7c4fb 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1321,6 +1321,7 @@ static void binder_transaction(struct binder_proc *proc,
         struct binder_transaction *t;
         struct binder_work *tcomplete;
         binder_size_t *offp, *off_end;
+        binder_size_t off_min;
         struct binder_proc *target_proc;
         struct binder_thread *target_thread = NULL;
         struct binder_node *target_node = NULL;
@@ -1522,18 +1523,24 @@ static void binder_transaction(struct binder_proc *proc,
                 goto err_bad_offset;
         }
         off_end = (void *)offp + tr->offsets_size;
+        off_min = 0;
         for (; offp < off_end; offp++) {
                 struct flat_binder_object *fp;
 
                 if (*offp > t->buffer->data_size - sizeof(*fp) ||
+                    *offp < off_min ||
                     t->buffer->data_size < sizeof(*fp) ||
                     !IS_ALIGNED(*offp, sizeof(u32))) {
-                        binder_user_error("%d:%d got transaction with invalid offset, %lld\n",
-                                          proc->pid, thread->pid, (u64)*offp);
+                        binder_user_error("%d:%d got transaction with invalid offset, %lld (min %lld, max %lld)\n",
+                                          proc->pid, thread->pid, (u64)*offp,
+                                          (u64)off_min,
+                                          (u64)(t->buffer->data_size -
+                                          sizeof(*fp)));
                         return_error = BR_FAILED_REPLY;
                         goto err_bad_offset;
                 }
                 fp = (struct flat_binder_object *)(t->buffer->data + *offp);
+                off_min = *offp + sizeof(struct flat_binder_object);
                 switch (fp->type) {
                 case BINDER_TYPE_BINDER:
                 case BINDER_TYPE_WEAK_BINDER: {
@@ -3598,13 +3605,24 @@ static int binder_transactions_show(struct seq_file *m, void *unused)
 
 static int binder_proc_show(struct seq_file *m, void *unused)
 {
+        struct binder_proc *itr;
         struct binder_proc *proc = m->private;
         int do_lock = !binder_debug_no_lock;
+        bool valid_proc = false;
 
         if (do_lock)
                 binder_lock(__func__);
-        seq_puts(m, "binder proc state:\n");
-        print_binder_proc(m, proc, 1);
+
+        hlist_for_each_entry(itr, &binder_procs, proc_node) {
+                if (itr == proc) {
+                        valid_proc = true;
+                        break;
+                }
+        }
+        if (valid_proc) {
+                seq_puts(m, "binder proc state:\n");
+                print_binder_proc(m, proc, 1);
+        }
         if (do_lock)
                 binder_unlock(__func__);
         return 0;
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 594fcabd22cd..546a3692774f 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -264,6 +264,26 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */
         { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */
         { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b2), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b3), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b4), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b5), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b6), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19b7), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19bE), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19bF), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c0), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c1), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c2), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c3), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c4), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c5), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c6), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19c7), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */
+        { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */
         { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */
         { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */
         { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index a4faa438889c..a44c75d4c284 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -250,6 +250,7 @@ enum {
         AHCI_HFLAG_MULTI_MSI            = 0,
         AHCI_HFLAG_MULTI_MSIX           = 0,
 #endif
+        AHCI_HFLAG_WAKE_BEFORE_STOP     = (1 << 22), /* wake before DMA stop */
 
         /* ap->flags bits */
 
diff --git a/drivers/ata/ahci_brcmstb.c b/drivers/ata/ahci_brcmstb.c
index b36cae2fd04b..e87bcec0fd7c 100644
--- a/drivers/ata/ahci_brcmstb.c
+++ b/drivers/ata/ahci_brcmstb.c
@@ -317,6 +317,7 @@ static int brcm_ahci_probe(struct platform_device *pdev)
         if (IS_ERR(hpriv))
                 return PTR_ERR(hpriv);
         hpriv->plat_data = priv;
+        hpriv->flags = AHCI_HFLAG_WAKE_BEFORE_STOP;
 
         brcm_sata_alpm_init(hpriv);
 
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index d61740e78d6d..402967902cbe 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -496,8 +496,8 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv)
                 }
         }
 
-        /* fabricate port_map from cap.nr_ports */
-        if (!port_map) {
+        /* fabricate port_map from cap.nr_ports for < AHCI 1.3 */
+        if (!port_map && vers < 0x10300) {
                 port_map = (1 << ahci_nr_ports(cap)) - 1;
                 dev_warn(dev, "forcing PORTS_IMPL to 0x%x\n", port_map);
 
@@ -593,8 +593,22 @@ EXPORT_SYMBOL_GPL(ahci_start_engine);
 int ahci_stop_engine(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
+        struct ahci_host_priv *hpriv = ap->host->private_data;
         u32 tmp;
 
+        /*
+         * On some controllers, stopping a port's DMA engine while the port
+         * is in ALPM state (partial or slumber) results in failures on
+         * subsequent DMA engine starts.  For those controllers, put the
+         * port back in active state before stopping its DMA engine.
+         */
+        if ((hpriv->flags & AHCI_HFLAG_WAKE_BEFORE_STOP) &&
+            (ap->link.lpm_policy > ATA_LPM_MAX_POWER) &&
+            ahci_set_lpm(&ap->link, ATA_LPM_MAX_POWER, ATA_LPM_WAKE_ONLY)) {
+                dev_err(ap->host->dev, "Failed to wake up port before engine stop\n");
+                return -EIO;
+        }
+
         tmp = readl(port_mmio + PORT_CMD);
 
         /* check if the HBA is idle */
@@ -689,6 +703,9 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
         void __iomem *port_mmio = ahci_port_base(ap);
 
         if (policy != ATA_LPM_MAX_POWER) {
+                /* wakeup flag only applies to the max power policy */
+                hints &= ~ATA_LPM_WAKE_ONLY;
+
                 /*
                  * Disable interrupts on Phy Ready. This keeps us from
                  * getting woken up due to spurious phy ready
@@ -704,7 +721,8 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
                 u32 cmd = readl(port_mmio + PORT_CMD);
 
                 if (policy == ATA_LPM_MAX_POWER || !(hints & ATA_LPM_HIPM)) {
-                        cmd &= ~(PORT_CMD_ASP | PORT_CMD_ALPE);
+                        if (!(hints & ATA_LPM_WAKE_ONLY))
+                                cmd &= ~(PORT_CMD_ASP | PORT_CMD_ALPE);
                         cmd |= PORT_CMD_ICC_ACTIVE;
 
                         writel(cmd, port_mmio + PORT_CMD);
@@ -712,6 +730,9 @@ static int ahci_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
 
                         /* wait 10ms to be sure we've come out of LPM state */
                         ata_msleep(ap, 10);
+
+                        if (hints & ATA_LPM_WAKE_ONLY)
+                                return 0;
                 } else {
                         cmd |= PORT_CMD_ALPE;
                         if (policy == ATA_LPM_MIN_POWER)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index cbb74719d2c1..55e257c268dd 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4125,6 +4125,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         { "SAMSUNG CD-ROM SN-124", "N001",      ATA_HORKAGE_NODMA },
         { "Seagate STT20000A", NULL,            ATA_HORKAGE_NODMA },
         { " 2GB ATA Flash Disk", "ADMA428M",    ATA_HORKAGE_NODMA },
+        { "VRFDFC22048UCHC-TE*", NULL,          ATA_HORKAGE_NODMA },
         /* Odd clown on sil3726/4726 PMPs */
         { "Config  Disk",       NULL,           ATA_HORKAGE_DISABLE },
 
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index cdf6215a9a22..051b6158d1b7 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -997,12 +997,9 @@ static inline int ata_hsm_ok_in_wq(struct ata_port *ap,
 static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
 {
         struct ata_port *ap = qc->ap;
-        unsigned long flags;
 
         if (ap->ops->error_handler) {
                 if (in_wq) {
-                        spin_lock_irqsave(ap->lock, flags);
-
                         /* EH might have kicked in while host lock is
                          * released.
                          */
@@ -1014,8 +1011,6 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
                                 } else
                                         ata_port_freeze(ap);
                         }
-
-                        spin_unlock_irqrestore(ap->lock, flags);
                 } else {
                         if (likely(!(qc->err_mask & AC_ERR_HSM)))
                                 ata_qc_complete(qc);
@@ -1024,10 +1019,8 @@ static void ata_hsm_qc_complete(struct ata_queued_cmd *qc, int in_wq)
                 }
         } else {
                 if (in_wq) {
-                        spin_lock_irqsave(ap->lock, flags);
                         ata_sff_irq_on(ap);
                         ata_qc_complete(qc);
-                        spin_unlock_irqrestore(ap->lock, flags);
                 } else
                         ata_qc_complete(qc);
         }
@@ -1048,9 +1041,10 @@ int ata_sff_hsm_move(struct ata_port *ap, struct ata_queued_cmd *qc,
 {
         struct ata_link *link = qc->dev->link;
         struct ata_eh_info *ehi = &link->eh_info;
-        unsigned long flags = 0;
         int poll_next;
 
+        lockdep_assert_held(ap->lock);
+
         WARN_ON_ONCE((qc->flags & ATA_QCFLAG_ACTIVE) == 0);
 
         /* Make sure ata_sff_qc_issue() does not throw things
@@ -1112,14 +1106,6 @@ fsm_start:
                         }
                 }
 
-                /* Send the CDB (atapi) or the first data block (ata pio out).
-                 * During the state transition, interrupt handler shouldn't
-                 * be invoked before the data transfer is complete and
-                 * hsm_task_state is changed. Hence, the following locking.
-                 */
-                if (in_wq)
-                        spin_lock_irqsave(ap->lock, flags);
-
                 if (qc->tf.protocol == ATA_PROT_PIO) {
                         /* PIO data out protocol.
                          * send first data block.
@@ -1135,9 +1121,6 @@ fsm_start:
                         /* send CDB */
                         atapi_send_cdb(ap, qc);
 
-                if (in_wq)
-                        spin_unlock_irqrestore(ap->lock, flags);
-
                 /* if polling, ata_sff_pio_task() handles the rest.
                  * otherwise, interrupt handler takes over from here.
                  */
@@ -1296,7 +1279,8 @@ fsm_start:
                 break;
         default:
                 poll_next = 0;
-                BUG();
+                WARN(true, "ata%d: SFF host state machine in invalid state %d",
+                     ap->print_id, ap->hsm_task_state);
         }
 
         return poll_next;
@@ -1361,12 +1345,14 @@ static void ata_sff_pio_task(struct work_struct *work)
         u8 status;
         int poll_next;
 
+        spin_lock_irq(ap->lock);
+
         BUG_ON(ap->sff_pio_task_link == NULL);
         /* qc can be NULL if timeout occurred */
         qc = ata_qc_from_tag(ap, link->active_tag);
         if (!qc) {
                 ap->sff_pio_task_link = NULL;
-                return;
+                goto out_unlock;
         }
 
 fsm_start:
@@ -1381,11 +1367,14 @@ fsm_start:
          */
         status = ata_sff_busy_wait(ap, ATA_BUSY, 5);
         if (status & ATA_BUSY) {
+                spin_unlock_irq(ap->lock);
                 ata_msleep(ap, 2);
+                spin_lock_irq(ap->lock);
+
                 status = ata_sff_busy_wait(ap, ATA_BUSY, 10);
                 if (status & ATA_BUSY) {
                         ata_sff_queue_pio_task(link, ATA_SHORT_PAUSE);
-                        return;
+                        goto out_unlock;
                 }
         }
 
@@ -1402,6 +1391,8 @@ fsm_start:
          */
         if (poll_next)
                 goto fsm_start;
+out_unlock:
+        spin_unlock_irq(ap->lock);
 }
 
 /**
diff --git a/drivers/base/component.c b/drivers/base/component.c
index 89f5cf68d80a..04a1582e80bb 100644
--- a/drivers/base/component.c
+++ b/drivers/base/component.c
@@ -206,6 +206,8 @@ static void component_match_release(struct device *master,
                 if (mc->release)
                         mc->release(master, mc->data);
         }
+
+        kfree(match->compare);
 }
 
 static void devm_component_match_release(struct device *dev, void *res)
@@ -221,14 +223,14 @@ static int component_match_realloc(struct device *dev,
         if (match->alloc == num)
                 return 0;
 
-        new = devm_kmalloc_array(dev, num, sizeof(*new), GFP_KERNEL);
+        new = kmalloc_array(num, sizeof(*new), GFP_KERNEL);
         if (!new)
                 return -ENOMEM;
 
         if (match->compare) {
                 memcpy(new, match->compare, sizeof(*new) *
                                             min(match->num, num));
-                devm_kfree(dev, match->compare);
+                kfree(match->compare);
         }
         match->compare = new;
         match->alloc = num;
@@ -283,6 +285,24 @@ void component_match_add_release(struct device *master,
 }
 EXPORT_SYMBOL(component_match_add_release);
 
+static void free_master(struct master *master)
+{
+        struct component_match *match = master->match;
+        int i;
+
+        list_del(&master->node);
+
+        if (match) {
+                for (i = 0; i < match->num; i++) {
+                        struct component *c = match->compare[i].component;
+                        if (c)
+                                c->master = NULL;
+                }
+        }
+
+        kfree(master);
+}
+
 int component_master_add_with_match(struct device *dev,
         const struct component_master_ops *ops,
         struct component_match *match)
@@ -309,11 +329,9 @@ int component_master_add_with_match(struct device *dev,
 
         ret = try_to_bring_up_master(master, NULL);
 
-        if (ret < 0) {
-                /* Delete off the list if we weren't successful */
-                list_del(&master->node);
-                kfree(master);
-        }
+        if (ret < 0)
+                free_master(master);
+
         mutex_unlock(&component_mutex);
 
         return ret < 0 ? ret : 0;
@@ -324,25 +342,12 @@ void component_master_del(struct device *dev,
         const struct component_master_ops *ops)
 {
         struct master *master;
-        int i;
 
         mutex_lock(&component_mutex);
         master = __master_find(dev, ops);
         if (master) {
-                struct component_match *match = master->match;
-
                 take_down_master(master);
-
-                list_del(&master->node);
-
-                if (match) {
-                        for (i = 0; i < match->num; i++) {
-                                struct component *c = match->compare[i].component;
-                                if (c)
-                                        c->master = NULL;
-                        }
-                }
-                kfree(master);
+                free_master(master);
         }
         mutex_unlock(&component_mutex);
 }
@@ -486,6 +491,8 @@ int component_add(struct device *dev, const struct component_ops *ops)
 
         ret = try_to_bring_up_masters(component);
         if (ret < 0) {
+                if (component->master)
+                        remove_component(component->master, component);
                 list_del(&component->node);
 
                 kfree(component);
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index b9250e564ebf..a7f4aa3f6b32 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -257,7 +257,7 @@ static void __fw_free_buf(struct kref *ref)
                 vunmap(buf->data);
                 for (i = 0; i < buf->nr_pages; i++)
                         __free_page(buf->pages[i]);
-                kfree(buf->pages);
+                vfree(buf->pages);
         } else
 #endif
                 vfree(buf->data);
@@ -353,15 +353,15 @@ static int fw_get_filesystem_firmware(struct device *device,
                 rc = fw_read_file_contents(file, buf);
                 fput(file);
                 if (rc)
-                        dev_warn(device, "firmware, attempted to load %s, but failed with error %d\n",
-                                path, rc);
+                        dev_warn(device, "loading %s failed with error %d\n",
+                                 path, rc);
                 else
                         break;
         }
         __putname(path);
 
         if (!rc) {
-                dev_dbg(device, "firmware: direct-loading firmware %s\n",
+                dev_dbg(device, "direct-loading %s\n",
                         buf->fw_id);
                 mutex_lock(&fw_lock);
                 set_bit(FW_STATUS_DONE, &buf->status);
@@ -660,7 +660,7 @@ static ssize_t firmware_loading_store(struct device *dev,
                 if (!test_bit(FW_STATUS_DONE, &fw_buf->status)) {
                         for (i = 0; i < fw_buf->nr_pages; i++)
                                 __free_page(fw_buf->pages[i]);
-                        kfree(fw_buf->pages);
+                        vfree(fw_buf->pages);
                         fw_buf->pages = NULL;
                         fw_buf->page_array_size = 0;
                         fw_buf->nr_pages = 0;
@@ -770,8 +770,7 @@ static int fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
                                          buf->page_array_size * 2);
                 struct page **new_pages;
 
-                new_pages = kmalloc(new_array_size * sizeof(void *),
-                                    GFP_KERNEL);
+                new_pages = vmalloc(new_array_size * sizeof(void *));
                 if (!new_pages) {
                         fw_load_abort(fw_priv);
                         return -ENOMEM;
@@ -780,7 +779,7 @@ static int fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
                        buf->page_array_size * sizeof(void *));
                 memset(&new_pages[buf->page_array_size], 0, sizeof(void *) *
                        (new_array_size - buf->page_array_size));
-                kfree(buf->pages);
+                vfree(buf->pages);
                 buf->pages = new_pages;
                 buf->page_array_size = new_array_size;
         }
@@ -1051,7 +1050,7 @@ _request_firmware_prepare(struct firmware **firmware_p, const char *name,
         }
 
         if (fw_get_builtin_firmware(firmware, name)) {
-                dev_dbg(device, "firmware: using built-in firmware %s\n", name);
+                dev_dbg(device, "using built-in %s\n", name);
                 return 0; /* assigned */
         }
 
diff --git a/drivers/base/regmap/regmap-mmio.c b/drivers/base/regmap/regmap-mmio.c
index 8812bfb9e3b8..eea51569f0eb 100644
--- a/drivers/base/regmap/regmap-mmio.c
+++ b/drivers/base/regmap/regmap-mmio.c
@@ -133,17 +133,17 @@ static int regmap_mmio_gather_write(void *context,
         while (val_size) {
                 switch (ctx->val_bytes) {
                 case 1:
-                        __raw_writeb(*(u8 *)val, ctx->regs + offset);
+                        writeb(*(u8 *)val, ctx->regs + offset);
                         break;
                 case 2:
-                        __raw_writew(*(u16 *)val, ctx->regs + offset);
+                        writew(*(u16 *)val, ctx->regs + offset);
                         break;
                 case 4:
-                        __raw_writel(*(u32 *)val, ctx->regs + offset);
+                        writel(*(u32 *)val, ctx->regs + offset);
                         break;
 #ifdef CONFIG_64BIT
                 case 8:
-                        __raw_writeq(*(u64 *)val, ctx->regs + offset);
+                        writeq(*(u64 *)val, ctx->regs + offset);
                         break;
 #endif
                 default:
@@ -193,17 +193,17 @@ static int regmap_mmio_read(void *context,
         while (val_size) {
                 switch (ctx->val_bytes) {
                 case 1:
-                        *(u8 *)val = __raw_readb(ctx->regs + offset);
+                        *(u8 *)val = readb(ctx->regs + offset);
                         break;
                 case 2:
-                        *(u16 *)val = __raw_readw(ctx->regs + offset);
+                        *(u16 *)val = readw(ctx->regs + offset);
                         break;
                 case 4:
-                        *(u32 *)val = __raw_readl(ctx->regs + offset);
+                        *(u32 *)val = readl(ctx->regs + offset);
                         break;
 #ifdef CONFIG_64BIT
                 case 8:
-                        *(u64 *)val = __raw_readq(ctx->regs + offset);
+                        *(u64 *)val = readq(ctx->regs + offset);
                         break;
 #endif
                 default:
diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
index 01292328a456..678fa97e41fb 100644
--- a/drivers/char/nvram.c
+++ b/drivers/char/nvram.c
@@ -496,12 +496,12 @@ static void pc_set_checksum(void)
 
 #ifdef CONFIG_PROC_FS
 
-static char *floppy_types[] = {
+static const char * const floppy_types[] = {
         "none", "5.25'' 360k", "5.25'' 1.2M", "3.5'' 720k", "3.5'' 1.44M",
         "3.5'' 2.88M", "3.5'' 2.88M"
 };
 
-static char *gfx_types[] = {
+static const char * const gfx_types[] = {
         "EGA, VGA, ... (with BIOS)",
         "CGA (40 cols)",
         "CGA (80 cols)",
@@ -602,7 +602,7 @@ static void atari_set_checksum(void)
 
 static struct {
         unsigned char val;
-        char *name;
+        const char *name;
 } boot_prefs[] = {
         { 0x80, "TOS" },
         { 0x40, "ASV" },
@@ -611,7 +611,7 @@ static struct {
         { 0x00, "unspecified" }
 };
 
-static char *languages[] = {
+static const char * const languages[] = {
         "English (US)",
         "German",
         "French",
@@ -623,7 +623,7 @@ static char *languages[] = {
         "Swiss (German)"
 };
 
-static char *dateformat[] = {
+static const char * const dateformat[] = {
         "MM%cDD%cYY",
         "DD%cMM%cYY",
         "YY%cMM%cDD",
@@ -634,7 +634,7 @@ static char *dateformat[] = {
         "7 (undefined)"
 };
 
-static char *colors[] = {
+static const char * const colors[] = {
         "2", "4", "16", "256", "65536", "??", "??", "??"
 };
 
diff --git a/drivers/char/nwbutton.c b/drivers/char/nwbutton.c
index 76c490fa0511..0e184426db98 100644
--- a/drivers/char/nwbutton.c
+++ b/drivers/char/nwbutton.c
@@ -129,10 +129,9 @@ static void button_consume_callbacks (int bpcount)
 
 static void button_sequence_finished (unsigned long parameters)
 {
-#ifdef CONFIG_NWBUTTON_REBOOT           /* Reboot using button is enabled */
-        if (button_press_count == reboot_count)
+        if (IS_ENABLED(CONFIG_NWBUTTON_REBOOT) &&
+            button_press_count == reboot_count)
                 kill_cad_pid(SIGINT, 1);        /* Ask init to reboot us */
-#endif /* CONFIG_NWBUTTON_REBOOT */
         button_consume_callbacks (button_press_count);
         bcount = sprintf (button_output_buffer, "%d\n", button_press_count);
         button_press_count = 0;         /* Reset the button press counter */
diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index ae0b42b66e55..d23368874710 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c
@@ -69,12 +69,13 @@
 #include <linux/ppdev.h>
 #include <linux/mutex.h>
 #include <linux/uaccess.h>
+#include <linux/compat.h>
 
 #define PP_VERSION "ppdev: user-space parallel port driver"
 #define CHRDEV "ppdev"
 
 struct pp_struct {
-        struct pardevice * pdev;
+        struct pardevice *pdev;
         wait_queue_head_t irq_wait;
         atomic_t irqc;
         unsigned int flags;
@@ -98,18 +99,26 @@ struct pp_struct {
 #define ROUND_UP(x,y) (((x)+(y)-1)/(y))
 
 static DEFINE_MUTEX(pp_do_mutex);
-static inline void pp_enable_irq (struct pp_struct *pp)
+
+/* define fixed sized ioctl cmd for y2038 migration */
+#define PPGETTIME32     _IOR(PP_IOCTL, 0x95, s32[2])
+#define PPSETTIME32     _IOW(PP_IOCTL, 0x96, s32[2])
+#define PPGETTIME64     _IOR(PP_IOCTL, 0x95, s64[2])
+#define PPSETTIME64     _IOW(PP_IOCTL, 0x96, s64[2])
+
+static inline void pp_enable_irq(struct pp_struct *pp)
 {
         struct parport *port = pp->pdev->port;
-        port->ops->enable_irq (port);
+
+        port->ops->enable_irq(port);
 }
 
-static ssize_t pp_read (struct file * file, char __user * buf, size_t count,
-                        loff_t * ppos)
+static ssize_t pp_read(struct file *file, char __user *buf, size_t count,
+                       loff_t *ppos)
 {
         unsigned int minor = iminor(file_inode(file));
         struct pp_struct *pp = file->private_data;
-        char * kbuffer;
+        char *kbuffer;
         ssize_t bytes_read = 0;
         struct parport *pport;
         int mode;
@@ -125,16 +134,15 @@ static ssize_t pp_read (struct file * file, char __user * buf, size_t count,
                 return 0;
 
         kbuffer = kmalloc(min_t(size_t, count, PP_BUFFER_SIZE), GFP_KERNEL);
-        if (!kbuffer) {
+        if (!kbuffer)
                 return -ENOMEM;
-        }
         pport = pp->pdev->port;
         mode = pport->ieee1284.mode & ~(IEEE1284_DEVICEID | IEEE1284_ADDR);
 
-        parport_set_timeout (pp->pdev,
-                             (file->f_flags & O_NONBLOCK) ?
-                             PARPORT_INACTIVITY_O_NONBLOCK :
-                             pp->default_inactivity);
+        parport_set_timeout(pp->pdev,
+                            (file->f_flags & O_NONBLOCK) ?
+                            PARPORT_INACTIVITY_O_NONBLOCK :
+                            pp->default_inactivity);
 
         while (bytes_read == 0) {
                 ssize_t need = min_t(unsigned long, count, PP_BUFFER_SIZE);
@@ -144,20 +152,17 @@ static ssize_t pp_read (struct file * file, char __user * buf, size_t count,
                         int flags = 0;
                         size_t (*fn)(struct parport *, void *, size_t, int);
 
-                        if (pp->flags & PP_W91284PIC) {
+                        if (pp->flags & PP_W91284PIC)
                                 flags |= PARPORT_W91284PIC;
-                        }
-                        if (pp->flags & PP_FASTREAD) {
+                        if (pp->flags & PP_FASTREAD)
                                 flags |= PARPORT_EPP_FAST;
-                        }
-                        if (pport->ieee1284.mode & IEEE1284_ADDR) {
+                        if (pport->ieee1284.mode & IEEE1284_ADDR)
                                 fn = pport->ops->epp_read_addr;
-                        } else {
+                        else
                                 fn = pport->ops->epp_read_data;
-                        }
                         bytes_read = (*fn)(pport, kbuffer, need, flags);
                 } else {
-                        bytes_read = parport_read (pport, kbuffer, need);
+                        bytes_read = parport_read(pport, kbuffer, need);
                 }
 
                 if (bytes_read != 0)
@@ -168,7 +173,7 @@ static ssize_t pp_read (struct file * file, char __user * buf, size_t count,
                         break;
                 }
 
-                if (signal_pending (current)) {
+                if (signal_pending(current)) {
                         bytes_read = -ERESTARTSYS;
                         break;
                 }
@@ -176,22 +181,22 @@ static ssize_t pp_read (struct file * file, char __user * buf, size_t count,
                 cond_resched();
         }
 
-        parport_set_timeout (pp->pdev, pp->default_inactivity);
+        parport_set_timeout(pp->pdev, pp->default_inactivity);
 
-        if (bytes_read > 0 && copy_to_user (buf, kbuffer, bytes_read))
+        if (bytes_read > 0 && copy_to_user(buf, kbuffer, bytes_read))
                 bytes_read = -EFAULT;
 
-        kfree (kbuffer);
-        pp_enable_irq (pp);
+        kfree(kbuffer);
+        pp_enable_irq(pp);
         return bytes_read;
 }
 
-static ssize_t pp_write (struct file * file, const char __user * buf,
-                         size_t count, loff_t * ppos)
+static ssize_t pp_write(struct file *file, const char __user *buf,
+                        size_t count, loff_t *ppos)
 {
         unsigned int minor = iminor(file_inode(file));
         struct pp_struct *pp = file->private_data;
-        char * kbuffer;
+        char *kbuffer;
         ssize_t bytes_written = 0;
         ssize_t wrote;
         int mode;
@@ -204,21 +209,21 @@ static ssize_t pp_write (struct file * file, const char __user * buf,
         }
 
         kbuffer = kmalloc(min_t(size_t, count, PP_BUFFER_SIZE), GFP_KERNEL);
-        if (!kbuffer) {
+        if (!kbuffer)
                 return -ENOMEM;
-        }
+
         pport = pp->pdev->port;
         mode = pport->ieee1284.mode & ~(IEEE1284_DEVICEID | IEEE1284_ADDR);
 
-        parport_set_timeout (pp->pdev,
-                             (file->f_flags & O_NONBLOCK) ?
-                             PARPORT_INACTIVITY_O_NONBLOCK :
-                             pp->default_inactivity);
+        parport_set_timeout(pp->pdev,
+                            (file->f_flags & O_NONBLOCK) ?
+                            PARPORT_INACTIVITY_O_NONBLOCK :
+                            pp->default_inactivity);
 
         while (bytes_written < count) {
                 ssize_t n = min_t(unsigned long, count - bytes_written, PP_BUFFER_SIZE);
 
-                if (copy_from_user (kbuffer, buf + bytes_written, n)) {
+                if (copy_from_user(kbuffer, buf + bytes_written, n)) {
                         bytes_written = -EFAULT;
                         break;
                 }
@@ -226,20 +231,19 @@ static ssize_t pp_write (struct file * file, const char __user * buf,
                 if ((pp->flags & PP_FASTWRITE) && (mode == IEEE1284_MODE_EPP)) {
                         /* do a fast EPP write */
                         if (pport->ieee1284.mode & IEEE1284_ADDR) {
-                                wrote = pport->ops->epp_write_addr (pport,
+                                wrote = pport->ops->epp_write_addr(pport,
                                         kbuffer, n, PARPORT_EPP_FAST);
                         } else {
-                                wrote = pport->ops->epp_write_data (pport,
+                                wrote = pport->ops->epp_write_data(pport,
                                         kbuffer, n, PARPORT_EPP_FAST);
                         }
                 } else {
-                        wrote = parport_write (pp->pdev->port, kbuffer, n);
+                        wrote = parport_write(pp->pdev->port, kbuffer, n);
                 }
 
                 if (wrote <= 0) {
-                        if (!bytes_written) {
+                        if (!bytes_written)
                                 bytes_written = wrote;
-                        }
                         break;
                 }
 
@@ -251,67 +255,69 @@ static ssize_t pp_write (struct file * file, const char __user * buf,
                         break;
                 }
 
-                if (signal_pending (current))
+                if (signal_pending(current))
                         break;
 
                 cond_resched();
         }
 
-        parport_set_timeout (pp->pdev, pp->default_inactivity);
+        parport_set_timeout(pp->pdev, pp->default_inactivity);
 
-        kfree (kbuffer);
-        pp_enable_irq (pp);
+        kfree(kbuffer);
+        pp_enable_irq(pp);
         return bytes_written;
 }
 
-static void pp_irq (void *private)
+static void pp_irq(void *private)
 {
         struct pp_struct *pp = private;
 
         if (pp->irqresponse) {
-                parport_write_control (pp->pdev->port, pp->irqctl);
+                parport_write_control(pp->pdev->port, pp->irqctl);
                 pp->irqresponse = 0;
         }
 
-        atomic_inc (&pp->irqc);
-        wake_up_interruptible (&pp->irq_wait);
+        atomic_inc(&pp->irqc);
+        wake_up_interruptible(&pp->irq_wait);
 }
 
-static int register_device (int minor, struct pp_struct *pp)
+static int register_device(int minor, struct pp_struct *pp)
 {
         struct parport *port;
-        struct pardevice * pdev = NULL;
+        struct pardevice *pdev = NULL;
         char *name;
-        int fl;
+        struct pardev_cb ppdev_cb;
 
         name = kasprintf(GFP_KERNEL, CHRDEV "%x", minor);
         if (name == NULL)
                 return -ENOMEM;
 
-        port = parport_find_number (minor);
+        port = parport_find_number(minor);
         if (!port) {
-                printk (KERN_WARNING "%s: no associated port!\n", name);
-                kfree (name);
+                printk(KERN_WARNING "%s: no associated port!\n", name);
+                kfree(name);
                 return -ENXIO;
         }
 
-        fl = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;
-        pdev = parport_register_device (port, name, NULL,
-                                        NULL, pp_irq, fl, pp);
-        parport_put_port (port);
+        memset(&ppdev_cb, 0, sizeof(ppdev_cb));
+        ppdev_cb.irq_func = pp_irq;
+        ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;
+        ppdev_cb.private = pp;
+        pdev = parport_register_dev_model(port, name, &ppdev_cb, minor);
+        parport_put_port(port);
 
         if (!pdev) {
-                printk (KERN_WARNING "%s: failed to register device!\n", name);
-                kfree (name);
+                printk(KERN_WARNING "%s: failed to register device!\n", name);
+                kfree(name);
                 return -ENXIO;
         }
 
         pp->pdev = pdev;
-        pr_debug("%s: registered pardevice\n", name);
+        dev_dbg(&pdev->dev, "registered pardevice\n");
         return 0;
 }
 
-static enum ieee1284_phase init_phase (int mode)
+static enum ieee1284_phase init_phase(int mode)
 {
         switch (mode & ~(IEEE1284_DEVICEID
                          | IEEE1284_ADDR)) {
@@ -322,11 +328,27 @@ static enum ieee1284_phase init_phase (int mode)
         return IEEE1284_PH_FWD_IDLE;
 }
 
+static int pp_set_timeout(struct pardevice *pdev, long tv_sec, int tv_usec)
+{
+        long to_jiffies;
+
+        if ((tv_sec < 0) || (tv_usec < 0))
+                return -EINVAL;
+
+        to_jiffies = usecs_to_jiffies(tv_usec);
+        to_jiffies += tv_sec * HZ;
+        if (to_jiffies <= 0)
+                return -EINVAL;
+
+        pdev->timeout = to_jiffies;
+        return 0;
+}
+
 static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         unsigned int minor = iminor(file_inode(file));
         struct pp_struct *pp = file->private_data;
-        struct parport * port;
+        struct parport *port;
         void __user *argp = (void __user *)arg;
 
         /* First handle the cases that don't take arguments. */
@@ -337,19 +359,19 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 int ret;
 
                 if (pp->flags & PP_CLAIMED) {
-                        pr_debug(CHRDEV "%x: you've already got it!\n", minor);
+                        dev_dbg(&pp->pdev->dev, "you've already got it!\n");
                         return -EINVAL;
                 }
 
                 /* Deferred device registration. */
                 if (!pp->pdev) {
-                        int err = register_device (minor, pp);
-                        if (err) {
+                        int err = register_device(minor, pp);
+
+                        if (err)
                                 return err;
-                        }
                 }
 
-                ret = parport_claim_or_block (pp->pdev);
+                ret = parport_claim_or_block(pp->pdev);
                 if (ret < 0)
                         return ret;
 
@@ -357,7 +379,7 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 /* For interrupt-reporting to work, we need to be
                  * informed of each interrupt. */
-                pp_enable_irq (pp);
+                pp_enable_irq(pp);
 
                 /* We may need to fix up the state machine. */
                 info = &pp->pdev->port->ieee1284;
@@ -365,15 +387,15 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 pp->saved_state.phase = info->phase;
                 info->mode = pp->state.mode;
                 info->phase = pp->state.phase;
-                pp->default_inactivity = parport_set_timeout (pp->pdev, 0);
-                parport_set_timeout (pp->pdev, pp->default_inactivity);
+                pp->default_inactivity = parport_set_timeout(pp->pdev, 0);
+                parport_set_timeout(pp->pdev, pp->default_inactivity);
 
                 return 0;
             }
         case PPEXCL:
                 if (pp->pdev) {
-                        pr_debug(CHRDEV "%x: too late for PPEXCL; "
-                                "already registered\n", minor);
+                        dev_dbg(&pp->pdev->dev,
+                                "too late for PPEXCL; already registered\n");
                         if (pp->flags & PP_EXCL)
                                 /* But it's not really an error. */
                                 return 0;
@@ -388,11 +410,12 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         case PPSETMODE:
             {
                 int mode;
-                if (copy_from_user (&mode, argp, sizeof (mode)))
+
+                if (copy_from_user(&mode, argp, sizeof(mode)))
                         return -EFAULT;
                 /* FIXME: validate mode */
                 pp->state.mode = mode;
-                pp->state.phase = init_phase (mode);
+                pp->state.phase = init_phase(mode);
 
                 if (pp->flags & PP_CLAIMED) {
                         pp->pdev->port->ieee1284.mode = mode;
@@ -405,28 +428,27 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
             {
                 int mode;
 
-                if (pp->flags & PP_CLAIMED) {
+                if (pp->flags & PP_CLAIMED)
                         mode = pp->pdev->port->ieee1284.mode;
-                } else {
+                else
                         mode = pp->state.mode;
-                }
-                if (copy_to_user (argp, &mode, sizeof (mode))) {
+
+                if (copy_to_user(argp, &mode, sizeof(mode)))
                         return -EFAULT;
-                }
                 return 0;
             }
         case PPSETPHASE:
             {
                 int phase;
-                if (copy_from_user (&phase, argp, sizeof (phase))) {
+
+                if (copy_from_user(&phase, argp, sizeof(phase)))
                         return -EFAULT;
-                }
+
                 /* FIXME: validate phase */
                 pp->state.phase = phase;
 
-                if (pp->flags & PP_CLAIMED) {
+                if (pp->flags & PP_CLAIMED)
                         pp->pdev->port->ieee1284.phase = phase;
-                }
 
                 return 0;
             }
@@ -434,38 +456,34 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
             {
                 int phase;
 
-                if (pp->flags & PP_CLAIMED) {
+                if (pp->flags & PP_CLAIMED)
                         phase = pp->pdev->port->ieee1284.phase;
-                } else {
+                else
                         phase = pp->state.phase;
-                }
-                if (copy_to_user (argp, &phase, sizeof (phase))) {
+                if (copy_to_user(argp, &phase, sizeof(phase)))
                         return -EFAULT;
-                }
                 return 0;
             }
         case PPGETMODES:
             {
                 unsigned int modes;
 
-                port = parport_find_number (minor);
+                port = parport_find_number(minor);
                 if (!port)
                         return -ENODEV;
 
                 modes = port->modes;
                 parport_put_port(port);
-                if (copy_to_user (argp, &modes, sizeof (modes))) {
+                if (copy_to_user(argp, &modes, sizeof(modes)))
                         return -EFAULT;
-                }
                 return 0;
             }
         case PPSETFLAGS:
             {
                 int uflags;
 
-                if (copy_from_user (&uflags, argp, sizeof (uflags))) {
+                if (copy_from_user(&uflags, argp, sizeof(uflags)))
                         return -EFAULT;
-                }
                 pp->flags &= ~PP_FLAGMASK;
                 pp->flags |= (uflags & PP_FLAGMASK);
                 return 0;
@@ -475,9 +493,8 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 int uflags;
 
                 uflags = pp->flags & PP_FLAGMASK;
-                if (copy_to_user (argp, &uflags, sizeof (uflags))) {
+                if (copy_to_user(argp, &uflags, sizeof(uflags)))
                         return -EFAULT;
-                }
                 return 0;
             }
         }       /* end switch() */
@@ -495,27 +512,28 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 unsigned char reg;
                 unsigned char mask;
                 int mode;
+                s32 time32[2];
+                s64 time64[2];
+                struct timespec64 ts;
                 int ret;
-                struct timeval par_timeout;
-                long to_jiffies;
 
         case PPRSTATUS:
-                reg = parport_read_status (port);
-                if (copy_to_user (argp, &reg, sizeof (reg)))
+                reg = parport_read_status(port);
+                if (copy_to_user(argp, &reg, sizeof(reg)))
                         return -EFAULT;
                 return 0;
         case PPRDATA:
-                reg = parport_read_data (port);
-                if (copy_to_user (argp, &reg, sizeof (reg)))
+                reg = parport_read_data(port);
+                if (copy_to_user(argp, &reg, sizeof(reg)))
                         return -EFAULT;
                 return 0;
         case PPRCONTROL:
-                reg = parport_read_control (port);
-                if (copy_to_user (argp, &reg, sizeof (reg)))
+                reg = parport_read_control(port);
+                if (copy_to_user(argp, &reg, sizeof(reg)))
                         return -EFAULT;
                 return 0;
         case PPYIELD:
-                parport_yield_blocking (pp->pdev);
+                parport_yield_blocking(pp->pdev);
                 return 0;
 
         case PPRELEASE:
@@ -525,45 +543,45 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 pp->state.phase = info->phase;
                 info->mode = pp->saved_state.mode;
                 info->phase = pp->saved_state.phase;
-                parport_release (pp->pdev);
+                parport_release(pp->pdev);
                 pp->flags &= ~PP_CLAIMED;
                 return 0;
 
         case PPWCONTROL:
-                if (copy_from_user (&reg, argp, sizeof (reg)))
+                if (copy_from_user(&reg, argp, sizeof(reg)))
                         return -EFAULT;
-                parport_write_control (port, reg);
+                parport_write_control(port, reg);
                 return 0;
 
         case PPWDATA:
-                if (copy_from_user (&reg, argp, sizeof (reg)))
+                if (copy_from_user(&reg, argp, sizeof(reg)))
                         return -EFAULT;
-                parport_write_data (port, reg);
+                parport_write_data(port, reg);
                 return 0;
 
         case PPFCONTROL:
-                if (copy_from_user (&mask, argp,
-                                    sizeof (mask)))
+                if (copy_from_user(&mask, argp,
+                                   sizeof(mask)))
                         return -EFAULT;
-                if (copy_from_user (&reg, 1 + (unsigned char __user *) arg,
-                                    sizeof (reg)))
+                if (copy_from_user(&reg, 1 + (unsigned char __user *) arg,
+                                   sizeof(reg)))
                         return -EFAULT;
-                parport_frob_control (port, mask, reg);
+                parport_frob_control(port, mask, reg);
                 return 0;
 
         case PPDATADIR:
-                if (copy_from_user (&mode, argp, sizeof (mode)))
+                if (copy_from_user(&mode, argp, sizeof(mode)))
                         return -EFAULT;
                 if (mode)
-                        port->ops->data_reverse (port);
+                        port->ops->data_reverse(port);
                 else
-                        port->ops->data_forward (port);
+                        port->ops->data_forward(port);
                 return 0;
 
         case PPNEGOT:
-                if (copy_from_user (&mode, argp, sizeof (mode)))
+                if (copy_from_user(&mode, argp, sizeof(mode)))
                         return -EFAULT;
-                switch ((ret = parport_negotiate (port, mode))) {
+                switch ((ret = parport_negotiate(port, mode))) {
                 case 0: break;
                 case -1: /* handshake failed, peripheral not IEEE 1284 */
                         ret = -EIO;
@@ -572,11 +590,11 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                         ret = -ENXIO;
                         break;
                 }
-                pp_enable_irq (pp);
+                pp_enable_irq(pp);
                 return ret;
 
         case PPWCTLONIRQ:
-                if (copy_from_user (&reg, argp, sizeof (reg)))
+                if (copy_from_user(&reg, argp, sizeof(reg)))
                         return -EFAULT;
 
                 /* Remember what to set the control lines to, for next
@@ -586,39 +604,50 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
                 return 0;
 
         case PPCLRIRQ:
-                ret = atomic_read (&pp->irqc);
-                if (copy_to_user (argp, &ret, sizeof (ret)))
+                ret = atomic_read(&pp->irqc);
+                if (copy_to_user(argp, &ret, sizeof(ret)))
                         return -EFAULT;
-                atomic_sub (ret, &pp->irqc);
+                atomic_sub(ret, &pp->irqc);
                 return 0;
 
-        case PPSETTIME:
-                if (copy_from_user (&par_timeout, argp, sizeof(struct timeval))) {
+        case PPSETTIME32:
+                if (copy_from_user(time32, argp, sizeof(time32)))
                         return -EFAULT;
-                }
-                /* Convert to jiffies, place in pp->pdev->timeout */
-                if ((par_timeout.tv_sec < 0) || (par_timeout.tv_usec < 0)) {
-                        return -EINVAL;
-                }
-                to_jiffies = ROUND_UP(par_timeout.tv_usec, 1000000/HZ);
-                to_jiffies += par_timeout.tv_sec * (long)HZ;
-                if (to_jiffies <= 0) {
+
+                return pp_set_timeout(pp->pdev, time32[0], time32[1]);
+
+        case PPSETTIME64:
+                if (copy_from_user(time64, argp, sizeof(time64)))
+                        return -EFAULT;
+
+                return pp_set_timeout(pp->pdev, time64[0], time64[1]);
+
+        case PPGETTIME32:
+                jiffies_to_timespec64(pp->pdev->timeout, &ts);
+                time32[0] = ts.tv_sec;
+                time32[1] = ts.tv_nsec / NSEC_PER_USEC;
+                if ((time32[0] < 0) || (time32[1] < 0))
                         return -EINVAL;
-                }
-                pp->pdev->timeout = to_jiffies;
+
+                if (copy_to_user(argp, time32, sizeof(time32)))
+                        return -EFAULT;
+
                 return 0;
 
-        case PPGETTIME:
-                to_jiffies = pp->pdev->timeout;
-                memset(&par_timeout, 0, sizeof(par_timeout));
-                par_timeout.tv_sec = to_jiffies / HZ;
-                par_timeout.tv_usec = (to_jiffies % (long)HZ) * (1000000/HZ);
-                if (copy_to_user (argp, &par_timeout, sizeof(struct timeval)))
+        case PPGETTIME64:
+                jiffies_to_timespec64(pp->pdev->timeout, &ts);
+                time64[0] = ts.tv_sec;
+                time64[1] = ts.tv_nsec / NSEC_PER_USEC;
+                if ((time64[0] < 0) || (time64[1] < 0))
+                        return -EINVAL;
+
+                if (copy_to_user(argp, time64, sizeof(time64)))
                         return -EFAULT;
+
                 return 0;
 
         default:
-                pr_debug(CHRDEV "%x: What? (cmd=0x%x)\n", minor, cmd);
+                dev_dbg(&pp->pdev->dev, "What? (cmd=0x%x)\n", cmd);
                 return -EINVAL;
         }
 
@@ -629,13 +658,22 @@ static int pp_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 static long pp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         long ret;
+
         mutex_lock(&pp_do_mutex);
         ret = pp_do_ioctl(file, cmd, arg);
         mutex_unlock(&pp_do_mutex);
         return ret;
 }
 
-static int pp_open (struct inode * inode, struct file * file)
+#ifdef CONFIG_COMPAT
+static long pp_compat_ioctl(struct file *file, unsigned int cmd,
+                            unsigned long arg)
+{
+        return pp_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
+}
+#endif
+
+static int pp_open(struct inode *inode, struct file *file)
 {
         unsigned int minor = iminor(inode);
         struct pp_struct *pp;
@@ -643,16 +681,16 @@ static int pp_open (struct inode * inode, struct file * file)
         if (minor >= PARPORT_MAX)
                 return -ENXIO;
 
-        pp = kmalloc (sizeof (struct pp_struct), GFP_KERNEL);
+        pp = kmalloc(sizeof(struct pp_struct), GFP_KERNEL);
         if (!pp)
                 return -ENOMEM;
 
         pp->state.mode = IEEE1284_MODE_COMPAT;
-        pp->state.phase = init_phase (pp->state.mode);
+        pp->state.phase = init_phase(pp->state.mode);
         pp->flags = 0;
         pp->irqresponse = 0;
-        atomic_set (&pp->irqc, 0);
-        init_waitqueue_head (&pp->irq_wait);
+        atomic_set(&pp->irqc, 0);
+        init_waitqueue_head(&pp->irq_wait);
 
         /* Defer the actual device registration until the first claim.
          * That way, we know whether or not the driver wants to have
@@ -664,7 +702,7 @@ static int pp_open (struct inode * inode, struct file * file)
         return 0;
 }
 
-static int pp_release (struct inode * inode, struct file * file)
+static int pp_release(struct inode *inode, struct file *file)
 {
         unsigned int minor = iminor(inode);
         struct pp_struct *pp = file->private_data;
@@ -673,10 +711,10 @@ static int pp_release (struct inode * inode, struct file * file)
         compat_negot = 0;
         if (!(pp->flags & PP_CLAIMED) && pp->pdev &&
             (pp->state.mode != IEEE1284_MODE_COMPAT)) {
-                struct ieee1284_info *info;
+                struct ieee1284_info *info;
 
                 /* parport released, but not in compatibility mode */
-                parport_claim_or_block (pp->pdev);
+                parport_claim_or_block(pp->pdev);
                 pp->flags |= PP_CLAIMED;
                 info = &pp->pdev->port->ieee1284;
                 pp->saved_state.mode = info->mode;
@@ -689,9 +727,9 @@ static int pp_release (struct inode * inode, struct file * file)
                 compat_negot = 2;
         }
         if (compat_negot) {
-                parport_negotiate (pp->pdev->port, IEEE1284_MODE_COMPAT);
-                pr_debug(CHRDEV "%x: negotiated back to compatibility "
-                        "mode because user-space forgot\n", minor);
+                parport_negotiate(pp->pdev->port, IEEE1284_MODE_COMPAT);
+                dev_dbg(&pp->pdev->dev,
+                        "negotiated back to compatibility mode because user-space forgot\n");
         }
 
         if (pp->flags & PP_CLAIMED) {
@@ -702,7 +740,7 @@ static int pp_release (struct inode * inode, struct file * file)
                 pp->state.phase = info->phase;
                 info->mode = pp->saved_state.mode;
                 info->phase = pp->saved_state.phase;
-                parport_release (pp->pdev);
+                parport_release(pp->pdev);
                 if (compat_negot != 1) {
                         pr_debug(CHRDEV "%x: released pardevice "
                                 "because user-space forgot\n", minor);
@@ -711,25 +749,26 @@ static int pp_release (struct inode * inode, struct file * file)
 
         if (pp->pdev) {
                 const char *name = pp->pdev->name;
-                parport_unregister_device (pp->pdev);
-                kfree (name);
+
+                parport_unregister_device(pp->pdev);
+                kfree(name);
                 pp->pdev = NULL;
                 pr_debug(CHRDEV "%x: unregistered pardevice\n", minor);
         }
 
-        kfree (pp);
+        kfree(pp);
 
         return 0;
 }
 
 /* No kernel lock held - fine */
-static unsigned int pp_poll (struct file * file, poll_table * wait)
+static unsigned int pp_poll(struct file *file, poll_table *wait)
 {
         struct pp_struct *pp = file->private_data;
         unsigned int mask = 0;
 
-        poll_wait (file, &pp->irq_wait, wait);
-        if (atomic_read (&pp->irqc))
+        poll_wait(file, &pp->irq_wait, wait);
+        if (atomic_read(&pp->irqc))
                 mask |= POLLIN | POLLRDNORM;
 
         return mask;
@@ -744,6 +783,9 @@ static const struct file_operations pp_fops = {
         .write          = pp_write,
         .poll           = pp_poll,
         .unlocked_ioctl = pp_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = pp_compat_ioctl,
+#endif
         .open           = pp_open,
         .release        = pp_release,
 };
@@ -759,19 +801,32 @@ static void pp_detach(struct parport *port)
         device_destroy(ppdev_class, MKDEV(PP_MAJOR, port->number));
 }
 
+static int pp_probe(struct pardevice *par_dev)
+{
+        struct device_driver *drv = par_dev->dev.driver;
+        int len = strlen(drv->name);
+
+        if (strncmp(par_dev->name, drv->name, len))
+                return -ENODEV;
+
+        return 0;
+}
+
 static struct parport_driver pp_driver = {
         .name           = CHRDEV,
-        .attach         = pp_attach,
+        .probe          = pp_probe,
+        .match_port     = pp_attach,
         .detach         = pp_detach,
+        .devmodel       = true,
 };
 
-static int __init ppdev_init (void)
+static int __init ppdev_init(void)
 {
         int err = 0;
 
-        if (register_chrdev (PP_MAJOR, CHRDEV, &pp_fops)) {
-                printk (KERN_WARNING CHRDEV ": unable to get major %d\n",
-                        PP_MAJOR);
+        if (register_chrdev(PP_MAJOR, CHRDEV, &pp_fops)) {
+                printk(KERN_WARNING CHRDEV ": unable to get major %d\n",
+                       PP_MAJOR);
                 return -EIO;
         }
         ppdev_class = class_create(THIS_MODULE, CHRDEV);
@@ -781,11 +836,11 @@ static int __init ppdev_init (void)
         }
         err = parport_register_driver(&pp_driver);
         if (err < 0) {
-                printk (KERN_WARNING CHRDEV ": unable to register with parport\n");
+                printk(KERN_WARNING CHRDEV ": unable to register with parport\n");
                 goto out_class;
         }
 
-        printk (KERN_INFO PP_VERSION "\n");
+        printk(KERN_INFO PP_VERSION "\n");
         goto out;
 
 out_class:
@@ -796,12 +851,12 @@ out:
         return err;
 }
 
-static void __exit ppdev_cleanup (void)
+static void __exit ppdev_cleanup(void)
 {
         /* Clean up all parport stuff */
         parport_unregister_driver(&pp_driver);
         class_destroy(ppdev_class);
-        unregister_chrdev (PP_MAJOR, CHRDEV);
+        unregister_chrdev(PP_MAJOR, CHRDEV);
 }
 
 module_init(ppdev_init);
diff --git a/drivers/char/raw.c b/drivers/char/raw.c
index 9b9809b709a5..e83b2adc014a 100644
--- a/drivers/char/raw.c
+++ b/drivers/char/raw.c
@@ -334,10 +334,8 @@ static int __init raw_init(void)
 
         cdev_init(&raw_cdev, &raw_fops);
         ret = cdev_add(&raw_cdev, dev, max_raw_minors);
-        if (ret) {
+        if (ret)
                 goto error_region;
-        }
-
         raw_class = class_create(THIS_MODULE, "raw");
         if (IS_ERR(raw_class)) {
                 printk(KERN_ERR "Error creating raw class.\n");
diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c
index 20de861aa0ea..8bf9914d4d15 100644
--- a/drivers/crypto/atmel-sha.c
+++ b/drivers/crypto/atmel-sha.c
@@ -782,7 +782,7 @@ static void atmel_sha_finish_req(struct ahash_request *req, int err)
         dd->flags &= ~(SHA_FLAGS_BUSY | SHA_FLAGS_FINAL | SHA_FLAGS_CPU |
                         SHA_FLAGS_DMA_READY | SHA_FLAGS_OUTPUT_READY);
 
-        clk_disable_unprepare(dd->iclk);
+        clk_disable(dd->iclk);
 
         if (req->base.complete)
                 req->base.complete(&req->base, err);
@@ -795,7 +795,7 @@ static int atmel_sha_hw_init(struct atmel_sha_dev *dd)
 {
         int err;
 
-        err = clk_prepare_enable(dd->iclk);
+        err = clk_enable(dd->iclk);
         if (err)
                 return err;
 
@@ -822,7 +822,7 @@ static void atmel_sha_hw_version_init(struct atmel_sha_dev *dd)
         dev_info(dd->dev,
                         "version: 0x%x\n", dd->hw_version);
 
-        clk_disable_unprepare(dd->iclk);
+        clk_disable(dd->iclk);
 }
 
 static int atmel_sha_handle_queue(struct atmel_sha_dev *dd,
@@ -1410,6 +1410,10 @@ static int atmel_sha_probe(struct platform_device *pdev)
                 goto res_err;
         }
 
+        err = clk_prepare(sha_dd->iclk);
+        if (err)
+                goto res_err;
+
         atmel_sha_hw_version_init(sha_dd);
 
         atmel_sha_get_cap(sha_dd);
@@ -1421,12 +1425,12 @@ static int atmel_sha_probe(struct platform_device *pdev)
                         if (IS_ERR(pdata)) {
                                 dev_err(&pdev->dev, "platform data not available\n");
                                 err = PTR_ERR(pdata);
-                                goto res_err;
+                                goto iclk_unprepare;
                         }
                 }
                 if (!pdata->dma_slave) {
                         err = -ENXIO;
-                        goto res_err;
+                        goto iclk_unprepare;
                 }
                 err = atmel_sha_dma_init(sha_dd, pdata);
                 if (err)
@@ -1457,6 +1461,8 @@ err_algs:
         if (sha_dd->caps.has_dma)
                 atmel_sha_dma_cleanup(sha_dd);
 err_sha_dma:
+iclk_unprepare:
+        clk_unprepare(sha_dd->iclk);
 res_err:
         tasklet_kill(&sha_dd->done_task);
 sha_dd_err:
@@ -1483,12 +1489,7 @@ static int atmel_sha_remove(struct platform_device *pdev)
         if (sha_dd->caps.has_dma)
                 atmel_sha_dma_cleanup(sha_dd);
 
-        iounmap(sha_dd->io_base);
-
-        clk_put(sha_dd->iclk);
-
-        if (sha_dd->irq >= 0)
-                free_irq(sha_dd->irq, sha_dd);
+        clk_unprepare(sha_dd->iclk);
 
         return 0;
 }
diff --git a/drivers/crypto/marvell/cesa.c b/drivers/crypto/marvell/cesa.c
index 0643e3366e33..c0656e7f37b5 100644
--- a/drivers/crypto/marvell/cesa.c
+++ b/drivers/crypto/marvell/cesa.c
@@ -306,7 +306,7 @@ static int mv_cesa_dev_dma_init(struct mv_cesa_dev *cesa)
                 return -ENOMEM;
 
         dma->padding_pool = dmam_pool_create("cesa_padding", dev, 72, 1, 0);
-        if (!dma->cache_pool)
+        if (!dma->padding_pool)
                 return -ENOMEM;
 
         cesa->dma = dma;
diff --git a/drivers/gpio/gpio-altera.c b/drivers/gpio/gpio-altera.c
index 2aeaebd1c6e7..3f87a03abc22 100644
--- a/drivers/gpio/gpio-altera.c
+++ b/drivers/gpio/gpio-altera.c
@@ -312,8 +312,8 @@ static int altera_gpio_probe(struct platform_device *pdev)
                 handle_simple_irq, IRQ_TYPE_NONE);
 
         if (ret) {
-                dev_info(&pdev->dev, "could not add irqchip\n");
-                return ret;
+                dev_err(&pdev->dev, "could not add irqchip\n");
+                goto teardown;
         }
 
         gpiochip_set_chained_irqchip(&altera_gc->mmchip.gc,
@@ -326,6 +326,7 @@ static int altera_gpio_probe(struct platform_device *pdev)
 skip_irq:
         return 0;
 teardown:
+        of_mm_gpiochip_remove(&altera_gc->mmchip);
         pr_err("%s: registration failed with status %d\n",
                 node->full_name, ret);
 
diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
index ec58f4288649..cd007a67b302 100644
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -195,7 +195,7 @@ static int davinci_gpio_of_xlate(struct gpio_chip *gc,
 static int davinci_gpio_probe(struct platform_device *pdev)
 {
         int i, base;
-        unsigned ngpio;
+        unsigned ngpio, nbank;
         struct davinci_gpio_controller *chips;
         struct davinci_gpio_platform_data *pdata;
         struct davinci_gpio_regs __iomem *regs;
@@ -224,8 +224,9 @@ static int davinci_gpio_probe(struct platform_device *pdev)
         if (WARN_ON(ARCH_NR_GPIOS < ngpio))
                 ngpio = ARCH_NR_GPIOS;
 
+        nbank = DIV_ROUND_UP(ngpio, 32);
         chips = devm_kzalloc(dev,
-                             ngpio * sizeof(struct davinci_gpio_controller),
+                             nbank * sizeof(struct davinci_gpio_controller),
                              GFP_KERNEL);
         if (!chips)
                 return -ENOMEM;
@@ -511,7 +512,7 @@ static int davinci_gpio_irq_setup(struct platform_device *pdev)
                         return irq;
                 }
 
-                irq_domain = irq_domain_add_legacy(NULL, ngpio, irq, 0,
+                irq_domain = irq_domain_add_legacy(dev->of_node, ngpio, irq, 0,
                                                         &davinci_gpio_irq_ops,
                                                         chips);
                 if (!irq_domain) {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
index 82edf95b7740..5e7770f9a415 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
@@ -87,6 +87,8 @@ extern int amdgpu_sched_jobs;
 extern int amdgpu_sched_hw_submission;
 extern int amdgpu_enable_semaphores;
 extern int amdgpu_powerplay;
+extern unsigned amdgpu_pcie_gen_cap;
+extern unsigned amdgpu_pcie_lane_cap;
 
 #define AMDGPU_WAIT_IDLE_TIMEOUT_IN_MS          3000
 #define AMDGPU_MAX_USEC_TIMEOUT                 100000  /* 100 ms */
@@ -132,47 +134,6 @@ extern int amdgpu_powerplay;
 #define AMDGPU_RESET_VCE                        (1 << 13)
 #define AMDGPU_RESET_VCE1                       (1 << 14)
 
-/* CG block flags */
-#define AMDGPU_CG_BLOCK_GFX                     (1 << 0)
-#define AMDGPU_CG_BLOCK_MC                      (1 << 1)
-#define AMDGPU_CG_BLOCK_SDMA                    (1 << 2)
-#define AMDGPU_CG_BLOCK_UVD                     (1 << 3)
-#define AMDGPU_CG_BLOCK_VCE                     (1 << 4)
-#define AMDGPU_CG_BLOCK_HDP                     (1 << 5)
-#define AMDGPU_CG_BLOCK_BIF                     (1 << 6)
-
-/* CG flags */
-#define AMDGPU_CG_SUPPORT_GFX_MGCG              (1 << 0)
-#define AMDGPU_CG_SUPPORT_GFX_MGLS              (1 << 1)
-#define AMDGPU_CG_SUPPORT_GFX_CGCG              (1 << 2)
-#define AMDGPU_CG_SUPPORT_GFX_CGLS              (1 << 3)
-#define AMDGPU_CG_SUPPORT_GFX_CGTS              (1 << 4)
-#define AMDGPU_CG_SUPPORT_GFX_CGTS_LS           (1 << 5)
-#define AMDGPU_CG_SUPPORT_GFX_CP_LS             (1 << 6)
-#define AMDGPU_CG_SUPPORT_GFX_RLC_LS            (1 << 7)
-#define AMDGPU_CG_SUPPORT_MC_LS                 (1 << 8)
-#define AMDGPU_CG_SUPPORT_MC_MGCG               (1 << 9)
-#define AMDGPU_CG_SUPPORT_SDMA_LS               (1 << 10)
-#define AMDGPU_CG_SUPPORT_SDMA_MGCG             (1 << 11)
-#define AMDGPU_CG_SUPPORT_BIF_LS                (1 << 12)
-#define AMDGPU_CG_SUPPORT_UVD_MGCG              (1 << 13)
-#define AMDGPU_CG_SUPPORT_VCE_MGCG              (1 << 14)
-#define AMDGPU_CG_SUPPORT_HDP_LS                (1 << 15)
-#define AMDGPU_CG_SUPPORT_HDP_MGCG              (1 << 16)
-
-/* PG flags */
-#define AMDGPU_PG_SUPPORT_GFX_PG                (1 << 0)
-#define AMDGPU_PG_SUPPORT_GFX_SMG               (1 << 1)
-#define AMDGPU_PG_SUPPORT_GFX_DMG               (1 << 2)
-#define AMDGPU_PG_SUPPORT_UVD                   (1 << 3)
-#define AMDGPU_PG_SUPPORT_VCE                   (1 << 4)
-#define AMDGPU_PG_SUPPORT_CP                    (1 << 5)
-#define AMDGPU_PG_SUPPORT_GDS                   (1 << 6)
-#define AMDGPU_PG_SUPPORT_RLC_SMU_HS            (1 << 7)
-#define AMDGPU_PG_SUPPORT_SDMA                  (1 << 8)
-#define AMDGPU_PG_SUPPORT_ACP                   (1 << 9)
-#define AMDGPU_PG_SUPPORT_SAMU                  (1 << 10)
-
 /* GFX current status */
 #define AMDGPU_GFX_NORMAL_MODE                  0x00000000L
 #define AMDGPU_GFX_SAFE_MODE                    0x00000001L
@@ -606,8 +567,6 @@ struct amdgpu_sa_manager {
         uint32_t                align;
 };
 
-struct amdgpu_sa_bo;
-
 /* sub-allocation buffer */
 struct amdgpu_sa_bo {
         struct list_head                olist;
@@ -2360,6 +2319,8 @@ bool amdgpu_ttm_bo_is_amdgpu_bo(struct ttm_buffer_object *bo);
 int amdgpu_ttm_tt_set_userptr(struct ttm_tt *ttm, uint64_t addr,
                                      uint32_t flags);
 bool amdgpu_ttm_tt_has_userptr(struct ttm_tt *ttm);
+bool amdgpu_ttm_tt_affect_userptr(struct ttm_tt *ttm, unsigned long start,
+                                  unsigned long end);
 bool amdgpu_ttm_tt_is_readonly(struct ttm_tt *ttm);
 uint32_t amdgpu_ttm_tt_pte_flags(struct amdgpu_device *adev, struct ttm_tt *ttm,
                                  struct ttm_mem_reg *mem);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
index a081dda9fa2f..7a4b101e10c6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
@@ -795,6 +795,12 @@ static int amdgpu_cgs_query_system_info(void *cgs_device,
         case CGS_SYSTEM_INFO_PCIE_MLW:
                 sys_info->value = adev->pm.pcie_mlw_mask;
                 break;
+        case CGS_SYSTEM_INFO_CG_FLAGS:
+                sys_info->value = adev->cg_flags;
+                break;
+        case CGS_SYSTEM_INFO_PG_FLAGS:
+                sys_info->value = adev->pg_flags;
+                break;
         default:
                 return -ENODEV;
         }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 65531463f88e..51bfc114584e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1795,15 +1795,20 @@ int amdgpu_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
         }
 
         /* post card */
-        amdgpu_atom_asic_init(adev->mode_info.atom_context);
+        if (!amdgpu_card_posted(adev))
+                amdgpu_atom_asic_init(adev->mode_info.atom_context);
 
         r = amdgpu_resume(adev);
+        if (r)
+                DRM_ERROR("amdgpu_resume failed (%d).\n", r);
 
         amdgpu_fence_driver_resume(adev);
 
-        r = amdgpu_ib_ring_tests(adev);
-        if (r)
-                DRM_ERROR("ib ring test failed (%d).\n", r);
+        if (resume) {
+                r = amdgpu_ib_ring_tests(adev);
+                if (r)
+                        DRM_ERROR("ib ring test failed (%d).\n", r);
+        }
 
         r = amdgpu_late_init(adev);
         if (r)
@@ -1933,80 +1938,97 @@ retry:
         return r;
 }
 
+#define AMDGPU_DEFAULT_PCIE_GEN_MASK 0x30007  /* gen: chipset 1/2, asic 1/2/3 */
+#define AMDGPU_DEFAULT_PCIE_MLW_MASK 0x2f0000 /* 1/2/4/8/16 lanes */
+
 void amdgpu_get_pcie_info(struct amdgpu_device *adev)
 {
         u32 mask;
         int ret;
 
-        if (pci_is_root_bus(adev->pdev->bus))
-                return;
+        if (amdgpu_pcie_gen_cap)
+                adev->pm.pcie_gen_mask = amdgpu_pcie_gen_cap;
 
-        if (amdgpu_pcie_gen2 == 0)
-                return;
+        if (amdgpu_pcie_lane_cap)
+                adev->pm.pcie_mlw_mask = amdgpu_pcie_lane_cap;
 
-        if (adev->flags & AMD_IS_APU)
+        /* covers APUs as well */
+        if (pci_is_root_bus(adev->pdev->bus)) {
+                if (adev->pm.pcie_gen_mask == 0)
+                        adev->pm.pcie_gen_mask = AMDGPU_DEFAULT_PCIE_GEN_MASK;
+                if (adev->pm.pcie_mlw_mask == 0)
+                        adev->pm.pcie_mlw_mask = AMDGPU_DEFAULT_PCIE_MLW_MASK;
                 return;
+        }
 
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
-        if (!ret) {
-                adev->pm.pcie_gen_mask = (CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1 |
-                                          CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2 |
-                                          CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3);
-
-                if (mask & DRM_PCIE_SPEED_25)
-                        adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1;
-                if (mask & DRM_PCIE_SPEED_50)
-                        adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2;
-                if (mask & DRM_PCIE_SPEED_80)
-                        adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3;
-        }
-        ret = drm_pcie_get_max_link_width(adev->ddev, &mask);
-        if (!ret) {
-                switch (mask) {
-                case 32:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X32 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 16:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 12:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 8:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 4:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 2:
-                        adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
-                                                  CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
-                        break;
-                case 1:
-                        adev->pm.pcie_mlw_mask = CAIL_PCIE_LINK_WIDTH_SUPPORT_X1;
-                        break;
-                default:
-                        break;
+        if (adev->pm.pcie_gen_mask == 0) {
+                ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
+                if (!ret) {
+                        adev->pm.pcie_gen_mask = (CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN1 |
+                                                  CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN2 |
+                                                  CAIL_ASIC_PCIE_LINK_SPEED_SUPPORT_GEN3);
+
+                        if (mask & DRM_PCIE_SPEED_25)
+                                adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN1;
+                        if (mask & DRM_PCIE_SPEED_50)
+                                adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2;
+                        if (mask & DRM_PCIE_SPEED_80)
+                                adev->pm.pcie_gen_mask |= CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3;
+                } else {
+                        adev->pm.pcie_gen_mask = AMDGPU_DEFAULT_PCIE_GEN_MASK;
+                }
+        }
+        if (adev->pm.pcie_mlw_mask == 0) {
+                ret = drm_pcie_get_max_link_width(adev->ddev, &mask);
+                if (!ret) {
+                        switch (mask) {
+                        case 32:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X32 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 16:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X16 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 12:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X12 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 8:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X8 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 4:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X4 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 2:
+                                adev->pm.pcie_mlw_mask = (CAIL_PCIE_LINK_WIDTH_SUPPORT_X2 |
+                                                          CAIL_PCIE_LINK_WIDTH_SUPPORT_X1);
+                                break;
+                        case 1:
+                                adev->pm.pcie_mlw_mask = CAIL_PCIE_LINK_WIDTH_SUPPORT_X1;
+                                break;
+                        default:
+                                break;
+                        }
+                } else {
+                        adev->pm.pcie_mlw_mask = AMDGPU_DEFAULT_PCIE_MLW_MASK;
                 }
         }
 }
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 9c1af8976bef..9ef1db87cf26 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -83,6 +83,8 @@ int amdgpu_sched_jobs = 32;
 int amdgpu_sched_hw_submission = 2;
 int amdgpu_enable_semaphores = 0;
 int amdgpu_powerplay = -1;
+unsigned amdgpu_pcie_gen_cap = 0;
+unsigned amdgpu_pcie_lane_cap = 0;
 
 MODULE_PARM_DESC(vramlimit, "Restrict VRAM for testing, in megabytes");
 module_param_named(vramlimit, amdgpu_vram_limit, int, 0600);
@@ -170,6 +172,12 @@ MODULE_PARM_DESC(powerplay, "Powerplay component (1 = enable, 0 = disable, -1 =
 module_param_named(powerplay, amdgpu_powerplay, int, 0444);
 #endif
 
+MODULE_PARM_DESC(pcie_gen_cap, "PCIE Gen Caps (0: autodetect (default))");
+module_param_named(pcie_gen_cap, amdgpu_pcie_gen_cap, uint, 0444);
+
+MODULE_PARM_DESC(pcie_lane_cap, "PCIE Lane Caps (0: autodetect (default))");
+module_param_named(pcie_lane_cap, amdgpu_pcie_lane_cap, uint, 0444);
+
 static struct pci_device_id pciidlist[] = {
 #ifdef CONFIG_DRM_AMDGPU_CIK
         /* Kaveri */
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
index b1969f2b2038..d4e2780c0796 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_mn.c
@@ -142,7 +142,8 @@ static void amdgpu_mn_invalidate_range_start(struct mmu_notifier *mn,
 
                 list_for_each_entry(bo, &node->bos, mn_list) {
 
-                        if (!bo->tbo.ttm || bo->tbo.ttm->state != tt_bound)
+                        if (!amdgpu_ttm_tt_affect_userptr(bo->tbo.ttm, start,
+                                                          end))
                                 continue;
 
                         r = amdgpu_bo_reserve(bo, true);
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
index 8b88edb0434b..ca72a2e487b9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sa.c
@@ -354,12 +354,15 @@ int amdgpu_sa_bo_new(struct amdgpu_sa_manager *sa_manager,
 
                 for (i = 0, count = 0; i < AMDGPU_MAX_RINGS; ++i)
                         if (fences[i])
-                                fences[count++] = fences[i];
+                                fences[count++] = fence_get(fences[i]);
 
                 if (count) {
                         spin_unlock(&sa_manager->wq.lock);
                         t = fence_wait_any_timeout(fences, count, false,
                                                    MAX_SCHEDULE_TIMEOUT);
+                        for (i = 0; i < count; ++i)
+                                fence_put(fences[i]);
+
                         r = (t > 0) ? 0 : t;
                         spin_lock(&sa_manager->wq.lock);
                 } else {
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 55cf05e1c81c..6442a06d6fdc 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -783,6 +783,25 @@ bool amdgpu_ttm_tt_has_userptr(struct ttm_tt *ttm)
         return !!gtt->userptr;
 }
 
+bool amdgpu_ttm_tt_affect_userptr(struct ttm_tt *ttm, unsigned long start,
+                                  unsigned long end)
+{
+        struct amdgpu_ttm_tt *gtt = (void *)ttm;
+        unsigned long size;
+
+        if (gtt == NULL)
+                return false;
+
+        if (gtt->ttm.ttm.state != tt_bound || !gtt->userptr)
+                return false;
+
+        size = (unsigned long)gtt->ttm.ttm.num_pages * PAGE_SIZE;
+        if (gtt->userptr > end || gtt->userptr + size <= start)
+                return false;
+
+        return true;
+}
+
 bool amdgpu_ttm_tt_is_readonly(struct ttm_tt *ttm)
 {
         struct amdgpu_ttm_tt *gtt = (void *)ttm;
diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
index 8b4731d4e10e..474ca02b0949 100644
--- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c
@@ -31,6 +31,7 @@
 #include "ci_dpm.h"
 #include "gfx_v7_0.h"
 #include "atom.h"
+#include "amd_pcie.h"
 #include <linux/seq_file.h>
 
 #include "smu/smu_7_0_1_d.h"
@@ -5835,18 +5836,16 @@ static int ci_dpm_init(struct amdgpu_device *adev)
         u8 frev, crev;
         struct ci_power_info *pi;
         int ret;
-        u32 mask;
 
         pi = kzalloc(sizeof(struct ci_power_info), GFP_KERNEL);
         if (pi == NULL)
                 return -ENOMEM;
         adev->pm.dpm.priv = pi;
 
-        ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask);
-        if (ret)
-                pi->sys_pcie_mask = 0;
-        else
-                pi->sys_pcie_mask = mask;
+        pi->sys_pcie_mask =
+                (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_MASK) >>
+                CAIL_PCIE_LINK_SPEED_SUPPORT_SHIFT;
+
         pi->force_pcie_gen = AMDGPU_PCIE_GEN_INVALID;
 
         pi->pcie_gen_performance.max = AMDGPU_PCIE_GEN1;
diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
index fd9c9588ef46..155965ed14a3 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik.c
@@ -1762,6 +1762,9 @@ static void cik_program_aspm(struct amdgpu_device *adev)
         if (amdgpu_aspm == 0)
                 return;
 
+        if (pci_is_root_bus(adev->pdev->bus))
+                return;
+
         /* XXX double check APUs */
         if (adev->flags & AMD_IS_APU)
                 return;
@@ -2332,72 +2335,72 @@ static int cik_common_early_init(void *handle)
         switch (adev->asic_type) {
         case CHIP_BONAIRE:
                 adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS_LS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_MC_LS |
-                        AMDGPU_CG_SUPPORT_MC_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGLS |
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
+                        AMD_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_MC_LS |
+                        AMD_CG_SUPPORT_MC_MGCG |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_MGCG;
                 adev->pg_flags = 0;
                 adev->external_rev_id = adev->rev_id + 0x14;
                 break;
         case CHIP_HAWAII:
                 adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_MC_LS |
-                        AMDGPU_CG_SUPPORT_MC_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGLS |
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
+                        AMD_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_MC_LS |
+                        AMD_CG_SUPPORT_MC_MGCG |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_MGCG;
                 adev->pg_flags = 0;
                 adev->external_rev_id = 0x28;
                 break;
         case CHIP_KAVERI:
                 adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS_LS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGLS |
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
+                        AMD_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_MGCG;
                 adev->pg_flags =
-                        /*AMDGPU_PG_SUPPORT_GFX_PG |
-                          AMDGPU_PG_SUPPORT_GFX_SMG |
-                          AMDGPU_PG_SUPPORT_GFX_DMG |*/
-                        AMDGPU_PG_SUPPORT_UVD |
-                        /*AMDGPU_PG_SUPPORT_VCE |
-                          AMDGPU_PG_SUPPORT_CP |
-                          AMDGPU_PG_SUPPORT_GDS |
-                          AMDGPU_PG_SUPPORT_RLC_SMU_HS |
-                          AMDGPU_PG_SUPPORT_ACP |
-                          AMDGPU_PG_SUPPORT_SAMU |*/
+                        /*AMD_PG_SUPPORT_GFX_PG |
+                          AMD_PG_SUPPORT_GFX_SMG |
+                          AMD_PG_SUPPORT_GFX_DMG |*/
+                        AMD_PG_SUPPORT_UVD |
+                        /*AMD_PG_SUPPORT_VCE |
+                          AMD_PG_SUPPORT_CP |
+                          AMD_PG_SUPPORT_GDS |
+                          AMD_PG_SUPPORT_RLC_SMU_HS |
+                          AMD_PG_SUPPORT_ACP |
+                          AMD_PG_SUPPORT_SAMU |*/
                         0;
                 if (adev->pdev->device == 0x1312 ||
                         adev->pdev->device == 0x1316 ||
@@ -2409,29 +2412,29 @@ static int cik_common_early_init(void *handle)
         case CHIP_KABINI:
         case CHIP_MULLINS:
                 adev->cg_flags =
-                        AMDGPU_CG_SUPPORT_GFX_MGCG |
-                        AMDGPU_CG_SUPPORT_GFX_MGLS |
-                        /*AMDGPU_CG_SUPPORT_GFX_CGCG |*/
-                        AMDGPU_CG_SUPPORT_GFX_CGLS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS |
-                        AMDGPU_CG_SUPPORT_GFX_CGTS_LS |
-                        AMDGPU_CG_SUPPORT_GFX_CP_LS |
-                        AMDGPU_CG_SUPPORT_SDMA_MGCG |
-                        AMDGPU_CG_SUPPORT_SDMA_LS |
-                        AMDGPU_CG_SUPPORT_BIF_LS |
-                        AMDGPU_CG_SUPPORT_VCE_MGCG |
-                        AMDGPU_CG_SUPPORT_UVD_MGCG |
-                        AMDGPU_CG_SUPPORT_HDP_LS |
-                        AMDGPU_CG_SUPPORT_HDP_MGCG;
+                        AMD_CG_SUPPORT_GFX_MGCG |
+                        AMD_CG_SUPPORT_GFX_MGLS |
+                        /*AMD_CG_SUPPORT_GFX_CGCG |*/
+                        AMD_CG_SUPPORT_GFX_CGLS |
+                        AMD_CG_SUPPORT_GFX_CGTS |
+                        AMD_CG_SUPPORT_GFX_CGTS_LS |
+                        AMD_CG_SUPPORT_GFX_CP_LS |
+                        AMD_CG_SUPPORT_SDMA_MGCG |
+                        AMD_CG_SUPPORT_SDMA_LS |
+                        AMD_CG_SUPPORT_BIF_LS |
+                        AMD_CG_SUPPORT_VCE_MGCG |
+                        AMD_CG_SUPPORT_UVD_MGCG |
+                        AMD_CG_SUPPORT_HDP_LS |
+                        AMD_CG_SUPPORT_HDP_MGCG;
                 adev->pg_flags =
-                        /*AMDGPU_PG_SUPPORT_GFX_PG |
-                          AMDGPU_PG_SUPPORT_GFX_SMG | */
-                        AMDGPU_PG_SUPPORT_UVD |
-                        /*AMDGPU_PG_SUPPORT_VCE |
-                          AMDGPU_PG_SUPPORT_CP |
-                          AMDGPU_PG_SUPPORT_GDS |
-                          AMDGPU_PG_SUPPORT_RLC_SMU_HS |
-                          AMDGPU_PG_SUPPORT_SAMU |*/
+                        /*AMD_PG_SUPPORT_GFX_PG |
+                          AMD_PG_SUPPORT_GFX_SMG | */
+                        AMD_PG_SUPPORT_UVD |
+                        /*AMD_PG_SUPPORT_VCE |
+                          AMD_PG_SUPPORT_CP |
+                          AMD_PG_SUPPORT_GDS |
+                          AMD_PG_SUPPORT_RLC_SMU_HS |
+                          AMD_PG_SUPPORT_SAMU |*/
                         0;
                 if (adev->asic_type == CHIP_KABINI) {
                         if (adev->rev_id == 0)
diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
index 5f712ceddf08..c55ecf0ea845 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c
@@ -885,7 +885,7 @@ static void cik_enable_sdma_mgcg(struct amdgpu_device *adev,
 {
         u32 orig, data;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_SDMA_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_SDMA_MGCG)) {
                 WREG32(mmSDMA0_CLK_CTRL + SDMA0_REGISTER_OFFSET, 0x00000100);
                 WREG32(mmSDMA0_CLK_CTRL + SDMA1_REGISTER_OFFSET, 0x00000100);
         } else {
@@ -906,7 +906,7 @@ static void cik_enable_sdma_mgls(struct amdgpu_device *adev,
 {
         u32 orig, data;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_SDMA_LS)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_SDMA_LS)) {
                 orig = data = RREG32(mmSDMA0_POWER_CNTL + SDMA0_REGISTER_OFFSET);
                 data |= 0x100;
                 if (orig != data)
diff --git a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
index 4dd17f2dd905..9056355309d1 100644
--- a/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/cz_dpm.c
@@ -445,13 +445,13 @@ static int cz_dpm_init(struct amdgpu_device *adev)
         pi->gfx_pg_threshold = 500;
         pi->caps_fps = true;
         /* uvd */
-        pi->caps_uvd_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_UVD) ? true : false;
+        pi->caps_uvd_pg = (adev->pg_flags & AMD_PG_SUPPORT_UVD) ? true : false;
         pi->caps_uvd_dpm = true;
         /* vce */
-        pi->caps_vce_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_VCE) ? true : false;
+        pi->caps_vce_pg = (adev->pg_flags & AMD_PG_SUPPORT_VCE) ? true : false;
         pi->caps_vce_dpm = true;
         /* acp */
-        pi->caps_acp_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_ACP) ? true : false;
+        pi->caps_acp_pg = (adev->pg_flags & AMD_PG_SUPPORT_ACP) ? true : false;
         pi->caps_acp_dpm = true;
 
         pi->caps_stable_power_state = false;
diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
index 6c76139de1c9..7732059ae30f 100644
--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c
@@ -4109,7 +4109,7 @@ static void gfx_v7_0_enable_cgcg(struct amdgpu_device *adev, bool enable)
 
         orig = data = RREG32(mmRLC_CGCG_CGLS_CTRL);
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGCG)) {
                 gfx_v7_0_enable_gui_idle_interrupt(adev, true);
 
                 tmp = gfx_v7_0_halt_rlc(adev);
@@ -4147,9 +4147,9 @@ static void gfx_v7_0_enable_mgcg(struct amdgpu_device *adev, bool enable)
 {
         u32 data, orig, tmp = 0;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_MGCG)) {
-                if (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_MGLS) {
-                        if (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CP_LS) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_GFX_MGCG)) {
+                if (adev->cg_flags & AMD_CG_SUPPORT_GFX_MGLS) {
+                        if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CP_LS) {
                                 orig = data = RREG32(mmCP_MEM_SLP_CNTL);
                                 data |= CP_MEM_SLP_CNTL__CP_MEM_LS_EN_MASK;
                                 if (orig != data)
@@ -4176,14 +4176,14 @@ static void gfx_v7_0_enable_mgcg(struct amdgpu_device *adev, bool enable)
 
                 gfx_v7_0_update_rlc(adev, tmp);
 
-                if (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CGTS) {
+                if (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGTS) {
                         orig = data = RREG32(mmCGTS_SM_CTRL_REG);
                         data &= ~CGTS_SM_CTRL_REG__SM_MODE_MASK;
                         data |= (0x2 << CGTS_SM_CTRL_REG__SM_MODE__SHIFT);
                         data |= CGTS_SM_CTRL_REG__SM_MODE_ENABLE_MASK;
                         data &= ~CGTS_SM_CTRL_REG__OVERRIDE_MASK;
-                        if ((adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_MGLS) &&
-                            (adev->cg_flags & AMDGPU_CG_SUPPORT_GFX_CGTS_LS))
+                        if ((adev->cg_flags & AMD_CG_SUPPORT_GFX_MGLS) &&
+                            (adev->cg_flags & AMD_CG_SUPPORT_GFX_CGTS_LS))
                                 data &= ~CGTS_SM_CTRL_REG__LS_OVERRIDE_MASK;
                         data &= ~CGTS_SM_CTRL_REG__ON_MONITOR_ADD_MASK;
                         data |= CGTS_SM_CTRL_REG__ON_MONITOR_ADD_EN_MASK;
@@ -4249,7 +4249,7 @@ static void gfx_v7_0_enable_sclk_slowdown_on_pu(struct amdgpu_device *adev,
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_RLC_SMU_HS))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_RLC_SMU_HS))
                 data |= RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PU_ENABLE_MASK;
         else
                 data &= ~RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PU_ENABLE_MASK;
@@ -4263,7 +4263,7 @@ static void gfx_v7_0_enable_sclk_slowdown_on_pd(struct amdgpu_device *adev,
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_RLC_SMU_HS))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_RLC_SMU_HS))
                 data |= RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PD_ENABLE_MASK;
         else
                 data &= ~RLC_PG_CNTL__SMU_CLK_SLOWDOWN_ON_PD_ENABLE_MASK;
@@ -4276,7 +4276,7 @@ static void gfx_v7_0_enable_cp_pg(struct amdgpu_device *adev, bool enable)
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_CP))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_CP))
                 data &= ~0x8000;
         else
                 data |= 0x8000;
@@ -4289,7 +4289,7 @@ static void gfx_v7_0_enable_gds_pg(struct amdgpu_device *adev, bool enable)
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GDS))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GDS))
                 data &= ~0x2000;
         else
                 data |= 0x2000;
@@ -4370,7 +4370,7 @@ static void gfx_v7_0_enable_gfx_cgpg(struct amdgpu_device *adev,
 {
         u32 data, orig;
 
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG)) {
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG)) {
                 orig = data = RREG32(mmRLC_PG_CNTL);
                 data |= RLC_PG_CNTL__GFX_POWER_GATING_ENABLE_MASK;
                 if (orig != data)
@@ -4442,7 +4442,7 @@ static void gfx_v7_0_enable_gfx_static_mgpg(struct amdgpu_device *adev,
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_SMG))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_SMG))
                 data |= RLC_PG_CNTL__STATIC_PER_CU_PG_ENABLE_MASK;
         else
                 data &= ~RLC_PG_CNTL__STATIC_PER_CU_PG_ENABLE_MASK;
@@ -4456,7 +4456,7 @@ static void gfx_v7_0_enable_gfx_dynamic_mgpg(struct amdgpu_device *adev,
         u32 data, orig;
 
         orig = data = RREG32(mmRLC_PG_CNTL);
-        if (enable && (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_DMG))
+        if (enable && (adev->pg_flags & AMD_PG_SUPPORT_GFX_DMG))
                 data |= RLC_PG_CNTL__DYN_PER_CU_PG_ENABLE_MASK;
         else
                 data &= ~RLC_PG_CNTL__DYN_PER_CU_PG_ENABLE_MASK;
@@ -4623,15 +4623,15 @@ static void gfx_v7_0_get_csb_buffer(struct amdgpu_device *adev,
 
 static void gfx_v7_0_init_pg(struct amdgpu_device *adev)
 {
-        if (adev->pg_flags & (AMDGPU_PG_SUPPORT_GFX_PG |
-                              AMDGPU_PG_SUPPORT_GFX_SMG |
-                              AMDGPU_PG_SUPPORT_GFX_DMG |
-                              AMDGPU_PG_SUPPORT_CP |
-                              AMDGPU_PG_SUPPORT_GDS |
-                              AMDGPU_PG_SUPPORT_RLC_SMU_HS)) {
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_PG |
+                              AMD_PG_SUPPORT_GFX_SMG |
+                              AMD_PG_SUPPORT_GFX_DMG |
+                              AMD_PG_SUPPORT_CP |
+                              AMD_PG_SUPPORT_GDS |
+                              AMD_PG_SUPPORT_RLC_SMU_HS)) {
                 gfx_v7_0_enable_sclk_slowdown_on_pu(adev, true);
                 gfx_v7_0_enable_sclk_slowdown_on_pd(adev, true);
-                if (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG) {
+                if (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) {
                         gfx_v7_0_init_gfx_cgpg(adev);
                         gfx_v7_0_enable_cp_pg(adev, true);
                         gfx_v7_0_enable_gds_pg(adev, true);
@@ -4643,14 +4643,14 @@ static void gfx_v7_0_init_pg(struct amdgpu_device *adev)
 
 static void gfx_v7_0_fini_pg(struct amdgpu_device *adev)
 {
-        if (adev->pg_flags & (AMDGPU_PG_SUPPORT_GFX_PG |
-                              AMDGPU_PG_SUPPORT_GFX_SMG |
-                              AMDGPU_PG_SUPPORT_GFX_DMG |
-                              AMDGPU_PG_SUPPORT_CP |
-                              AMDGPU_PG_SUPPORT_GDS |
-                              AMDGPU_PG_SUPPORT_RLC_SMU_HS)) {
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_PG |
+                              AMD_PG_SUPPORT_GFX_SMG |
+                              AMD_PG_SUPPORT_GFX_DMG |
+                              AMD_PG_SUPPORT_CP |
+                              AMD_PG_SUPPORT_GDS |
+                              AMD_PG_SUPPORT_RLC_SMU_HS)) {
                 gfx_v7_0_update_gfx_pg(adev, false);
-                if (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG) {
+                if (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) {
                         gfx_v7_0_enable_cp_pg(adev, false);
                         gfx_v7_0_enable_gds_pg(adev, false);
                 }
@@ -5527,14 +5527,14 @@ static int gfx_v7_0_set_powergating_state(void *handle,
         if (state == AMD_PG_STATE_GATE)
                 gate = true;
 
-        if (adev->pg_flags & (AMDGPU_PG_SUPPORT_GFX_PG |
-                              AMDGPU_PG_SUPPORT_GFX_SMG |
-                              AMDGPU_PG_SUPPORT_GFX_DMG |
-                              AMDGPU_PG_SUPPORT_CP |
-                              AMDGPU_PG_SUPPORT_GDS |
-                              AMDGPU_PG_SUPPORT_RLC_SMU_HS)) {
+        if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_PG |
+                              AMD_PG_SUPPORT_GFX_SMG |
+                              AMD_PG_SUPPORT_GFX_DMG |
+                              AMD_PG_SUPPORT_CP |
+                              AMD_PG_SUPPORT_GDS |
+                              AMD_PG_SUPPORT_RLC_SMU_HS)) {
                 gfx_v7_0_update_gfx_pg(adev, gate);
-                if (adev->pg_flags & AMDGPU_PG_SUPPORT_GFX_PG) {
+                if (adev->pg_flags & AMD_PG_SUPPORT_GFX_PG) {
                         gfx_v7_0_enable_cp_pg(adev, gate);
                         gfx_v7_0_enable_gds_pg(adev, gate);
                 }
diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
index 8aa2991ab379..b8060795b27b 100644
--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
@@ -792,7 +792,7 @@ static void gmc_v7_0_enable_mc_ls(struct amdgpu_device *adev,
 
         for (i = 0; i < ARRAY_SIZE(mc_cg_registers); i++) {
                 orig = data = RREG32(mc_cg_registers[i]);
-                if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_MC_LS))
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_MC_LS))
                         data |= mc_cg_ls_en[i];
                 else
                         data &= ~mc_cg_ls_en[i];
@@ -809,7 +809,7 @@ static void gmc_v7_0_enable_mc_mgcg(struct amdgpu_device *adev,
 
         for (i = 0; i < ARRAY_SIZE(mc_cg_registers); i++) {
                 orig = data = RREG32(mc_cg_registers[i]);
-                if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_MC_MGCG))
+                if (enable && (adev->cg_flags & AMD_CG_SUPPORT_MC_MGCG))
                         data |= mc_cg_en[i];
                 else
                         data &= ~mc_cg_en[i];
@@ -825,7 +825,7 @@ static void gmc_v7_0_enable_bif_mgls(struct amdgpu_device *adev,
 
         orig = data = RREG32_PCIE(ixPCIE_CNTL2);
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_BIF_LS)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_BIF_LS)) {
                 data = REG_SET_FIELD(data, PCIE_CNTL2, SLV_MEM_LS_EN, 1);
                 data = REG_SET_FIELD(data, PCIE_CNTL2, MST_MEM_LS_EN, 1);
                 data = REG_SET_FIELD(data, PCIE_CNTL2, REPLAY_MEM_LS_EN, 1);
@@ -848,7 +848,7 @@ static void gmc_v7_0_enable_hdp_mgcg(struct amdgpu_device *adev,
 
         orig = data = RREG32(mmHDP_HOST_PATH_CNTL);
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_HDP_MGCG))
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_MGCG))
                 data = REG_SET_FIELD(data, HDP_HOST_PATH_CNTL, CLOCK_GATING_DIS, 0);
         else
                 data = REG_SET_FIELD(data, HDP_HOST_PATH_CNTL, CLOCK_GATING_DIS, 1);
@@ -864,7 +864,7 @@ static void gmc_v7_0_enable_hdp_ls(struct amdgpu_device *adev,
 
         orig = data = RREG32(mmHDP_MEM_POWER_LS);
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_HDP_LS))
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_HDP_LS))
                 data = REG_SET_FIELD(data, HDP_MEM_POWER_LS, LS_ENABLE, 1);
         else
                 data = REG_SET_FIELD(data, HDP_MEM_POWER_LS, LS_ENABLE, 0);
diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
index 7e9154c7f1db..654d76723bc3 100644
--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
@@ -2859,11 +2859,11 @@ static int kv_dpm_init(struct amdgpu_device *adev)
         pi->voltage_drop_t = 0;
         pi->caps_sclk_throttle_low_notification = false;
         pi->caps_fps = false; /* true? */
-        pi->caps_uvd_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_UVD) ? true : false;
+        pi->caps_uvd_pg = (adev->pg_flags & AMD_PG_SUPPORT_UVD) ? true : false;
         pi->caps_uvd_dpm = true;
-        pi->caps_vce_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_VCE) ? true : false;
-        pi->caps_samu_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_SAMU) ? true : false;
-        pi->caps_acp_pg = (adev->pg_flags & AMDGPU_PG_SUPPORT_ACP) ? true : false;
+        pi->caps_vce_pg = (adev->pg_flags & AMD_PG_SUPPORT_VCE) ? true : false;
+        pi->caps_samu_pg = (adev->pg_flags & AMD_PG_SUPPORT_SAMU) ? true : false;
+        pi->caps_acp_pg = (adev->pg_flags & AMD_PG_SUPPORT_ACP) ? true : false;
         pi->caps_stable_p_state = false;
 
         ret = kv_parse_sys_info_table(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
index 5e9f73af83a8..fbd3767671bb 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v4_2.c
@@ -611,7 +611,7 @@ static void uvd_v4_2_enable_mgcg(struct amdgpu_device *adev,
 {
         u32 orig, data;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_UVD_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG)) {
                 data = RREG32_UVD_CTX(ixUVD_CGC_MEM_CTRL);
                 data = 0xfff;
                 WREG32_UVD_CTX(ixUVD_CGC_MEM_CTRL, data);
@@ -830,6 +830,9 @@ static int uvd_v4_2_set_clockgating_state(void *handle,
         bool gate = false;
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
+                return 0;
+
         if (state == AMD_CG_STATE_GATE)
                 gate = true;
 
@@ -848,7 +851,10 @@ static int uvd_v4_2_set_powergating_state(void *handle,
          * revisit this when there is a cleaner line between
          * the smc and the hw blocks
          */
-         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
+                return 0;
 
         if (state == AMD_PG_STATE_GATE) {
                 uvd_v4_2_stop(adev);
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
index 38864f562981..57f1c5bf3bf1 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v5_0.c
@@ -774,6 +774,11 @@ static int uvd_v5_0_process_interrupt(struct amdgpu_device *adev,
 static int uvd_v5_0_set_clockgating_state(void *handle,
                                           enum amd_clockgating_state state)
 {
+        struct amdgpu_device *adev = (struct amdgpu_device *)handle;
+
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
+                return 0;
+
         return 0;
 }
 
@@ -789,6 +794,9 @@ static int uvd_v5_0_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
+                return 0;
+
         if (state == AMD_PG_STATE_GATE) {
                 uvd_v5_0_stop(adev);
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
index 3d5913926436..0b365b7651ff 100644
--- a/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/uvd_v6_0.c
@@ -532,7 +532,7 @@ static int uvd_v6_0_start(struct amdgpu_device *adev)
         uvd_v6_0_mc_resume(adev);
 
         /* Set dynamic clock gating in S/W control mode */
-        if (adev->cg_flags & AMDGPU_CG_SUPPORT_UVD_MGCG) {
+        if (adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG) {
                 if (adev->flags & AMD_IS_APU)
                         cz_set_uvd_clock_gating_branches(adev, false);
                 else
@@ -1000,7 +1000,7 @@ static int uvd_v6_0_set_clockgating_state(void *handle,
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
         bool enable = (state == AMD_CG_STATE_GATE) ? true : false;
 
-        if (!(adev->cg_flags & AMDGPU_CG_SUPPORT_UVD_MGCG))
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_UVD_MGCG))
                 return 0;
 
         if (enable) {
@@ -1030,6 +1030,9 @@ static int uvd_v6_0_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_UVD))
+                return 0;
+
         if (state == AMD_PG_STATE_GATE) {
                 uvd_v6_0_stop(adev);
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c
index 52ac7a8f1e58..a822edacfa95 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v2_0.c
@@ -373,7 +373,7 @@ static void vce_v2_0_enable_mgcg(struct amdgpu_device *adev, bool enable)
 {
         bool sw_cg = false;
 
-        if (enable && (adev->cg_flags & AMDGPU_CG_SUPPORT_VCE_MGCG)) {
+        if (enable && (adev->cg_flags & AMD_CG_SUPPORT_VCE_MGCG)) {
                 if (sw_cg)
                         vce_v2_0_set_sw_cg(adev, true);
                 else
@@ -608,6 +608,9 @@ static int vce_v2_0_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_VCE))
+                return 0;
+
         if (state == AMD_PG_STATE_GATE)
                 /* XXX do we need a vce_v2_0_stop()? */
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
index e99af81e4aec..d662fa9f9091 100644
--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c
@@ -277,7 +277,7 @@ static int vce_v3_0_start(struct amdgpu_device *adev)
                 WREG32_P(mmVCE_STATUS, 0, ~1);
 
                 /* Set Clock-Gating off */
-                if (adev->cg_flags & AMDGPU_CG_SUPPORT_VCE_MGCG)
+                if (adev->cg_flags & AMD_CG_SUPPORT_VCE_MGCG)
                         vce_v3_0_set_vce_sw_clock_gating(adev, false);
 
                 if (r) {
@@ -676,7 +676,7 @@ static int vce_v3_0_set_clockgating_state(void *handle,
         bool enable = (state == AMD_CG_STATE_GATE) ? true : false;
         int i;
 
-        if (!(adev->cg_flags & AMDGPU_CG_SUPPORT_VCE_MGCG))
+        if (!(adev->cg_flags & AMD_CG_SUPPORT_VCE_MGCG))
                 return 0;
 
         mutex_lock(&adev->grbm_idx_mutex);
@@ -728,6 +728,9 @@ static int vce_v3_0_set_powergating_state(void *handle,
          */
         struct amdgpu_device *adev = (struct amdgpu_device *)handle;
 
+        if (!(adev->pg_flags & AMD_PG_SUPPORT_VCE))
+                return 0;
+
         if (state == AMD_PG_STATE_GATE)
                 /* XXX do we need a vce_v3_0_stop()? */
                 return 0;
diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c
index 89f5a1ff6f43..0d14d108a6c4 100644
--- a/drivers/gpu/drm/amd/amdgpu/vi.c
+++ b/drivers/gpu/drm/amd/amdgpu/vi.c
@@ -1457,8 +1457,7 @@ static int vi_common_early_init(void *handle)
         case CHIP_STONEY:
                 adev->has_uvd = true;
                 adev->cg_flags = 0;
-                /* Disable UVD pg */
-                adev->pg_flags = /* AMDGPU_PG_SUPPORT_UVD | */AMDGPU_PG_SUPPORT_VCE;
+                adev->pg_flags = 0;
                 adev->external_rev_id = adev->rev_id + 0x1;
                 break;
         default:
diff --git a/drivers/gpu/drm/amd/include/amd_shared.h b/drivers/gpu/drm/amd/include/amd_shared.h
index 1195d06f55bc..dbf7e6413cab 100644
--- a/drivers/gpu/drm/amd/include/amd_shared.h
+++ b/drivers/gpu/drm/amd/include/amd_shared.h
@@ -85,6 +85,38 @@ enum amd_powergating_state {
         AMD_PG_STATE_UNGATE,
 };
 
+/* CG flags */
+#define AMD_CG_SUPPORT_GFX_MGCG                 (1 << 0)
+#define AMD_CG_SUPPORT_GFX_MGLS                 (1 << 1)
+#define AMD_CG_SUPPORT_GFX_CGCG                 (1 << 2)
+#define AMD_CG_SUPPORT_GFX_CGLS                 (1 << 3)
+#define AMD_CG_SUPPORT_GFX_CGTS                 (1 << 4)
+#define AMD_CG_SUPPORT_GFX_CGTS_LS              (1 << 5)
+#define AMD_CG_SUPPORT_GFX_CP_LS                (1 << 6)
+#define AMD_CG_SUPPORT_GFX_RLC_LS               (1 << 7)
+#define AMD_CG_SUPPORT_MC_LS                    (1 << 8)
+#define AMD_CG_SUPPORT_MC_MGCG                  (1 << 9)
+#define AMD_CG_SUPPORT_SDMA_LS                  (1 << 10)
+#define AMD_CG_SUPPORT_SDMA_MGCG                (1 << 11)
+#define AMD_CG_SUPPORT_BIF_LS                   (1 << 12)
+#define AMD_CG_SUPPORT_UVD_MGCG                 (1 << 13)
+#define AMD_CG_SUPPORT_VCE_MGCG                 (1 << 14)
+#define AMD_CG_SUPPORT_HDP_LS                   (1 << 15)
+#define AMD_CG_SUPPORT_HDP_MGCG                 (1 << 16)
+
+/* PG flags */
+#define AMD_PG_SUPPORT_GFX_PG                   (1 << 0)
+#define AMD_PG_SUPPORT_GFX_SMG                  (1 << 1)
+#define AMD_PG_SUPPORT_GFX_DMG                  (1 << 2)
+#define AMD_PG_SUPPORT_UVD                      (1 << 3)
+#define AMD_PG_SUPPORT_VCE                      (1 << 4)
+#define AMD_PG_SUPPORT_CP                       (1 << 5)
+#define AMD_PG_SUPPORT_GDS                      (1 << 6)
+#define AMD_PG_SUPPORT_RLC_SMU_HS               (1 << 7)
+#define AMD_PG_SUPPORT_SDMA                     (1 << 8)
+#define AMD_PG_SUPPORT_ACP                      (1 << 9)
+#define AMD_PG_SUPPORT_SAMU                     (1 << 10)
+
 enum amd_pm_state_type {
         /* not used for dpm */
         POWER_STATE_TYPE_DEFAULT,
diff --git a/drivers/gpu/drm/amd/include/cgs_common.h b/drivers/gpu/drm/amd/include/cgs_common.h
index 713aec954692..aec38fc3834f 100644
--- a/drivers/gpu/drm/amd/include/cgs_common.h
+++ b/drivers/gpu/drm/amd/include/cgs_common.h
@@ -109,6 +109,8 @@ enum cgs_system_info_id {
         CGS_SYSTEM_INFO_ADAPTER_BDF_ID = 1,
         CGS_SYSTEM_INFO_PCIE_GEN_INFO,
         CGS_SYSTEM_INFO_PCIE_MLW,
+        CGS_SYSTEM_INFO_CG_FLAGS,
+        CGS_SYSTEM_INFO_PG_FLAGS,
         CGS_SYSTEM_INFO_ID_MAXIMUM,
 };
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
index 0874ab42ee95..cf01177ca3b5 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_hwmgr.c
@@ -174,6 +174,8 @@ static int cz_initialize_dpm_defaults(struct pp_hwmgr *hwmgr)
 {
         struct cz_hwmgr *cz_hwmgr = (struct cz_hwmgr *)(hwmgr->backend);
         uint32_t i;
+        struct cgs_system_info sys_info = {0};
+        int result;
 
         cz_hwmgr->gfx_ramp_step = 256*25/100;
 
@@ -247,6 +249,22 @@ static int cz_initialize_dpm_defaults(struct pp_hwmgr *hwmgr)
         phm_cap_set(hwmgr->platform_descriptor.platformCaps,
                                    PHM_PlatformCaps_DisableVoltageIsland);
 
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_UVDPowerGating);
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_VCEPowerGating);
+        sys_info.size = sizeof(struct cgs_system_info);
+        sys_info.info_id = CGS_SYSTEM_INFO_PG_FLAGS;
+        result = cgs_query_system_info(hwmgr->device, &sys_info);
+        if (!result) {
+                if (sys_info.value & AMD_PG_SUPPORT_UVD)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_UVDPowerGating);
+                if (sys_info.value & AMD_PG_SUPPORT_VCE)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_VCEPowerGating);
+        }
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
index 44a925006479..980d3bf8ea76 100644
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/tonga_hwmgr.c
@@ -4451,6 +4451,7 @@ int tonga_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
         pp_atomctrl_gpio_pin_assignment gpio_pin_assignment;
         struct phm_ppt_v1_information *pptable_info = (struct phm_ppt_v1_information *)(hwmgr->pptable);
         phw_tonga_ulv_parm *ulv;
+        struct cgs_system_info sys_info = {0};
 
         PP_ASSERT_WITH_CODE((NULL != hwmgr),
                 "Invalid Parameter!", return -1;);
@@ -4615,9 +4616,23 @@ int tonga_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
 
         data->vddc_phase_shed_control = 0;
 
-        if (0 == result) {
-                struct cgs_system_info sys_info = {0};
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_UVDPowerGating);
+        phm_cap_unset(hwmgr->platform_descriptor.platformCaps,
+                      PHM_PlatformCaps_VCEPowerGating);
+        sys_info.size = sizeof(struct cgs_system_info);
+        sys_info.info_id = CGS_SYSTEM_INFO_PG_FLAGS;
+        result = cgs_query_system_info(hwmgr->device, &sys_info);
+        if (!result) {
+                if (sys_info.value & AMD_PG_SUPPORT_UVD)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_UVDPowerGating);
+                if (sys_info.value & AMD_PG_SUPPORT_VCE)
+                        phm_cap_set(hwmgr->platform_descriptor.platformCaps,
+                                      PHM_PlatformCaps_VCEPowerGating);
+        }
 
+        if (0 == result) {
                 data->is_tlu_enabled = 0;
                 hwmgr->platform_descriptor.hardwareActivityPerformanceLevels =
                         TONGA_MAX_HARDWARE_POWERLEVELS;
diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
index c507896aca45..197b157b73d0 100644
--- a/drivers/gpu/drm/radeon/radeon_sa.c
+++ b/drivers/gpu/drm/radeon/radeon_sa.c
@@ -349,8 +349,13 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
                         /* see if we can skip over some allocations */
                 } while (radeon_sa_bo_next_hole(sa_manager, fences, tries));
 
+                for (i = 0; i < RADEON_NUM_RINGS; ++i)
+                        radeon_fence_ref(fences[i]);
+
                 spin_unlock(&sa_manager->wq.lock);
                 r = radeon_fence_wait_any(rdev, fences, false);
+                for (i = 0; i < RADEON_NUM_RINGS; ++i)
+                        radeon_fence_unref(&fences[i]);
                 spin_lock(&sa_manager->wq.lock);
                 /* if we have nothing to wait for block */
                 if (r == -ENOENT) {
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 1161d68a1863..56dd261f7142 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -219,6 +219,21 @@ error0:
 }
 EXPORT_SYMBOL_GPL(vmbus_open);
 
+/* Used for Hyper-V Socket: a guest client's connect() to the host */
+int vmbus_send_tl_connect_request(const uuid_le *shv_guest_servie_id,
+                                  const uuid_le *shv_host_servie_id)
+{
+        struct vmbus_channel_tl_connect_request conn_msg;
+
+        memset(&conn_msg, 0, sizeof(conn_msg));
+        conn_msg.header.msgtype = CHANNELMSG_TL_CONNECT_REQUEST;
+        conn_msg.guest_endpoint_id = *shv_guest_servie_id;
+        conn_msg.host_service_id = *shv_host_servie_id;
+
+        return vmbus_post_msg(&conn_msg, sizeof(conn_msg));
+}
+EXPORT_SYMBOL_GPL(vmbus_send_tl_connect_request);
+
 /*
  * create_gpadl_header - Creates a gpadl for the specified buffer
  */
@@ -624,6 +639,7 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
         u64 aligned_data = 0;
         int ret;
         bool signal = false;
+        bool lock = channel->acquire_ring_lock;
         int num_vecs = ((bufferlen != 0) ? 3 : 1);
 
 
@@ -643,7 +659,7 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
         bufferlist[2].iov_len = (packetlen_aligned - packetlen);
 
         ret = hv_ringbuffer_write(&channel->outbound, bufferlist, num_vecs,
-                                  &signal);
+                                  &signal, lock);
 
         /*
          * Signalling the host is conditional on many factors:
@@ -659,6 +675,9 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
          * If we cannot write to the ring-buffer; signal the host
          * even if we may not have written anything. This is a rare
          * enough condition that it should not matter.
+         * NOTE: in this case, the hvsock channel is an exception, because
+         * it looks the host side's hvsock implementation has a throttling
+         * mechanism which can hurt the performance otherwise.
          */
 
         if (channel->signal_policy)
@@ -666,7 +685,8 @@ int vmbus_sendpacket_ctl(struct vmbus_channel *channel, void *buffer,
         else
                 kick_q = true;
 
-        if (((ret == 0) && kick_q && signal) || (ret))
+        if (((ret == 0) && kick_q && signal) ||
+            (ret && !is_hvsock_channel(channel)))
                 vmbus_setevent(channel);
 
         return ret;
@@ -719,6 +739,7 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
         struct kvec bufferlist[3];
         u64 aligned_data = 0;
         bool signal = false;
+        bool lock = channel->acquire_ring_lock;
 
         if (pagecount > MAX_PAGE_BUFFER_COUNT)
                 return -EINVAL;
@@ -755,7 +776,8 @@ int vmbus_sendpacket_pagebuffer_ctl(struct vmbus_channel *channel,
         bufferlist[2].iov_base = &aligned_data;
         bufferlist[2].iov_len = (packetlen_aligned - packetlen);
 
-        ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3, &signal);
+        ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+                                  &signal, lock);
 
         /*
          * Signalling the host is conditional on many factors:
@@ -818,6 +840,7 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
         struct kvec bufferlist[3];
         u64 aligned_data = 0;
         bool signal = false;
+        bool lock = channel->acquire_ring_lock;
 
         packetlen = desc_size + bufferlen;
         packetlen_aligned = ALIGN(packetlen, sizeof(u64));
@@ -837,7 +860,8 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
         bufferlist[2].iov_base = &aligned_data;
         bufferlist[2].iov_len = (packetlen_aligned - packetlen);
 
-        ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3, &signal);
+        ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+                                  &signal, lock);
 
         if (ret == 0 && signal)
                 vmbus_setevent(channel);
@@ -862,6 +886,7 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
         struct kvec bufferlist[3];
         u64 aligned_data = 0;
         bool signal = false;
+        bool lock = channel->acquire_ring_lock;
         u32 pfncount = NUM_PAGES_SPANNED(multi_pagebuffer->offset,
                                          multi_pagebuffer->len);
 
@@ -900,7 +925,8 @@ int vmbus_sendpacket_multipagebuffer(struct vmbus_channel *channel,
         bufferlist[2].iov_base = &aligned_data;
         bufferlist[2].iov_len = (packetlen_aligned - packetlen);
 
-        ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3, &signal);
+        ret = hv_ringbuffer_write(&channel->outbound, bufferlist, 3,
+                                  &signal, lock);
 
         if (ret == 0 && signal)
                 vmbus_setevent(channel);
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 1c1ad47042c5..b40f429aaa13 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -28,12 +28,127 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/completion.h>
+#include <linux/delay.h>
 #include <linux/hyperv.h>
 
 #include "hyperv_vmbus.h"
 
-static void init_vp_index(struct vmbus_channel *channel,
-                          const uuid_le *type_guid);
+static void init_vp_index(struct vmbus_channel *channel, u16 dev_type);
+
+static const struct vmbus_device vmbus_devs[] = {
+        /* IDE */
+        { .dev_type = HV_IDE,
+          HV_IDE_GUID,
+          .perf_device = true,
+        },
+
+        /* SCSI */
+        { .dev_type = HV_SCSI,
+          HV_SCSI_GUID,
+          .perf_device = true,
+        },
+
+        /* Fibre Channel */
+        { .dev_type = HV_FC,
+          HV_SYNTHFC_GUID,
+          .perf_device = true,
+        },
+
+        /* Synthetic NIC */
+        { .dev_type = HV_NIC,
+          HV_NIC_GUID,
+          .perf_device = true,
+        },
+
+        /* Network Direct */
+        { .dev_type = HV_ND,
+          HV_ND_GUID,
+          .perf_device = true,
+        },
+
+        /* PCIE */
+        { .dev_type = HV_PCIE,
+          HV_PCIE_GUID,
+          .perf_device = true,
+        },
+
+        /* Synthetic Frame Buffer */
+        { .dev_type = HV_FB,
+          HV_SYNTHVID_GUID,
+          .perf_device = false,
+        },
+
+        /* Synthetic Keyboard */
+        { .dev_type = HV_KBD,
+          HV_KBD_GUID,
+          .perf_device = false,
+        },
+
+        /* Synthetic MOUSE */
+        { .dev_type = HV_MOUSE,
+          HV_MOUSE_GUID,
+          .perf_device = false,
+        },
+
+        /* KVP */
+        { .dev_type = HV_KVP,
+          HV_KVP_GUID,
+          .perf_device = false,
+        },
+
+        /* Time Synch */
+        { .dev_type = HV_TS,
+          HV_TS_GUID,
+          .perf_device = false,
+        },
+
+        /* Heartbeat */
+        { .dev_type = HV_HB,
+          HV_HEART_BEAT_GUID,
+          .perf_device = false,
+        },
+
+        /* Shutdown */
+        { .dev_type = HV_SHUTDOWN,
+          HV_SHUTDOWN_GUID,
+          .perf_device = false,
+        },
+
+        /* File copy */
+        { .dev_type = HV_FCOPY,
+          HV_FCOPY_GUID,
+          .perf_device = false,
+        },
+
+        /* Backup */
+        { .dev_type = HV_BACKUP,
+          HV_VSS_GUID,
+          .perf_device = false,
+        },
+
+        /* Dynamic Memory */
+        { .dev_type = HV_DM,
+          HV_DM_GUID,
+          .perf_device = false,
+        },
+
+        /* Unknown GUID */
+        { .dev_type = HV_UNKOWN,
+          .perf_device = false,
+        },
+};
+
+static u16 hv_get_dev_type(const uuid_le *guid)
+{
+        u16 i;
+
+        for (i = HV_IDE; i < HV_UNKOWN; i++) {
+                if (!uuid_le_cmp(*guid, vmbus_devs[i].guid))
+                        return i;
+        }
+        pr_info("Unknown GUID: %pUl\n", guid);
+        return i;
+}
 
 /**
  * vmbus_prep_negotiate_resp() - Create default response for Hyper-V Negotiate message
@@ -144,6 +259,7 @@ static struct vmbus_channel *alloc_channel(void)
                 return NULL;
 
         channel->id = atomic_inc_return(&chan_num);
+        channel->acquire_ring_lock = true;
         spin_lock_init(&channel->inbound_lock);
         spin_lock_init(&channel->lock);
 
@@ -195,6 +311,7 @@ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
         vmbus_release_relid(relid);
 
         BUG_ON(!channel->rescind);
+        BUG_ON(!mutex_is_locked(&vmbus_connection.channel_mutex));
 
         if (channel->target_cpu != get_cpu()) {
                 put_cpu();
@@ -206,9 +323,7 @@ void hv_process_channel_removal(struct vmbus_channel *channel, u32 relid)
         }
 
         if (channel->primary_channel == NULL) {
-                mutex_lock(&vmbus_connection.channel_mutex);
                 list_del(&channel->listentry);
-                mutex_unlock(&vmbus_connection.channel_mutex);
 
                 primary_channel = channel;
         } else {
@@ -251,6 +366,8 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
         struct vmbus_channel *channel;
         bool fnew = true;
         unsigned long flags;
+        u16 dev_type;
+        int ret;
 
         /* Make sure this is a new offer */
         mutex_lock(&vmbus_connection.channel_mutex);
@@ -288,7 +405,9 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
                         goto err_free_chan;
         }
 
-        init_vp_index(newchannel, &newchannel->offermsg.offer.if_type);
+        dev_type = hv_get_dev_type(&newchannel->offermsg.offer.if_type);
+
+        init_vp_index(newchannel, dev_type);
 
         if (newchannel->target_cpu != get_cpu()) {
                 put_cpu();
@@ -325,12 +444,17 @@ static void vmbus_process_offer(struct vmbus_channel *newchannel)
         if (!newchannel->device_obj)
                 goto err_deq_chan;
 
+        newchannel->device_obj->device_id = dev_type;
         /*
          * Add the new device to the bus. This will kick off device-driver
          * binding which eventually invokes the device driver's AddDevice()
          * method.
          */
-        if (vmbus_device_register(newchannel->device_obj) != 0) {
+        mutex_lock(&vmbus_connection.channel_mutex);
+        ret = vmbus_device_register(newchannel->device_obj);
+        mutex_unlock(&vmbus_connection.channel_mutex);
+
+        if (ret != 0) {
                 pr_err("unable to add child device object (relid %d)\n",
                         newchannel->offermsg.child_relid);
                 kfree(newchannel->device_obj);
@@ -358,37 +482,6 @@ err_free_chan:
         free_channel(newchannel);
 }
 
-enum {
-        IDE = 0,
-        SCSI,
-        FC,
-        NIC,
-        ND_NIC,
-        PCIE,
-        MAX_PERF_CHN,
-};
-
-/*
- * This is an array of device_ids (device types) that are performance critical.
- * We attempt to distribute the interrupt load for these devices across
- * all available CPUs.
- */
-static const struct hv_vmbus_device_id hp_devs[] = {
-        /* IDE */
-        { HV_IDE_GUID, },
-        /* Storage - SCSI */
-        { HV_SCSI_GUID, },
-        /* Storage - FC */
-        { HV_SYNTHFC_GUID, },
-        /* Network */
-        { HV_NIC_GUID, },
-        /* NetworkDirect Guest RDMA */
-        { HV_ND_GUID, },
-        /* PCI Express Pass Through */
-        { HV_PCIE_GUID, },
-};
-
-
 /*
  * We use this state to statically distribute the channel interrupt load.
  */
@@ -405,22 +498,15 @@ static int next_numa_node_id;
  * For pre-win8 hosts or non-performance critical channels we assign the
  * first CPU in the first NUMA node.
  */
-static void init_vp_index(struct vmbus_channel *channel, const uuid_le *type_guid)
+static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
 {
         u32 cur_cpu;
-        int i;
-        bool perf_chn = false;
+        bool perf_chn = vmbus_devs[dev_type].perf_device;
         struct vmbus_channel *primary = channel->primary_channel;
         int next_node;
         struct cpumask available_mask;
         struct cpumask *alloced_mask;
 
-        for (i = IDE; i < MAX_PERF_CHN; i++) {
-                if (!uuid_le_cmp(*type_guid, hp_devs[i].guid)) {
-                        perf_chn = true;
-                        break;
-                }
-        }
         if ((vmbus_proto_version == VERSION_WS2008) ||
             (vmbus_proto_version == VERSION_WIN7) || (!perf_chn)) {
                 /*
@@ -469,6 +555,17 @@ static void init_vp_index(struct vmbus_channel *channel, const uuid_le *type_gui
                     cpumask_of_node(primary->numa_node));
 
         cur_cpu = -1;
+
+        /*
+         * Normally Hyper-V host doesn't create more subchannels than there
+         * are VCPUs on the node but it is possible when not all present VCPUs
+         * on the node are initialized by guest. Clear the alloced_cpus_in_node
+         * to start over.
+         */
+        if (cpumask_equal(&primary->alloced_cpus_in_node,
+                          cpumask_of_node(primary->numa_node)))
+                cpumask_clear(&primary->alloced_cpus_in_node);
+
         while (true) {
                 cur_cpu = cpumask_next(cur_cpu, &available_mask);
                 if (cur_cpu >= nr_cpu_ids) {
@@ -498,6 +595,40 @@ static void init_vp_index(struct vmbus_channel *channel, const uuid_le *type_gui
         channel->target_vp = hv_context.vp_index[cur_cpu];
 }
 
+static void vmbus_wait_for_unload(void)
+{
+        int cpu = smp_processor_id();
+        void *page_addr = hv_context.synic_message_page[cpu];
+        struct hv_message *msg = (struct hv_message *)page_addr +
+                                  VMBUS_MESSAGE_SINT;
+        struct vmbus_channel_message_header *hdr;
+        bool unloaded = false;
+
+        while (1) {
+                if (msg->header.message_type == HVMSG_NONE) {
+                        mdelay(10);
+                        continue;
+                }
+
+                hdr = (struct vmbus_channel_message_header *)msg->u.payload;
+                if (hdr->msgtype == CHANNELMSG_UNLOAD_RESPONSE)
+                        unloaded = true;
+
+                msg->header.message_type = HVMSG_NONE;
+                /*
+                 * header.message_type needs to be written before we do
+                 * wrmsrl() below.
+                 */
+                mb();
+
+                if (msg->header.message_flags.msg_pending)
+                        wrmsrl(HV_X64_MSR_EOM, 0);
+
+                if (unloaded)
+                        break;
+        }
+}
+
 /*
  * vmbus_unload_response - Handler for the unload response.
  */
@@ -523,7 +654,14 @@ void vmbus_initiate_unload(void)
         hdr.msgtype = CHANNELMSG_UNLOAD;
         vmbus_post_msg(&hdr, sizeof(struct vmbus_channel_message_header));
 
-        wait_for_completion(&vmbus_connection.unload_event);
+        /*
+         * vmbus_initiate_unload() is also called on crash and the crash can be
+         * happening in an interrupt context, where scheduling is impossible.
+         */
+        if (!in_interrupt())
+                wait_for_completion(&vmbus_connection.unload_event);
+        else
+                vmbus_wait_for_unload();
 }
 
 /*
@@ -592,6 +730,8 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
         struct device *dev;
 
         rescind = (struct vmbus_channel_rescind_offer *)hdr;
+
+        mutex_lock(&vmbus_connection.channel_mutex);
         channel = relid2channel(rescind->child_relid);
 
         if (channel == NULL) {
@@ -600,7 +740,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
                  * vmbus_process_offer(), we have already invoked
                  * vmbus_release_relid() on error.
                  */
-                return;
+                goto out;
         }
 
         spin_lock_irqsave(&channel->lock, flags);
@@ -608,6 +748,10 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
         spin_unlock_irqrestore(&channel->lock, flags);
 
         if (channel->device_obj) {
+                if (channel->chn_rescind_callback) {
+                        channel->chn_rescind_callback(channel);
+                        goto out;
+                }
                 /*
                  * We will have to unregister this device from the
                  * driver core.
@@ -621,8 +765,25 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
                 hv_process_channel_removal(channel,
                         channel->offermsg.child_relid);
         }
+
+out:
+        mutex_unlock(&vmbus_connection.channel_mutex);
 }
 
+void vmbus_hvsock_device_unregister(struct vmbus_channel *channel)
+{
+        mutex_lock(&vmbus_connection.channel_mutex);
+
+        BUG_ON(!is_hvsock_channel(channel));
+
+        channel->rescind = true;
+        vmbus_device_unregister(channel->device_obj);
+
+        mutex_unlock(&vmbus_connection.channel_mutex);
+}
+EXPORT_SYMBOL_GPL(vmbus_hvsock_device_unregister);
+
+
 /*
  * vmbus_onoffers_delivered -
  * This is invoked when all offers have been delivered.
@@ -825,6 +986,10 @@ struct vmbus_channel_message_table_entry
         {CHANNELMSG_VERSION_RESPONSE,           1, vmbus_onversion_response},
         {CHANNELMSG_UNLOAD,                     0, NULL},
         {CHANNELMSG_UNLOAD_RESPONSE,            1, vmbus_unload_response},
+        {CHANNELMSG_18,                         0, NULL},
+        {CHANNELMSG_19,                         0, NULL},
+        {CHANNELMSG_20,                         0, NULL},
+        {CHANNELMSG_TL_CONNECT_REQUEST,         0, NULL},
 };
 
 /*
@@ -973,3 +1138,10 @@ bool vmbus_are_subchannels_present(struct vmbus_channel *primary)
         return ret;
 }
 EXPORT_SYMBOL_GPL(vmbus_are_subchannels_present);
+
+void vmbus_set_chn_rescind_callback(struct vmbus_channel *channel,
+                void (*chn_rescind_cb)(struct vmbus_channel *))
+{
+        channel->chn_rescind_callback = chn_rescind_cb;
+}
+EXPORT_SYMBOL_GPL(vmbus_set_chn_rescind_callback);
diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
index 3dc5a9c7fad6..fa86b2cb28b8 100644
--- a/drivers/hv/connection.c
+++ b/drivers/hv/connection.c
@@ -288,7 +288,8 @@ struct vmbus_channel *relid2channel(u32 relid)
         struct list_head *cur, *tmp;
         struct vmbus_channel *cur_sc;
 
-        mutex_lock(&vmbus_connection.channel_mutex);
+        BUG_ON(!mutex_is_locked(&vmbus_connection.channel_mutex));
+
         list_for_each_entry(channel, &vmbus_connection.chn_list, listentry) {
                 if (channel->offermsg.child_relid == relid) {
                         found_channel = channel;
@@ -307,7 +308,6 @@ struct vmbus_channel *relid2channel(u32 relid)
                         }
                 }
         }
-        mutex_unlock(&vmbus_connection.channel_mutex);
 
         return found_channel;
 }
@@ -474,7 +474,7 @@ int vmbus_post_msg(void *buffer, size_t buflen)
 /*
  * vmbus_set_event - Send an event notification to the parent
  */
-int vmbus_set_event(struct vmbus_channel *channel)
+void vmbus_set_event(struct vmbus_channel *channel)
 {
         u32 child_relid = channel->offermsg.child_relid;
 
@@ -485,5 +485,5 @@ int vmbus_set_event(struct vmbus_channel *channel)
                         (child_relid >> 5));
         }
 
-        return hv_signal_event(channel->sig_event);
+        hv_do_hypercall(HVCALL_SIGNAL_EVENT, channel->sig_event, NULL);
 }
diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index 11bca51ef5ff..ccb335f57c88 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -295,8 +295,14 @@ void hv_cleanup(void)
          * Cleanup the TSC page based CS.
          */
         if (ms_hyperv.features & HV_X64_MSR_REFERENCE_TSC_AVAILABLE) {
-                clocksource_change_rating(&hyperv_cs_tsc, 10);
-                clocksource_unregister(&hyperv_cs_tsc);
+                /*
+                 * Crash can happen in an interrupt context and unregistering
+                 * a clocksource is impossible and redundant in this case.
+                 */
+                if (!oops_in_progress) {
+                        clocksource_change_rating(&hyperv_cs_tsc, 10);
+                        clocksource_unregister(&hyperv_cs_tsc);
+                }
 
                 hypercall_msr.as_uint64 = 0;
                 wrmsrl(HV_X64_MSR_REFERENCE_TSC, hypercall_msr.as_uint64);
@@ -337,22 +343,6 @@ int hv_post_message(union hv_connection_id connection_id,
         return status & 0xFFFF;
 }
 
-
-/*
- * hv_signal_event -
- * Signal an event on the specified connection using the hypervisor event IPC.
- *
- * This involves a hypercall.
- */
-int hv_signal_event(void *con_id)
-{
-        u64 status;
-
-        status = hv_do_hypercall(HVCALL_SIGNAL_EVENT, con_id, NULL);
-
-        return status & 0xFFFF;
-}
-
 static int hv_ce_set_next_event(unsigned long delta,
                                 struct clock_event_device *evt)
 {
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index 4ebc796b4f33..b9ea7f59036b 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -501,8 +501,6 @@ extern int hv_post_message(union hv_connection_id connection_id,
                          enum hv_message_type message_type,
                          void *payload, size_t payload_size);
 
-extern int hv_signal_event(void *con_id);
-
 extern int hv_synic_alloc(void);
 
 extern void hv_synic_free(void);
@@ -531,7 +529,7 @@ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info);
 
 int hv_ringbuffer_write(struct hv_ring_buffer_info *ring_info,
                     struct kvec *kv_list,
-                    u32 kv_count, bool *signal);
+                    u32 kv_count, bool *signal, bool lock);
 
 int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
                        void *buffer, u32 buflen, u32 *buffer_actual_len,
@@ -650,7 +648,7 @@ void vmbus_disconnect(void);
 
 int vmbus_post_msg(void *buffer, size_t buflen);
 
-int vmbus_set_event(struct vmbus_channel *channel);
+void vmbus_set_event(struct vmbus_channel *channel);
 
 void vmbus_on_event(unsigned long data);
 
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index b53702ce692f..5613e2b5cff7 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -314,7 +314,7 @@ void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info)
 
 /* Write to the ring buffer. */
 int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
-                    struct kvec *kv_list, u32 kv_count, bool *signal)
+                    struct kvec *kv_list, u32 kv_count, bool *signal, bool lock)
 {
         int i = 0;
         u32 bytes_avail_towrite;
@@ -324,14 +324,15 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
         u32 next_write_location;
         u32 old_write;
         u64 prev_indices = 0;
-        unsigned long flags;
+        unsigned long flags = 0;
 
         for (i = 0; i < kv_count; i++)
                 totalbytes_towrite += kv_list[i].iov_len;
 
         totalbytes_towrite += sizeof(u64);
 
-        spin_lock_irqsave(&outring_info->ring_lock, flags);
+        if (lock)
+                spin_lock_irqsave(&outring_info->ring_lock, flags);
 
         hv_get_ringbuffer_availbytes(outring_info,
                                 &bytes_avail_toread,
@@ -343,7 +344,8 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
          * is empty since the read index == write index.
          */
         if (bytes_avail_towrite <= totalbytes_towrite) {
-                spin_unlock_irqrestore(&outring_info->ring_lock, flags);
+                if (lock)
+                        spin_unlock_irqrestore(&outring_info->ring_lock, flags);
                 return -EAGAIN;
         }
 
@@ -374,7 +376,8 @@ int hv_ringbuffer_write(struct hv_ring_buffer_info *outring_info,
         hv_set_next_write_location(outring_info, next_write_location);
 
 
-        spin_unlock_irqrestore(&outring_info->ring_lock, flags);
+        if (lock)
+                spin_unlock_irqrestore(&outring_info->ring_lock, flags);
 
         *signal = hv_need_to_signal(old_write, outring_info);
         return 0;
@@ -388,7 +391,6 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
         u32 bytes_avail_toread;
         u32 next_read_location = 0;
         u64 prev_indices = 0;
-        unsigned long flags;
         struct vmpacket_descriptor desc;
         u32 offset;
         u32 packetlen;
@@ -397,7 +399,6 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
         if (buflen <= 0)
                 return -EINVAL;
 
-        spin_lock_irqsave(&inring_info->ring_lock, flags);
 
         *buffer_actual_len = 0;
         *requestid = 0;
@@ -412,7 +413,7 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
                  * No error is set when there is even no header, drivers are
                  * supposed to analyze buffer_actual_len.
                  */
-                goto out_unlock;
+                return ret;
         }
 
         next_read_location = hv_get_next_read_location(inring_info);
@@ -425,15 +426,11 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
         *buffer_actual_len = packetlen;
         *requestid = desc.trans_id;
 
-        if (bytes_avail_toread < packetlen + offset) {
-                ret = -EAGAIN;
-                goto out_unlock;
-        }
+        if (bytes_avail_toread < packetlen + offset)
+                return -EAGAIN;
 
-        if (packetlen > buflen) {
-                ret = -ENOBUFS;
-                goto out_unlock;
-        }
+        if (packetlen > buflen)
+                return -ENOBUFS;
 
         next_read_location =
                 hv_get_next_readlocation_withoffset(inring_info, offset);
@@ -460,7 +457,5 @@ int hv_ringbuffer_read(struct hv_ring_buffer_info *inring_info,
 
         *signal = hv_need_to_signal_on_read(bytes_avail_towrite, inring_info);
 
-out_unlock:
-        spin_unlock_irqrestore(&inring_info->ring_lock, flags);
         return ret;
 }
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index 328e4c3808e0..063e5f53ca78 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -477,6 +477,24 @@ static ssize_t channel_vp_mapping_show(struct device *dev,
 }
 static DEVICE_ATTR_RO(channel_vp_mapping);
 
+static ssize_t vendor_show(struct device *dev,
+                           struct device_attribute *dev_attr,
+                           char *buf)
+{
+        struct hv_device *hv_dev = device_to_hv_device(dev);
+        return sprintf(buf, "0x%x\n", hv_dev->vendor_id);
+}
+static DEVICE_ATTR_RO(vendor);
+
+static ssize_t device_show(struct device *dev,
+                           struct device_attribute *dev_attr,
+                           char *buf)
+{
+        struct hv_device *hv_dev = device_to_hv_device(dev);
+        return sprintf(buf, "0x%x\n", hv_dev->device_id);
+}
+static DEVICE_ATTR_RO(device);
+
 /* Set up per device attributes in /sys/bus/vmbus/devices/<bus device> */
 static struct attribute *vmbus_attrs[] = {
         &dev_attr_id.attr,
@@ -502,6 +520,8 @@ static struct attribute *vmbus_attrs[] = {
         &dev_attr_in_read_bytes_avail.attr,
         &dev_attr_in_write_bytes_avail.attr,
         &dev_attr_channel_vp_mapping.attr,
+        &dev_attr_vendor.attr,
+        &dev_attr_device.attr,
         NULL,
 };
 ATTRIBUTE_GROUPS(vmbus);
@@ -562,6 +582,10 @@ static int vmbus_match(struct device *device, struct device_driver *driver)
         struct hv_driver *drv = drv_to_hv_drv(driver);
         struct hv_device *hv_dev = device_to_hv_device(device);
 
+        /* The hv_sock driver handles all hv_sock offers. */
+        if (is_hvsock_channel(hv_dev->channel))
+                return drv->hvsock;
+
         if (hv_vmbus_get_id(drv->id_table, &hv_dev->dev_type))
                 return 1;
 
@@ -957,6 +981,7 @@ struct hv_device *vmbus_device_create(const uuid_le *type,
         memcpy(&child_device_obj->dev_type, type, sizeof(uuid_le));
         memcpy(&child_device_obj->dev_instance, instance,
                sizeof(uuid_le));
+        child_device_obj->vendor_id = 0x1414; /* MSFT vendor ID */
 
 
         return child_device_obj;
diff --git a/drivers/hwtracing/coresight/Kconfig b/drivers/hwtracing/coresight/Kconfig
index c85935f3525a..db0541031c72 100644
--- a/drivers/hwtracing/coresight/Kconfig
+++ b/drivers/hwtracing/coresight/Kconfig
@@ -4,6 +4,7 @@
 menuconfig CORESIGHT
         bool "CoreSight Tracing Support"
         select ARM_AMBA
+        select PERF_EVENTS
         help
           This framework provides a kernel interface for the CoreSight debug
           and trace drivers to register themselves with. It's intended to build
diff --git a/drivers/hwtracing/coresight/Makefile b/drivers/hwtracing/coresight/Makefile
index 99f8e5f6256e..cf8c6d689747 100644
--- a/drivers/hwtracing/coresight/Makefile
+++ b/drivers/hwtracing/coresight/Makefile
@@ -8,6 +8,8 @@ obj-$(CONFIG_CORESIGHT_SINK_TPIU) += coresight-tpiu.o
 obj-$(CONFIG_CORESIGHT_SINK_ETBV10) += coresight-etb10.o
 obj-$(CONFIG_CORESIGHT_LINKS_AND_SINKS) += coresight-funnel.o \
                                            coresight-replicator.o
-obj-$(CONFIG_CORESIGHT_SOURCE_ETM3X) += coresight-etm3x.o coresight-etm-cp14.o
+obj-$(CONFIG_CORESIGHT_SOURCE_ETM3X) += coresight-etm3x.o coresight-etm-cp14.o \
+                                        coresight-etm3x-sysfs.o \
+                                        coresight-etm-perf.o
 obj-$(CONFIG_CORESIGHT_SOURCE_ETM4X) += coresight-etm4x.o
 obj-$(CONFIG_CORESIGHT_QCOM_REPLICATOR) += coresight-replicator-qcom.o
diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
index 77d0f9c1118d..acbce79934d6 100644
--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -1,5 +1,7 @@
 /* Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
  *
+ * Description: CoreSight Embedded Trace Buffer driver
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
  * only version 2 as published by the Free Software Foundation.
@@ -10,8 +12,8 @@
  * GNU General Public License for more details.
  */
 
+#include <asm/local.h>
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/device.h>
@@ -27,6 +29,11 @@
 #include <linux/coresight.h>
 #include <linux/amba/bus.h>
 #include <linux/clk.h>
+#include <linux/circ_buf.h>
+#include <linux/mm.h>
+#include <linux/perf_event.h>
+
+#include <asm/local.h>
 
 #include "coresight-priv.h"
 
@@ -64,6 +71,26 @@
 #define ETB_FRAME_SIZE_WORDS    4
 
 /**
+ * struct cs_buffer - keep track of a recording session' specifics
+ * @cur:        index of the current buffer
+ * @nr_pages:   max number of pages granted to us
+ * @offset:     offset within the current buffer
+ * @data_size:  how much we collected in this run
+ * @lost:       other than zero if we had a HW buffer wrap around
+ * @snapshot:   is this run in snapshot mode
+ * @data_pages: a handle the ring buffer
+ */
+struct cs_buffers {
+        unsigned int            cur;
+        unsigned int            nr_pages;
+        unsigned long           offset;
+        local_t                 data_size;
+        local_t                 lost;
+        bool                    snapshot;
+        void                    **data_pages;
+};
+
+/**
  * struct etb_drvdata - specifics associated to an ETB component
  * @base:       memory mapped base address for this component.
  * @dev:        the device entity associated to this component.
@@ -71,10 +98,10 @@
  * @csdev:      component vitals needed by the framework.
  * @miscdev:    specifics to handle "/dev/xyz.etb" entry.
  * @spinlock:   only one at a time pls.
- * @in_use:     synchronise user space access to etb buffer.
+ * @reading:    synchronise user space access to etb buffer.
+ * @mode:       this ETB is being used.
  * @buf:        area of memory where ETB buffer content gets sent.
  * @buffer_depth: size of @buf.
- * @enable:     this ETB is being used.
  * @trigger_cntr: amount of words to store after a trigger.
  */
 struct etb_drvdata {
@@ -84,10 +111,10 @@ struct etb_drvdata {
         struct coresight_device *csdev;
         struct miscdevice       miscdev;
         spinlock_t              spinlock;
-        atomic_t                in_use;
+        local_t                 reading;
+        local_t                 mode;
         u8                      *buf;
         u32                     buffer_depth;
-        bool                    enable;
         u32                     trigger_cntr;
 };
 
@@ -132,18 +159,31 @@ static void etb_enable_hw(struct etb_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
-static int etb_enable(struct coresight_device *csdev)
+static int etb_enable(struct coresight_device *csdev, u32 mode)
 {
-        struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+        u32 val;
         unsigned long flags;
+        struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        pm_runtime_get_sync(drvdata->dev);
+        val = local_cmpxchg(&drvdata->mode,
+                            CS_MODE_DISABLED, mode);
+        /*
+         * When accessing from Perf, a HW buffer can be handled
+         * by a single trace entity.  In sysFS mode many tracers
+         * can be logging to the same HW buffer.
+         */
+        if (val == CS_MODE_PERF)
+                return -EBUSY;
+
+        /* Nothing to do, the tracer is already enabled. */
+        if (val == CS_MODE_SYSFS)
+                goto out;
 
         spin_lock_irqsave(&drvdata->spinlock, flags);
         etb_enable_hw(drvdata);
-        drvdata->enable = true;
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
+out:
         dev_info(drvdata->dev, "ETB enabled\n");
         return 0;
 }
@@ -244,17 +284,225 @@ static void etb_disable(struct coresight_device *csdev)
         spin_lock_irqsave(&drvdata->spinlock, flags);
         etb_disable_hw(drvdata);
         etb_dump_hw(drvdata);
-        drvdata->enable = false;
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-        pm_runtime_put(drvdata->dev);
+        local_set(&drvdata->mode, CS_MODE_DISABLED);
 
         dev_info(drvdata->dev, "ETB disabled\n");
 }
 
+static void *etb_alloc_buffer(struct coresight_device *csdev, int cpu,
+                              void **pages, int nr_pages, bool overwrite)
+{
+        int node;
+        struct cs_buffers *buf;
+
+        if (cpu == -1)
+                cpu = smp_processor_id();
+        node = cpu_to_node(cpu);
+
+        buf = kzalloc_node(sizeof(struct cs_buffers), GFP_KERNEL, node);
+        if (!buf)
+                return NULL;
+
+        buf->snapshot = overwrite;
+        buf->nr_pages = nr_pages;
+        buf->data_pages = pages;
+
+        return buf;
+}
+
+static void etb_free_buffer(void *config)
+{
+        struct cs_buffers *buf = config;
+
+        kfree(buf);
+}
+
+static int etb_set_buffer(struct coresight_device *csdev,
+                          struct perf_output_handle *handle,
+                          void *sink_config)
+{
+        int ret = 0;
+        unsigned long head;
+        struct cs_buffers *buf = sink_config;
+
+        /* wrap head around to the amount of space we have */
+        head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1);
+
+        /* find the page to write to */
+        buf->cur = head / PAGE_SIZE;
+
+        /* and offset within that page */
+        buf->offset = head % PAGE_SIZE;
+
+        local_set(&buf->data_size, 0);
+
+        return ret;
+}
+
+static unsigned long etb_reset_buffer(struct coresight_device *csdev,
+                                      struct perf_output_handle *handle,
+                                      void *sink_config, bool *lost)
+{
+        unsigned long size = 0;
+        struct cs_buffers *buf = sink_config;
+
+        if (buf) {
+                /*
+                 * In snapshot mode ->data_size holds the new address of the
+                 * ring buffer's head.  The size itself is the whole address
+                 * range since we want the latest information.
+                 */
+                if (buf->snapshot)
+                        handle->head = local_xchg(&buf->data_size,
+                                                  buf->nr_pages << PAGE_SHIFT);
+
+                /*
+                 * Tell the tracer PMU how much we got in this run and if
+                 * something went wrong along the way.  Nobody else can use
+                 * this cs_buffers instance until we are done.  As such
+                 * resetting parameters here and squaring off with the ring
+                 * buffer API in the tracer PMU is fine.
+                 */
+                *lost = !!local_xchg(&buf->lost, 0);
+                size = local_xchg(&buf->data_size, 0);
+        }
+
+        return size;
+}
+
+static void etb_update_buffer(struct coresight_device *csdev,
+                              struct perf_output_handle *handle,
+                              void *sink_config)
+{
+        int i, cur;
+        u8 *buf_ptr;
+        u32 read_ptr, write_ptr, capacity;
+        u32 status, read_data, to_read;
+        unsigned long offset;
+        struct cs_buffers *buf = sink_config;
+        struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        if (!buf)
+                return;
+
+        capacity = drvdata->buffer_depth * ETB_FRAME_SIZE_WORDS;
+
+        CS_UNLOCK(drvdata->base);
+        etb_disable_hw(drvdata);
+
+        /* unit is in words, not bytes */
+        read_ptr = readl_relaxed(drvdata->base + ETB_RAM_READ_POINTER);
+        write_ptr = readl_relaxed(drvdata->base + ETB_RAM_WRITE_POINTER);
+
+        /*
+         * Entries should be aligned to the frame size.  If they are not
+         * go back to the last alignement point to give decoding tools a
+         * chance to fix things.
+         */
+        if (write_ptr % ETB_FRAME_SIZE_WORDS) {
+                dev_err(drvdata->dev,
+                        "write_ptr: %lu not aligned to formatter frame size\n",
+                        (unsigned long)write_ptr);
+
+                write_ptr &= ~(ETB_FRAME_SIZE_WORDS - 1);
+                local_inc(&buf->lost);
+        }
+
+        /*
+         * Get a hold of the status register and see if a wrap around
+         * has occurred.  If so adjust things accordingly.  Otherwise
+         * start at the beginning and go until the write pointer has
+         * been reached.
+         */
+        status = readl_relaxed(drvdata->base + ETB_STATUS_REG);
+        if (status & ETB_STATUS_RAM_FULL) {
+                local_inc(&buf->lost);
+                to_read = capacity;
+                read_ptr = write_ptr;
+        } else {
+                to_read = CIRC_CNT(write_ptr, read_ptr, drvdata->buffer_depth);
+                to_read *= ETB_FRAME_SIZE_WORDS;
+        }
+
+        /*
+         * Make sure we don't overwrite data that hasn't been consumed yet.
+         * It is entirely possible that the HW buffer has more data than the
+         * ring buffer can currently handle.  If so adjust the start address
+         * to take only the last traces.
+         *
+         * In snapshot mode we are looking to get the latest traces only and as
+         * such, we don't care about not overwriting data that hasn't been
+         * processed by user space.
+         */
+        if (!buf->snapshot && to_read > handle->size) {
+                u32 mask = ~(ETB_FRAME_SIZE_WORDS - 1);
+
+                /* The new read pointer must be frame size aligned */
+                to_read -= handle->size & mask;
+                /*
+                 * Move the RAM read pointer up, keeping in mind that
+                 * everything is in frame size units.
+                 */
+                read_ptr = (write_ptr + drvdata->buffer_depth) -
+                                        to_read / ETB_FRAME_SIZE_WORDS;
+                /* Wrap around if need be*/
+                read_ptr &= ~(drvdata->buffer_depth - 1);
+                /* let the decoder know we've skipped ahead */
+                local_inc(&buf->lost);
+        }
+
+        /* finally tell HW where we want to start reading from */
+        writel_relaxed(read_ptr, drvdata->base + ETB_RAM_READ_POINTER);
+
+        cur = buf->cur;
+        offset = buf->offset;
+        for (i = 0; i < to_read; i += 4) {
+                buf_ptr = buf->data_pages[cur] + offset;
+                read_data = readl_relaxed(drvdata->base +
+                                          ETB_RAM_READ_DATA_REG);
+                *buf_ptr++ = read_data >> 0;
+                *buf_ptr++ = read_data >> 8;
+                *buf_ptr++ = read_data >> 16;
+                *buf_ptr++ = read_data >> 24;
+
+                offset += 4;
+                if (offset >= PAGE_SIZE) {
+                        offset = 0;
+                        cur++;
+                        /* wrap around at the end of the buffer */
+                        cur &= buf->nr_pages - 1;
+                }
+        }
+
+        /* reset ETB buffer for next run */
+        writel_relaxed(0x0, drvdata->base + ETB_RAM_READ_POINTER);
+        writel_relaxed(0x0, drvdata->base + ETB_RAM_WRITE_POINTER);
+
+        /*
+         * In snapshot mode all we have to do is communicate to
+         * perf_aux_output_end() the address of the current head.  In full
+         * trace mode the same function expects a size to move rb->aux_head
+         * forward.
+         */
+        if (buf->snapshot)
+                local_set(&buf->data_size, (cur * PAGE_SIZE) + offset);
+        else
+                local_add(to_read, &buf->data_size);
+
+        etb_enable_hw(drvdata);
+        CS_LOCK(drvdata->base);
+}
+
 static const struct coresight_ops_sink etb_sink_ops = {
         .enable         = etb_enable,
         .disable        = etb_disable,
+        .alloc_buffer   = etb_alloc_buffer,
+        .free_buffer    = etb_free_buffer,
+        .set_buffer     = etb_set_buffer,
+        .reset_buffer   = etb_reset_buffer,
+        .update_buffer  = etb_update_buffer,
 };
 
 static const struct coresight_ops etb_cs_ops = {
@@ -266,7 +514,7 @@ static void etb_dump(struct etb_drvdata *drvdata)
         unsigned long flags;
 
         spin_lock_irqsave(&drvdata->spinlock, flags);
-        if (drvdata->enable) {
+        if (local_read(&drvdata->mode) == CS_MODE_SYSFS) {
                 etb_disable_hw(drvdata);
                 etb_dump_hw(drvdata);
                 etb_enable_hw(drvdata);
@@ -281,7 +529,7 @@ static int etb_open(struct inode *inode, struct file *file)
         struct etb_drvdata *drvdata = container_of(file->private_data,
                                                    struct etb_drvdata, miscdev);
 
-        if (atomic_cmpxchg(&drvdata->in_use, 0, 1))
+        if (local_cmpxchg(&drvdata->reading, 0, 1))
                 return -EBUSY;
 
         dev_dbg(drvdata->dev, "%s: successfully opened\n", __func__);
@@ -317,7 +565,7 @@ static int etb_release(struct inode *inode, struct file *file)
 {
         struct etb_drvdata *drvdata = container_of(file->private_data,
                                                    struct etb_drvdata, miscdev);
-        atomic_set(&drvdata->in_use, 0);
+        local_set(&drvdata->reading, 0);
 
         dev_dbg(drvdata->dev, "%s: released\n", __func__);
         return 0;
@@ -489,15 +737,6 @@ err_misc_register:
         return ret;
 }
 
-static int etb_remove(struct amba_device *adev)
-{
-        struct etb_drvdata *drvdata = amba_get_drvdata(adev);
-
-        misc_deregister(&drvdata->miscdev);
-        coresight_unregister(drvdata->csdev);
-        return 0;
-}
-
 #ifdef CONFIG_PM
 static int etb_runtime_suspend(struct device *dev)
 {
@@ -537,14 +776,10 @@ static struct amba_driver etb_driver = {
                 .name   = "coresight-etb10",
                 .owner  = THIS_MODULE,
                 .pm     = &etb_dev_pm_ops,
+                .suppress_bind_attrs = true,
 
         },
         .probe          = etb_probe,
-        .remove         = etb_remove,
         .id_table       = etb_ids,
 };
-
-module_amba_driver(etb_driver);
-
-MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("CoreSight Embedded Trace Buffer driver");
+builtin_amba_driver(etb_driver);
diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
new file mode 100644
index 000000000000..36153a77e982
--- /dev/null
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
@@ -0,0 +1,393 @@
+/*
+ * Copyright(C) 2015 Linaro Limited. All rights reserved.
+ * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/coresight.h>
+#include <linux/coresight-pmu.h>
+#include <linux/cpumask.h>
+#include <linux/device.h>
+#include <linux/list.h>
+#include <linux/mm.h>
+#include <linux/module.h>
+#include <linux/perf_event.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/workqueue.h>
+
+#include "coresight-priv.h"
+
+static struct pmu etm_pmu;
+static bool etm_perf_up;
+
+/**
+ * struct etm_event_data - Coresight specifics associated to an event
+ * @work:               Handle to free allocated memory outside IRQ context.
+ * @mask:               Hold the CPU(s) this event was set for.
+ * @snk_config:         The sink configuration.
+ * @path:               An array of path, each slot for one CPU.
+ */
+struct etm_event_data {
+        struct work_struct work;
+        cpumask_t mask;
+        void *snk_config;
+        struct list_head **path;
+};
+
+static DEFINE_PER_CPU(struct perf_output_handle, ctx_handle);
+static DEFINE_PER_CPU(struct coresight_device *, csdev_src);
+
+/* ETMv3.5/PTM's ETMCR is 'config' */
+PMU_FORMAT_ATTR(cycacc,         "config:" __stringify(ETM_OPT_CYCACC));
+PMU_FORMAT_ATTR(timestamp,      "config:" __stringify(ETM_OPT_TS));
+
+static struct attribute *etm_config_formats_attr[] = {
+        &format_attr_cycacc.attr,
+        &format_attr_timestamp.attr,
+        NULL,
+};
+
+static struct attribute_group etm_pmu_format_group = {
+        .name   = "format",
+        .attrs  = etm_config_formats_attr,
+};
+
+static const struct attribute_group *etm_pmu_attr_groups[] = {
+        &etm_pmu_format_group,
+        NULL,
+};
+
+static void etm_event_read(struct perf_event *event) {}
+
+static int etm_event_init(struct perf_event *event)
+{
+        if (event->attr.type != etm_pmu.type)
+                return -ENOENT;
+
+        return 0;
+}
+
+static void free_event_data(struct work_struct *work)
+{
+        int cpu;
+        cpumask_t *mask;
+        struct etm_event_data *event_data;
+        struct coresight_device *sink;
+
+        event_data = container_of(work, struct etm_event_data, work);
+        mask = &event_data->mask;
+        /*
+         * First deal with the sink configuration.  See comment in
+         * etm_setup_aux() about why we take the first available path.
+         */
+        if (event_data->snk_config) {
+                cpu = cpumask_first(mask);
+                sink = coresight_get_sink(event_data->path[cpu]);
+                if (sink_ops(sink)->free_buffer)
+                        sink_ops(sink)->free_buffer(event_data->snk_config);
+        }
+
+        for_each_cpu(cpu, mask) {
+                if (event_data->path[cpu])
+                        coresight_release_path(event_data->path[cpu]);
+        }
+
+        kfree(event_data->path);
+        kfree(event_data);
+}
+
+static void *alloc_event_data(int cpu)
+{
+        int size;
+        cpumask_t *mask;
+        struct etm_event_data *event_data;
+
+        /* First get memory for the session's data */
+        event_data = kzalloc(sizeof(struct etm_event_data), GFP_KERNEL);
+        if (!event_data)
+                return NULL;
+
+        /* Make sure nothing disappears under us */
+        get_online_cpus();
+        size = num_online_cpus();
+
+        mask = &event_data->mask;
+        if (cpu != -1)
+                cpumask_set_cpu(cpu, mask);
+        else
+                cpumask_copy(mask, cpu_online_mask);
+        put_online_cpus();
+
+        /*
+         * Each CPU has a single path between source and destination.  As such
+         * allocate an array using CPU numbers as indexes.  That way a path
+         * for any CPU can easily be accessed at any given time.  We proceed
+         * the same way for sessions involving a single CPU.  The cost of
+         * unused memory when dealing with single CPU trace scenarios is small
+         * compared to the cost of searching through an optimized array.
+         */
+        event_data->path = kcalloc(size,
+                                   sizeof(struct list_head *), GFP_KERNEL);
+        if (!event_data->path) {
+                kfree(event_data);
+                return NULL;
+        }
+
+        return event_data;
+}
+
+static void etm_free_aux(void *data)
+{
+        struct etm_event_data *event_data = data;
+
+        schedule_work(&event_data->work);
+}
+
+static void *etm_setup_aux(int event_cpu, void **pages,
+                           int nr_pages, bool overwrite)
+{
+        int cpu;
+        cpumask_t *mask;
+        struct coresight_device *sink;
+        struct etm_event_data *event_data = NULL;
+
+        event_data = alloc_event_data(event_cpu);
+        if (!event_data)
+                return NULL;
+
+        INIT_WORK(&event_data->work, free_event_data);
+
+        mask = &event_data->mask;
+
+        /* Setup the path for each CPU in a trace session */
+        for_each_cpu(cpu, mask) {
+                struct coresight_device *csdev;
+
+                csdev = per_cpu(csdev_src, cpu);
+                if (!csdev)
+                        goto err;
+
+                /*
+                 * Building a path doesn't enable it, it simply builds a
+                 * list of devices from source to sink that can be
+                 * referenced later when the path is actually needed.
+                 */
+                event_data->path[cpu] = coresight_build_path(csdev);
+                if (!event_data->path[cpu])
+                        goto err;
+        }
+
+        /*
+         * In theory nothing prevent tracers in a trace session from being
+         * associated with different sinks, nor having a sink per tracer.  But
+         * until we have HW with this kind of topology and a way to convey
+         * sink assignement from the perf cmd line we need to assume tracers
+         * in a trace session are using the same sink.  Therefore pick the sink
+         * found at the end of the first available path.
+         */
+        cpu = cpumask_first(mask);
+        /* Grab the sink at the end of the path */
+        sink = coresight_get_sink(event_data->path[cpu]);
+        if (!sink)
+                goto err;
+
+        if (!sink_ops(sink)->alloc_buffer)
+                goto err;
+
+        /* Get the AUX specific data from the sink buffer */
+        event_data->snk_config =
+                        sink_ops(sink)->alloc_buffer(sink, cpu, pages,
+                                                     nr_pages, overwrite);
+        if (!event_data->snk_config)
+                goto err;
+
+out:
+        return event_data;
+
+err:
+        etm_free_aux(event_data);
+        event_data = NULL;
+        goto out;
+}
+
+static void etm_event_start(struct perf_event *event, int flags)
+{
+        int cpu = smp_processor_id();
+        struct etm_event_data *event_data;
+        struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
+        struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
+
+        if (!csdev)
+                goto fail;
+
+        /*
+         * Deal with the ring buffer API and get a handle on the
+         * session's information.
+         */
+        event_data = perf_aux_output_begin(handle, event);
+        if (!event_data)
+                goto fail;
+
+        /* We need a sink, no need to continue without one */
+        sink = coresight_get_sink(event_data->path[cpu]);
+        if (WARN_ON_ONCE(!sink || !sink_ops(sink)->set_buffer))
+                goto fail_end_stop;
+
+        /* Configure the sink */
+        if (sink_ops(sink)->set_buffer(sink, handle,
+                                       event_data->snk_config))
+                goto fail_end_stop;
+
+        /* Nothing will happen without a path */
+        if (coresight_enable_path(event_data->path[cpu], CS_MODE_PERF))
+                goto fail_end_stop;
+
+        /* Tell the perf core the event is alive */
+        event->hw.state = 0;
+
+        /* Finally enable the tracer */
+        if (source_ops(csdev)->enable(csdev, &event->attr, CS_MODE_PERF))
+                goto fail_end_stop;
+
+out:
+        return;
+
+fail_end_stop:
+        perf_aux_output_end(handle, 0, true);
+fail:
+        event->hw.state = PERF_HES_STOPPED;
+        goto out;
+}
+
+static void etm_event_stop(struct perf_event *event, int mode)
+{
+        bool lost;
+        int cpu = smp_processor_id();
+        unsigned long size;
+        struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
+        struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
+        struct etm_event_data *event_data = perf_get_aux(handle);
+
+        if (event->hw.state == PERF_HES_STOPPED)
+                return;
+
+        if (!csdev)
+                return;
+
+        sink = coresight_get_sink(event_data->path[cpu]);
+        if (!sink)
+                return;
+
+        /* stop tracer */
+        source_ops(csdev)->disable(csdev);
+
+        /* tell the core */
+        event->hw.state = PERF_HES_STOPPED;
+
+        if (mode & PERF_EF_UPDATE) {
+                if (WARN_ON_ONCE(handle->event != event))
+                        return;
+
+                /* update trace information */
+                if (!sink_ops(sink)->update_buffer)
+                        return;
+
+                sink_ops(sink)->update_buffer(sink, handle,
+                                              event_data->snk_config);
+
+                if (!sink_ops(sink)->reset_buffer)
+                        return;
+
+                size = sink_ops(sink)->reset_buffer(sink, handle,
+                                                    event_data->snk_config,
+                                                    &lost);
+
+                perf_aux_output_end(handle, size, lost);
+        }
+
+        /* Disabling the path make its elements available to other sessions */
+        coresight_disable_path(event_data->path[cpu]);
+}
+
+static int etm_event_add(struct perf_event *event, int mode)
+{
+        int ret = 0;
+        struct hw_perf_event *hwc = &event->hw;
+
+        if (mode & PERF_EF_START) {
+                etm_event_start(event, 0);
+                if (hwc->state & PERF_HES_STOPPED)
+                        ret = -EINVAL;
+        } else {
+                hwc->state = PERF_HES_STOPPED;
+        }
+
+        return ret;
+}
+
+static void etm_event_del(struct perf_event *event, int mode)
+{
+        etm_event_stop(event, PERF_EF_UPDATE);
+}
+
+int etm_perf_symlink(struct coresight_device *csdev, bool link)
+{
+        char entry[sizeof("cpu9999999")];
+        int ret = 0, cpu = source_ops(csdev)->cpu_id(csdev);
+        struct device *pmu_dev = etm_pmu.dev;
+        struct device *cs_dev = &csdev->dev;
+
+        sprintf(entry, "cpu%d", cpu);
+
+        if (!etm_perf_up)
+                return -EPROBE_DEFER;
+
+        if (link) {
+                ret = sysfs_create_link(&pmu_dev->kobj, &cs_dev->kobj, entry);
+                if (ret)
+                        return ret;
+                per_cpu(csdev_src, cpu) = csdev;
+        } else {
+                sysfs_remove_link(&pmu_dev->kobj, entry);
+                per_cpu(csdev_src, cpu) = NULL;
+        }
+
+        return 0;
+}
+
+static int __init etm_perf_init(void)
+{
+        int ret;
+
+        etm_pmu.capabilities    = PERF_PMU_CAP_EXCLUSIVE;
+
+        etm_pmu.attr_groups     = etm_pmu_attr_groups;
+        etm_pmu.task_ctx_nr     = perf_sw_context;
+        etm_pmu.read            = etm_event_read;
+        etm_pmu.event_init      = etm_event_init;
+        etm_pmu.setup_aux       = etm_setup_aux;
+        etm_pmu.free_aux        = etm_free_aux;
+        etm_pmu.start           = etm_event_start;
+        etm_pmu.stop            = etm_event_stop;
+        etm_pmu.add             = etm_event_add;
+        etm_pmu.del             = etm_event_del;
+
+        ret = perf_pmu_register(&etm_pmu, CORESIGHT_ETM_PMU_NAME, -1);
+        if (ret == 0)
+                etm_perf_up = true;
+
+        return ret;
+}
+module_init(etm_perf_init);
diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.h b/drivers/hwtracing/coresight/coresight-etm-perf.h
new file mode 100644
index 000000000000..87f5a134eb6f
--- /dev/null
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright(C) 2015 Linaro Limited. All rights reserved.
+ * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef _CORESIGHT_ETM_PERF_H
+#define _CORESIGHT_ETM_PERF_H
+
+struct coresight_device;
+
+#ifdef CONFIG_CORESIGHT
+int etm_perf_symlink(struct coresight_device *csdev, bool link);
+
+#else
+static inline int etm_perf_symlink(struct coresight_device *csdev, bool link)
+{ return -EINVAL; }
+
+#endif /* CONFIG_CORESIGHT */
+
+#endif
diff --git a/drivers/hwtracing/coresight/coresight-etm.h b/drivers/hwtracing/coresight/coresight-etm.h
index b4481eb29304..51597cb2c08a 100644
--- a/drivers/hwtracing/coresight/coresight-etm.h
+++ b/drivers/hwtracing/coresight/coresight-etm.h
@@ -13,6 +13,7 @@
 #ifndef _CORESIGHT_CORESIGHT_ETM_H
 #define _CORESIGHT_CORESIGHT_ETM_H
 
+#include <asm/local.h>
 #include <linux/spinlock.h>
 #include "coresight-priv.h"
 
@@ -109,7 +110,10 @@
 #define ETM_MODE_STALL          BIT(2)
 #define ETM_MODE_TIMESTAMP      BIT(3)
 #define ETM_MODE_CTXID          BIT(4)
-#define ETM_MODE_ALL            0x1f
+#define ETM_MODE_ALL            (ETM_MODE_EXCLUDE | ETM_MODE_CYCACC | \
+                                 ETM_MODE_STALL | ETM_MODE_TIMESTAMP | \
+                                 ETM_MODE_CTXID | ETM_MODE_EXCL_KERN | \
+                                 ETM_MODE_EXCL_USER)
 
 #define ETM_SQR_MASK            0x3
 #define ETM_TRACEID_MASK        0x3f
@@ -136,35 +140,16 @@
 #define ETM_DEFAULT_EVENT_VAL   (ETM_HARD_WIRE_RES_A    |       \
                                  ETM_ADD_COMP_0         |       \
                                  ETM_EVENT_NOT_A)
+
 /**
- * struct etm_drvdata - specifics associated to an ETM component
- * @base:       memory mapped base address for this component.
- * @dev:        the device entity associated to this component.
- * @atclk:      optional clock for the core parts of the ETM.
- * @csdev:      component vitals needed by the framework.
- * @spinlock:   only one at a time pls.
- * @cpu:        the cpu this component is affined to.
- * @port_size:  port size as reported by ETMCR bit 4-6 and 21.
- * @arch:       ETM/PTM version number.
- * @use_cpu14:  true if management registers need to be accessed via CP14.
- * @enable:     is this ETM/PTM currently tracing.
- * @sticky_enable: true if ETM base configuration has been done.
- * @boot_enable:true if we should start tracing at boot time.
- * @os_unlock:  true if access to management registers is allowed.
- * @nr_addr_cmp:Number of pairs of address comparators as found in ETMCCR.
- * @nr_cntr:    Number of counters as found in ETMCCR bit 13-15.
- * @nr_ext_inp: Number of external input as found in ETMCCR bit 17-19.
- * @nr_ext_out: Number of external output as found in ETMCCR bit 20-22.
- * @nr_ctxid_cmp: Number of contextID comparators as found in ETMCCR bit 24-25.
- * @etmccr:     value of register ETMCCR.
- * @etmccer:    value of register ETMCCER.
- * @traceid:    value of the current ID for this component.
+ * struct etm_config - configuration information related to an ETM
  * @mode:       controls various modes supported by this ETM/PTM.
  * @ctrl:       used in conjunction with @mode.
  * @trigger_event: setting for register ETMTRIGGER.
  * @startstop_ctrl: setting for register ETMTSSCR.
  * @enable_event: setting for register ETMTEEVR.
  * @enable_ctrl1: setting for register ETMTECR1.
+ * @enable_ctrl2: setting for register ETMTECR2.
  * @fifofull_level: setting for register ETMFFLR.
  * @addr_idx:   index for the address comparator selection.
  * @addr_val:   value for address comparator register.
@@ -189,36 +174,16 @@
  * @ctxid_mask: mask applicable to all the context IDs.
  * @sync_freq:  Synchronisation frequency.
  * @timestamp_event: Defines an event that requests the insertion
-                     of a timestamp into the trace stream.
+ *                   of a timestamp into the trace stream.
  */
-struct etm_drvdata {
-        void __iomem                    *base;
-        struct device                   *dev;
-        struct clk                      *atclk;
-        struct coresight_device         *csdev;
-        spinlock_t                      spinlock;
-        int                             cpu;
-        int                             port_size;
-        u8                              arch;
-        bool                            use_cp14;
-        bool                            enable;
-        bool                            sticky_enable;
-        bool                            boot_enable;
-        bool                            os_unlock;
-        u8                              nr_addr_cmp;
-        u8                              nr_cntr;
-        u8                              nr_ext_inp;
-        u8                              nr_ext_out;
-        u8                              nr_ctxid_cmp;
-        u32                             etmccr;
-        u32                             etmccer;
-        u32                             traceid;
+struct etm_config {
         u32                             mode;
         u32                             ctrl;
         u32                             trigger_event;
         u32                             startstop_ctrl;
         u32                             enable_event;
         u32                             enable_ctrl1;
+        u32                             enable_ctrl2;
         u32                             fifofull_level;
         u8                              addr_idx;
         u32                             addr_val[ETM_MAX_ADDR_CMP];
@@ -244,6 +209,56 @@ struct etm_drvdata {
         u32                             timestamp_event;
 };
 
+/**
+ * struct etm_drvdata - specifics associated to an ETM component
+ * @base:       memory mapped base address for this component.
+ * @dev:        the device entity associated to this component.
+ * @atclk:      optional clock for the core parts of the ETM.
+ * @csdev:      component vitals needed by the framework.
+ * @spinlock:   only one at a time pls.
+ * @cpu:        the cpu this component is affined to.
+ * @port_size:  port size as reported by ETMCR bit 4-6 and 21.
+ * @arch:       ETM/PTM version number.
+ * @use_cpu14:  true if management registers need to be accessed via CP14.
+ * @mode:       this tracer's mode, i.e sysFS, Perf or disabled.
+ * @sticky_enable: true if ETM base configuration has been done.
+ * @boot_enable:true if we should start tracing at boot time.
+ * @os_unlock:  true if access to management registers is allowed.
+ * @nr_addr_cmp:Number of pairs of address comparators as found in ETMCCR.
+ * @nr_cntr:    Number of counters as found in ETMCCR bit 13-15.
+ * @nr_ext_inp: Number of external input as found in ETMCCR bit 17-19.
+ * @nr_ext_out: Number of external output as found in ETMCCR bit 20-22.
+ * @nr_ctxid_cmp: Number of contextID comparators as found in ETMCCR bit 24-25.
+ * @etmccr:     value of register ETMCCR.
+ * @etmccer:    value of register ETMCCER.
+ * @traceid:    value of the current ID for this component.
+ * @config:     structure holding configuration parameters.
+ */
+struct etm_drvdata {
+        void __iomem                    *base;
+        struct device                   *dev;
+        struct clk                      *atclk;
+        struct coresight_device         *csdev;
+        spinlock_t                      spinlock;
+        int                             cpu;
+        int                             port_size;
+        u8                              arch;
+        bool                            use_cp14;
+        local_t                         mode;
+        bool                            sticky_enable;
+        bool                            boot_enable;
+        bool                            os_unlock;
+        u8                              nr_addr_cmp;
+        u8                              nr_cntr;
+        u8                              nr_ext_inp;
+        u8                              nr_ext_out;
+        u8                              nr_ctxid_cmp;
+        u32                             etmccr;
+        u32                             etmccer;
+        u32                             traceid;
+        struct etm_config               config;
+};
+
 enum etm_addr_type {
         ETM_ADDR_TYPE_NONE,
         ETM_ADDR_TYPE_SINGLE,
@@ -251,4 +266,39 @@ enum etm_addr_type {
         ETM_ADDR_TYPE_START,
         ETM_ADDR_TYPE_STOP,
 };
+
+static inline void etm_writel(struct etm_drvdata *drvdata,
+                              u32 val, u32 off)
+{
+        if (drvdata->use_cp14) {
+                if (etm_writel_cp14(off, val)) {
+                        dev_err(drvdata->dev,
+                                "invalid CP14 access to ETM reg: %#x", off);
+                }
+        } else {
+                writel_relaxed(val, drvdata->base + off);
+        }
+}
+
+static inline unsigned int etm_readl(struct etm_drvdata *drvdata, u32 off)
+{
+        u32 val;
+
+        if (drvdata->use_cp14) {
+                if (etm_readl_cp14(off, &val)) {
+                        dev_err(drvdata->dev,
+                                "invalid CP14 access to ETM reg: %#x", off);
+                }
+        } else {
+                val = readl_relaxed(drvdata->base + off);
+        }
+
+        return val;
+}
+
+extern const struct attribute_group *coresight_etm_groups[];
+int etm_get_trace_id(struct etm_drvdata *drvdata);
+void etm_set_default(struct etm_config *config);
+void etm_config_trace_mode(struct etm_config *config);
+struct etm_config *get_etm_config(struct etm_drvdata *drvdata);
 #endif
diff --git a/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
new file mode 100644
index 000000000000..cbb4046c1070
--- /dev/null
+++ b/drivers/hwtracing/coresight/coresight-etm3x-sysfs.c
@@ -0,0 +1,1272 @@
+/*
+ * Copyright(C) 2015 Linaro Limited. All rights reserved.
+ * Author: Mathieu Poirier <mathieu.poirier@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <linux/pm_runtime.h>
+#include <linux/sysfs.h>
+#include "coresight-etm.h"
+
+static ssize_t nr_addr_cmp_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+        val = drvdata->nr_addr_cmp;
+        return sprintf(buf, "%#lx\n", val);
+}
+static DEVICE_ATTR_RO(nr_addr_cmp);
+
+static ssize_t nr_cntr_show(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{       unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+        val = drvdata->nr_cntr;
+        return sprintf(buf, "%#lx\n", val);
+}
+static DEVICE_ATTR_RO(nr_cntr);
+
+static ssize_t nr_ctxid_cmp_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+        val = drvdata->nr_ctxid_cmp;
+        return sprintf(buf, "%#lx\n", val);
+}
+static DEVICE_ATTR_RO(nr_ctxid_cmp);
+
+static ssize_t etmsr_show(struct device *dev,
+                          struct device_attribute *attr, char *buf)
+{
+        unsigned long flags, val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+        pm_runtime_get_sync(drvdata->dev);
+        spin_lock_irqsave(&drvdata->spinlock, flags);
+        CS_UNLOCK(drvdata->base);
+
+        val = etm_readl(drvdata, ETMSR);
+
+        CS_LOCK(drvdata->base);
+        spin_unlock_irqrestore(&drvdata->spinlock, flags);
+        pm_runtime_put(drvdata->dev);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+static DEVICE_ATTR_RO(etmsr);
+
+static ssize_t reset_store(struct device *dev,
+                           struct device_attribute *attr,
+                           const char *buf, size_t size)
+{
+        int i, ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        if (val) {
+                spin_lock(&drvdata->spinlock);
+                memset(config, 0, sizeof(struct etm_config));
+                config->mode = ETM_MODE_EXCLUDE;
+                config->trigger_event = ETM_DEFAULT_EVENT_VAL;
+                for (i = 0; i < drvdata->nr_addr_cmp; i++) {
+                        config->addr_type[i] = ETM_ADDR_TYPE_NONE;
+                }
+
+                etm_set_default(config);
+                spin_unlock(&drvdata->spinlock);
+        }
+
+        return size;
+}
+static DEVICE_ATTR_WO(reset);
+
+static ssize_t mode_show(struct device *dev,
+                         struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->mode;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t mode_store(struct device *dev,
+                          struct device_attribute *attr,
+                          const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        spin_lock(&drvdata->spinlock);
+        config->mode = val & ETM_MODE_ALL;
+
+        if (config->mode & ETM_MODE_EXCLUDE)
+                config->enable_ctrl1 |= ETMTECR1_INC_EXC;
+        else
+                config->enable_ctrl1 &= ~ETMTECR1_INC_EXC;
+
+        if (config->mode & ETM_MODE_CYCACC)
+                config->ctrl |= ETMCR_CYC_ACC;
+        else
+                config->ctrl &= ~ETMCR_CYC_ACC;
+
+        if (config->mode & ETM_MODE_STALL) {
+                if (!(drvdata->etmccr & ETMCCR_FIFOFULL)) {
+                        dev_warn(drvdata->dev, "stall mode not supported\n");
+                        ret = -EINVAL;
+                        goto err_unlock;
+                }
+                config->ctrl |= ETMCR_STALL_MODE;
+         } else
+                config->ctrl &= ~ETMCR_STALL_MODE;
+
+        if (config->mode & ETM_MODE_TIMESTAMP) {
+                if (!(drvdata->etmccer & ETMCCER_TIMESTAMP)) {
+                        dev_warn(drvdata->dev, "timestamp not supported\n");
+                        ret = -EINVAL;
+                        goto err_unlock;
+                }
+                config->ctrl |= ETMCR_TIMESTAMP_EN;
+        } else
+                config->ctrl &= ~ETMCR_TIMESTAMP_EN;
+
+        if (config->mode & ETM_MODE_CTXID)
+                config->ctrl |= ETMCR_CTXID_SIZE;
+        else
+                config->ctrl &= ~ETMCR_CTXID_SIZE;
+
+        if (config->mode & (ETM_MODE_EXCL_KERN | ETM_MODE_EXCL_USER))
+                etm_config_trace_mode(config);
+
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+
+err_unlock:
+        spin_unlock(&drvdata->spinlock);
+        return ret;
+}
+static DEVICE_ATTR_RW(mode);
+
+static ssize_t trigger_event_show(struct device *dev,
+                                  struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->trigger_event;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t trigger_event_store(struct device *dev,
+                                   struct device_attribute *attr,
+                                   const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->trigger_event = val & ETM_EVENT_MASK;
+
+        return size;
+}
+static DEVICE_ATTR_RW(trigger_event);
+
+static ssize_t enable_event_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->enable_event;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t enable_event_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->enable_event = val & ETM_EVENT_MASK;
+
+        return size;
+}
+static DEVICE_ATTR_RW(enable_event);
+
+static ssize_t fifofull_level_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->fifofull_level;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t fifofull_level_store(struct device *dev,
+                                    struct device_attribute *attr,
+                                    const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->fifofull_level = val;
+
+        return size;
+}
+static DEVICE_ATTR_RW(fifofull_level);
+
+static ssize_t addr_idx_show(struct device *dev,
+                             struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->addr_idx;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t addr_idx_store(struct device *dev,
+                              struct device_attribute *attr,
+                              const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        if (val >= drvdata->nr_addr_cmp)
+                return -EINVAL;
+
+        /*
+         * Use spinlock to ensure index doesn't change while it gets
+         * dereferenced multiple times within a spinlock block elsewhere.
+         */
+        spin_lock(&drvdata->spinlock);
+        config->addr_idx = val;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(addr_idx);
+
+static ssize_t addr_single_show(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        u8 idx;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        spin_lock(&drvdata->spinlock);
+        idx = config->addr_idx;
+        if (!(config->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
+              config->addr_type[idx] == ETM_ADDR_TYPE_SINGLE)) {
+                spin_unlock(&drvdata->spinlock);
+                return -EINVAL;
+        }
+
+        val = config->addr_val[idx];
+        spin_unlock(&drvdata->spinlock);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t addr_single_store(struct device *dev,
+                                 struct device_attribute *attr,
+                                 const char *buf, size_t size)
+{
+        u8 idx;
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        spin_lock(&drvdata->spinlock);
+        idx = config->addr_idx;
+        if (!(config->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
+              config->addr_type[idx] == ETM_ADDR_TYPE_SINGLE)) {
+                spin_unlock(&drvdata->spinlock);
+                return -EINVAL;
+        }
+
+        config->addr_val[idx] = val;
+        config->addr_type[idx] = ETM_ADDR_TYPE_SINGLE;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(addr_single);
+
+static ssize_t addr_range_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        u8 idx;
+        unsigned long val1, val2;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        spin_lock(&drvdata->spinlock);
+        idx = config->addr_idx;
+        if (idx % 2 != 0) {
+                spin_unlock(&drvdata->spinlock);
+                return -EPERM;
+        }
+        if (!((config->addr_type[idx] == ETM_ADDR_TYPE_NONE &&
+               config->addr_type[idx + 1] == ETM_ADDR_TYPE_NONE) ||
+              (config->addr_type[idx] == ETM_ADDR_TYPE_RANGE &&
+               config->addr_type[idx + 1] == ETM_ADDR_TYPE_RANGE))) {
+                spin_unlock(&drvdata->spinlock);
+                return -EPERM;
+        }
+
+        val1 = config->addr_val[idx];
+        val2 = config->addr_val[idx + 1];
+        spin_unlock(&drvdata->spinlock);
+
+        return sprintf(buf, "%#lx %#lx\n", val1, val2);
+}
+
+static ssize_t addr_range_store(struct device *dev,
+                              struct device_attribute *attr,
+                              const char *buf, size_t size)
+{
+        u8 idx;
+        unsigned long val1, val2;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        if (sscanf(buf, "%lx %lx", &val1, &val2) != 2)
+                return -EINVAL;
+        /* Lower address comparator cannot have a higher address value */
+        if (val1 > val2)
+                return -EINVAL;
+
+        spin_lock(&drvdata->spinlock);
+        idx = config->addr_idx;
+        if (idx % 2 != 0) {
+                spin_unlock(&drvdata->spinlock);
+                return -EPERM;
+        }
+        if (!((config->addr_type[idx] == ETM_ADDR_TYPE_NONE &&
+               config->addr_type[idx + 1] == ETM_ADDR_TYPE_NONE) ||
+              (config->addr_type[idx] == ETM_ADDR_TYPE_RANGE &&
+               config->addr_type[idx + 1] == ETM_ADDR_TYPE_RANGE))) {
+                spin_unlock(&drvdata->spinlock);
+                return -EPERM;
+        }
+
+        config->addr_val[idx] = val1;
+        config->addr_type[idx] = ETM_ADDR_TYPE_RANGE;
+        config->addr_val[idx + 1] = val2;
+        config->addr_type[idx + 1] = ETM_ADDR_TYPE_RANGE;
+        config->enable_ctrl1 |= (1 << (idx/2));
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(addr_range);
+
+static ssize_t addr_start_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        u8 idx;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        spin_lock(&drvdata->spinlock);
+        idx = config->addr_idx;
+        if (!(config->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
+              config->addr_type[idx] == ETM_ADDR_TYPE_START)) {
+                spin_unlock(&drvdata->spinlock);
+                return -EPERM;
+        }
+
+        val = config->addr_val[idx];
+        spin_unlock(&drvdata->spinlock);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t addr_start_store(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t size)
+{
+        u8 idx;
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        spin_lock(&drvdata->spinlock);
+        idx = config->addr_idx;
+        if (!(config->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
+              config->addr_type[idx] == ETM_ADDR_TYPE_START)) {
+                spin_unlock(&drvdata->spinlock);
+                return -EPERM;
+        }
+
+        config->addr_val[idx] = val;
+        config->addr_type[idx] = ETM_ADDR_TYPE_START;
+        config->startstop_ctrl |= (1 << idx);
+        config->enable_ctrl1 |= BIT(25);
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(addr_start);
+
+static ssize_t addr_stop_show(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        u8 idx;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        spin_lock(&drvdata->spinlock);
+        idx = config->addr_idx;
+        if (!(config->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
+              config->addr_type[idx] == ETM_ADDR_TYPE_STOP)) {
+                spin_unlock(&drvdata->spinlock);
+                return -EPERM;
+        }
+
+        val = config->addr_val[idx];
+        spin_unlock(&drvdata->spinlock);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t addr_stop_store(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t size)
+{
+        u8 idx;
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        spin_lock(&drvdata->spinlock);
+        idx = config->addr_idx;
+        if (!(config->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
+              config->addr_type[idx] == ETM_ADDR_TYPE_STOP)) {
+                spin_unlock(&drvdata->spinlock);
+                return -EPERM;
+        }
+
+        config->addr_val[idx] = val;
+        config->addr_type[idx] = ETM_ADDR_TYPE_STOP;
+        config->startstop_ctrl |= (1 << (idx + 16));
+        config->enable_ctrl1 |= ETMTECR1_START_STOP;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(addr_stop);
+
+static ssize_t addr_acctype_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        spin_lock(&drvdata->spinlock);
+        val = config->addr_acctype[config->addr_idx];
+        spin_unlock(&drvdata->spinlock);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t addr_acctype_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        spin_lock(&drvdata->spinlock);
+        config->addr_acctype[config->addr_idx] = val;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(addr_acctype);
+
+static ssize_t cntr_idx_show(struct device *dev,
+                             struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->cntr_idx;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t cntr_idx_store(struct device *dev,
+                              struct device_attribute *attr,
+                              const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        if (val >= drvdata->nr_cntr)
+                return -EINVAL;
+        /*
+         * Use spinlock to ensure index doesn't change while it gets
+         * dereferenced multiple times within a spinlock block elsewhere.
+         */
+        spin_lock(&drvdata->spinlock);
+        config->cntr_idx = val;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(cntr_idx);
+
+static ssize_t cntr_rld_val_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        spin_lock(&drvdata->spinlock);
+        val = config->cntr_rld_val[config->cntr_idx];
+        spin_unlock(&drvdata->spinlock);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t cntr_rld_val_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        spin_lock(&drvdata->spinlock);
+        config->cntr_rld_val[config->cntr_idx] = val;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(cntr_rld_val);
+
+static ssize_t cntr_event_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        spin_lock(&drvdata->spinlock);
+        val = config->cntr_event[config->cntr_idx];
+        spin_unlock(&drvdata->spinlock);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t cntr_event_store(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        spin_lock(&drvdata->spinlock);
+        config->cntr_event[config->cntr_idx] = val & ETM_EVENT_MASK;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(cntr_event);
+
+static ssize_t cntr_rld_event_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        spin_lock(&drvdata->spinlock);
+        val = config->cntr_rld_event[config->cntr_idx];
+        spin_unlock(&drvdata->spinlock);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t cntr_rld_event_store(struct device *dev,
+                                    struct device_attribute *attr,
+                                    const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        spin_lock(&drvdata->spinlock);
+        config->cntr_rld_event[config->cntr_idx] = val & ETM_EVENT_MASK;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(cntr_rld_event);
+
+static ssize_t cntr_val_show(struct device *dev,
+                             struct device_attribute *attr, char *buf)
+{
+        int i, ret = 0;
+        u32 val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        if (!local_read(&drvdata->mode)) {
+                spin_lock(&drvdata->spinlock);
+                for (i = 0; i < drvdata->nr_cntr; i++)
+                        ret += sprintf(buf, "counter %d: %x\n",
+                                       i, config->cntr_val[i]);
+                spin_unlock(&drvdata->spinlock);
+                return ret;
+        }
+
+        for (i = 0; i < drvdata->nr_cntr; i++) {
+                val = etm_readl(drvdata, ETMCNTVRn(i));
+                ret += sprintf(buf, "counter %d: %x\n", i, val);
+        }
+
+        return ret;
+}
+
+static ssize_t cntr_val_store(struct device *dev,
+                              struct device_attribute *attr,
+                              const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        spin_lock(&drvdata->spinlock);
+        config->cntr_val[config->cntr_idx] = val;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(cntr_val);
+
+static ssize_t seq_12_event_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->seq_12_event;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t seq_12_event_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->seq_12_event = val & ETM_EVENT_MASK;
+        return size;
+}
+static DEVICE_ATTR_RW(seq_12_event);
+
+static ssize_t seq_21_event_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->seq_21_event;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t seq_21_event_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->seq_21_event = val & ETM_EVENT_MASK;
+        return size;
+}
+static DEVICE_ATTR_RW(seq_21_event);
+
+static ssize_t seq_23_event_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->seq_23_event;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t seq_23_event_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->seq_23_event = val & ETM_EVENT_MASK;
+        return size;
+}
+static DEVICE_ATTR_RW(seq_23_event);
+
+static ssize_t seq_31_event_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->seq_31_event;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t seq_31_event_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->seq_31_event = val & ETM_EVENT_MASK;
+        return size;
+}
+static DEVICE_ATTR_RW(seq_31_event);
+
+static ssize_t seq_32_event_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->seq_32_event;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t seq_32_event_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->seq_32_event = val & ETM_EVENT_MASK;
+        return size;
+}
+static DEVICE_ATTR_RW(seq_32_event);
+
+static ssize_t seq_13_event_show(struct device *dev,
+                                 struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->seq_13_event;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t seq_13_event_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->seq_13_event = val & ETM_EVENT_MASK;
+        return size;
+}
+static DEVICE_ATTR_RW(seq_13_event);
+
+static ssize_t seq_curr_state_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        unsigned long val, flags;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        if (!local_read(&drvdata->mode)) {
+                val = config->seq_curr_state;
+                goto out;
+        }
+
+        pm_runtime_get_sync(drvdata->dev);
+        spin_lock_irqsave(&drvdata->spinlock, flags);
+
+        CS_UNLOCK(drvdata->base);
+        val = (etm_readl(drvdata, ETMSQR) & ETM_SQR_MASK);
+        CS_LOCK(drvdata->base);
+
+        spin_unlock_irqrestore(&drvdata->spinlock, flags);
+        pm_runtime_put(drvdata->dev);
+out:
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t seq_curr_state_store(struct device *dev,
+                                    struct device_attribute *attr,
+                                    const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        if (val > ETM_SEQ_STATE_MAX_VAL)
+                return -EINVAL;
+
+        config->seq_curr_state = val;
+
+        return size;
+}
+static DEVICE_ATTR_RW(seq_curr_state);
+
+static ssize_t ctxid_idx_show(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->ctxid_idx;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t ctxid_idx_store(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        if (val >= drvdata->nr_ctxid_cmp)
+                return -EINVAL;
+
+        /*
+         * Use spinlock to ensure index doesn't change while it gets
+         * dereferenced multiple times within a spinlock block elsewhere.
+         */
+        spin_lock(&drvdata->spinlock);
+        config->ctxid_idx = val;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(ctxid_idx);
+
+static ssize_t ctxid_pid_show(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        spin_lock(&drvdata->spinlock);
+        val = config->ctxid_vpid[config->ctxid_idx];
+        spin_unlock(&drvdata->spinlock);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t ctxid_pid_store(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t size)
+{
+        int ret;
+        unsigned long vpid, pid;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &vpid);
+        if (ret)
+                return ret;
+
+        pid = coresight_vpid_to_pid(vpid);
+
+        spin_lock(&drvdata->spinlock);
+        config->ctxid_pid[config->ctxid_idx] = pid;
+        config->ctxid_vpid[config->ctxid_idx] = vpid;
+        spin_unlock(&drvdata->spinlock);
+
+        return size;
+}
+static DEVICE_ATTR_RW(ctxid_pid);
+
+static ssize_t ctxid_mask_show(struct device *dev,
+                               struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->ctxid_mask;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t ctxid_mask_store(struct device *dev,
+                                struct device_attribute *attr,
+                                const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->ctxid_mask = val;
+        return size;
+}
+static DEVICE_ATTR_RW(ctxid_mask);
+
+static ssize_t sync_freq_show(struct device *dev,
+                              struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->sync_freq;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t sync_freq_store(struct device *dev,
+                               struct device_attribute *attr,
+                               const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->sync_freq = val & ETM_SYNC_MASK;
+        return size;
+}
+static DEVICE_ATTR_RW(sync_freq);
+
+static ssize_t timestamp_event_show(struct device *dev,
+                                    struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        val = config->timestamp_event;
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t timestamp_event_store(struct device *dev,
+                                     struct device_attribute *attr,
+                                     const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+        struct etm_config *config = &drvdata->config;
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        config->timestamp_event = val & ETM_EVENT_MASK;
+        return size;
+}
+static DEVICE_ATTR_RW(timestamp_event);
+
+static ssize_t cpu_show(struct device *dev,
+                        struct device_attribute *attr, char *buf)
+{
+        int val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+        val = drvdata->cpu;
+        return scnprintf(buf, PAGE_SIZE, "%d\n", val);
+
+}
+static DEVICE_ATTR_RO(cpu);
+
+static ssize_t traceid_show(struct device *dev,
+                            struct device_attribute *attr, char *buf)
+{
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+        val = etm_get_trace_id(drvdata);
+
+        return sprintf(buf, "%#lx\n", val);
+}
+
+static ssize_t traceid_store(struct device *dev,
+                             struct device_attribute *attr,
+                             const char *buf, size_t size)
+{
+        int ret;
+        unsigned long val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
+
+        ret = kstrtoul(buf, 16, &val);
+        if (ret)
+                return ret;
+
+        drvdata->traceid = val & ETM_TRACEID_MASK;
+        return size;
+}
+static DEVICE_ATTR_RW(traceid);
+
+static struct attribute *coresight_etm_attrs[] = {
+        &dev_attr_nr_addr_cmp.attr,
+        &dev_attr_nr_cntr.attr,
+        &dev_attr_nr_ctxid_cmp.attr,
+        &dev_attr_etmsr.attr,
+        &dev_attr_reset.attr,
+        &dev_attr_mode.attr,
+        &dev_attr_trigger_event.attr,
+        &dev_attr_enable_event.attr,
+        &dev_attr_fifofull_level.attr,
+        &dev_attr_addr_idx.attr,
+        &dev_attr_addr_single.attr,
+        &dev_attr_addr_range.attr,
+        &dev_attr_addr_start.attr,
+        &dev_attr_addr_stop.attr,
+        &dev_attr_addr_acctype.attr,
+        &dev_attr_cntr_idx.attr,
+        &dev_attr_cntr_rld_val.attr,
+        &dev_attr_cntr_event.attr,
+        &dev_attr_cntr_rld_event.attr,
+        &dev_attr_cntr_val.attr,
+        &dev_attr_seq_12_event.attr,
+        &dev_attr_seq_21_event.attr,
+        &dev_attr_seq_23_event.attr,
+        &dev_attr_seq_31_event.attr,
+        &dev_attr_seq_32_event.attr,
+        &dev_attr_seq_13_event.attr,
+        &dev_attr_seq_curr_state.attr,
+        &dev_attr_ctxid_idx.attr,
+        &dev_attr_ctxid_pid.attr,
+        &dev_attr_ctxid_mask.attr,
+        &dev_attr_sync_freq.attr,
+        &dev_attr_timestamp_event.attr,
+        &dev_attr_traceid.attr,
+        &dev_attr_cpu.attr,
+        NULL,
+};
+
+#define coresight_simple_func(name, offset)                             \
+static ssize_t name##_show(struct device *_dev,                         \
+                           struct device_attribute *attr, char *buf)    \
+{                                                                       \
+        struct etm_drvdata *drvdata = dev_get_drvdata(_dev->parent);    \
+        return scnprintf(buf, PAGE_SIZE, "0x%x\n",                      \
+                         readl_relaxed(drvdata->base + offset));        \
+}                                                                       \
+DEVICE_ATTR_RO(name)
+
+coresight_simple_func(etmccr, ETMCCR);
+coresight_simple_func(etmccer, ETMCCER);
+coresight_simple_func(etmscr, ETMSCR);
+coresight_simple_func(etmidr, ETMIDR);
+coresight_simple_func(etmcr, ETMCR);
+coresight_simple_func(etmtraceidr, ETMTRACEIDR);
+coresight_simple_func(etmteevr, ETMTEEVR);
+coresight_simple_func(etmtssvr, ETMTSSCR);
+coresight_simple_func(etmtecr1, ETMTECR1);
+coresight_simple_func(etmtecr2, ETMTECR2);
+
+static struct attribute *coresight_etm_mgmt_attrs[] = {
+        &dev_attr_etmccr.attr,
+        &dev_attr_etmccer.attr,
+        &dev_attr_etmscr.attr,
+        &dev_attr_etmidr.attr,
+        &dev_attr_etmcr.attr,
+        &dev_attr_etmtraceidr.attr,
+        &dev_attr_etmteevr.attr,
+        &dev_attr_etmtssvr.attr,
+        &dev_attr_etmtecr1.attr,
+        &dev_attr_etmtecr2.attr,
+        NULL,
+};
+
+static const struct attribute_group coresight_etm_group = {
+        .attrs = coresight_etm_attrs,
+};
+
+static const struct attribute_group coresight_etm_mgmt_group = {
+        .attrs = coresight_etm_mgmt_attrs,
+        .name = "mgmt",
+};
+
+const struct attribute_group *coresight_etm_groups[] = {
+        &coresight_etm_group,
+        &coresight_etm_mgmt_group,
+        NULL,
+};
diff --git a/drivers/hwtracing/coresight/coresight-etm3x.c b/drivers/hwtracing/coresight/coresight-etm3x.c
index d630b7ece735..d83ab82672e4 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x.c
@@ -1,5 +1,7 @@
 /* Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
  *
+ * Description: CoreSight Program Flow Trace driver
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
  * only version 2 as published by the Free Software Foundation.
@@ -11,7 +13,7 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/device.h>
@@ -27,14 +29,21 @@
 #include <linux/cpu.h>
 #include <linux/of.h>
 #include <linux/coresight.h>
+#include <linux/coresight-pmu.h>
 #include <linux/amba/bus.h>
 #include <linux/seq_file.h>
 #include <linux/uaccess.h>
 #include <linux/clk.h>
+#include <linux/perf_event.h>
 #include <asm/sections.h>
 
 #include "coresight-etm.h"
+#include "coresight-etm-perf.h"
 
+/*
+ * Not really modular but using module_param is the easiest way to
+ * remain consistent with existing use cases for now.
+ */
 static int boot_enable;
 module_param_named(boot_enable, boot_enable, int, S_IRUGO);
 
@@ -42,45 +51,16 @@ module_param_named(boot_enable, boot_enable, int, S_IRUGO);
 static int etm_count;
 static struct etm_drvdata *etmdrvdata[NR_CPUS];
 
-static inline void etm_writel(struct etm_drvdata *drvdata,
-                              u32 val, u32 off)
-{
-        if (drvdata->use_cp14) {
-                if (etm_writel_cp14(off, val)) {
-                        dev_err(drvdata->dev,
-                                "invalid CP14 access to ETM reg: %#x", off);
-                }
-        } else {
-                writel_relaxed(val, drvdata->base + off);
-        }
-}
-
-static inline unsigned int etm_readl(struct etm_drvdata *drvdata, u32 off)
-{
-        u32 val;
-
-        if (drvdata->use_cp14) {
-                if (etm_readl_cp14(off, &val)) {
-                        dev_err(drvdata->dev,
-                                "invalid CP14 access to ETM reg: %#x", off);
-                }
-        } else {
-                val = readl_relaxed(drvdata->base + off);
-        }
-
-        return val;
-}
-
 /*
  * Memory mapped writes to clear os lock are not supported on some processors
  * and OS lock must be unlocked before any memory mapped access on such
  * processors, otherwise memory mapped reads/writes will be invalid.
  */
-static void etm_os_unlock(void *info)
+static void etm_os_unlock(struct etm_drvdata *drvdata)
 {
-        struct etm_drvdata *drvdata = (struct etm_drvdata *)info;
         /* Writing any value to ETMOSLAR unlocks the trace registers */
         etm_writel(drvdata, 0x0, ETMOSLAR);
+        drvdata->os_unlock = true;
         isb();
 }
 
@@ -215,36 +195,156 @@ static void etm_clr_prog(struct etm_drvdata *drvdata)
         }
 }
 
-static void etm_set_default(struct etm_drvdata *drvdata)
+void etm_set_default(struct etm_config *config)
 {
         int i;
 
-        drvdata->trigger_event = ETM_DEFAULT_EVENT_VAL;
-        drvdata->enable_event = ETM_HARD_WIRE_RES_A;
+        if (WARN_ON_ONCE(!config))
+                return;
 
-        drvdata->seq_12_event = ETM_DEFAULT_EVENT_VAL;
-        drvdata->seq_21_event = ETM_DEFAULT_EVENT_VAL;
-        drvdata->seq_23_event = ETM_DEFAULT_EVENT_VAL;
-        drvdata->seq_31_event = ETM_DEFAULT_EVENT_VAL;
-        drvdata->seq_32_event = ETM_DEFAULT_EVENT_VAL;
-        drvdata->seq_13_event = ETM_DEFAULT_EVENT_VAL;
-        drvdata->timestamp_event = ETM_DEFAULT_EVENT_VAL;
+        /*
+         * Taken verbatim from the TRM:
+         *
+         * To trace all memory:
+         *  set bit [24] in register 0x009, the ETMTECR1, to 1
+         *  set all other bits in register 0x009, the ETMTECR1, to 0
+         *  set all bits in register 0x007, the ETMTECR2, to 0
+         *  set register 0x008, the ETMTEEVR, to 0x6F (TRUE).
+         */
+        config->enable_ctrl1 = BIT(24);
+        config->enable_ctrl2 = 0x0;
+        config->enable_event = ETM_HARD_WIRE_RES_A;
 
-        for (i = 0; i < drvdata->nr_cntr; i++) {
-                drvdata->cntr_rld_val[i] = 0x0;
-                drvdata->cntr_event[i] = ETM_DEFAULT_EVENT_VAL;
-                drvdata->cntr_rld_event[i] = ETM_DEFAULT_EVENT_VAL;
-                drvdata->cntr_val[i] = 0x0;
+        config->trigger_event = ETM_DEFAULT_EVENT_VAL;
+        config->enable_event = ETM_HARD_WIRE_RES_A;
+
+        config->seq_12_event = ETM_DEFAULT_EVENT_VAL;
+        config->seq_21_event = ETM_DEFAULT_EVENT_VAL;
+        config->seq_23_event = ETM_DEFAULT_EVENT_VAL;
+        config->seq_31_event = ETM_DEFAULT_EVENT_VAL;
+        config->seq_32_event = ETM_DEFAULT_EVENT_VAL;
+        config->seq_13_event = ETM_DEFAULT_EVENT_VAL;
+        config->timestamp_event = ETM_DEFAULT_EVENT_VAL;
+
+        for (i = 0; i < ETM_MAX_CNTR; i++) {
+                config->cntr_rld_val[i] = 0x0;
+                config->cntr_event[i] = ETM_DEFAULT_EVENT_VAL;
+                config->cntr_rld_event[i] = ETM_DEFAULT_EVENT_VAL;
+                config->cntr_val[i] = 0x0;
         }
 
-        drvdata->seq_curr_state = 0x0;
-        drvdata->ctxid_idx = 0x0;
-        for (i = 0; i < drvdata->nr_ctxid_cmp; i++) {
-                drvdata->ctxid_pid[i] = 0x0;
-                drvdata->ctxid_vpid[i] = 0x0;
+        config->seq_curr_state = 0x0;
+        config->ctxid_idx = 0x0;
+        for (i = 0; i < ETM_MAX_CTXID_CMP; i++) {
+                config->ctxid_pid[i] = 0x0;
+                config->ctxid_vpid[i] = 0x0;
         }
 
-        drvdata->ctxid_mask = 0x0;
+        config->ctxid_mask = 0x0;
+}
+
+void etm_config_trace_mode(struct etm_config *config)
+{
+        u32 flags, mode;
+
+        mode = config->mode;
+
+        mode &= (ETM_MODE_EXCL_KERN | ETM_MODE_EXCL_USER);
+
+        /* excluding kernel AND user space doesn't make sense */
+        if (mode == (ETM_MODE_EXCL_KERN | ETM_MODE_EXCL_USER))
+                return;
+
+        /* nothing to do if neither flags are set */
+        if (!(mode & ETM_MODE_EXCL_KERN) && !(mode & ETM_MODE_EXCL_USER))
+                return;
+
+        flags = (1 << 0 |       /* instruction execute */
+                 3 << 3 |       /* ARM instruction */
+                 0 << 5 |       /* No data value comparison */
+                 0 << 7 |       /* No exact mach */
+                 0 << 8);       /* Ignore context ID */
+
+        /* No need to worry about single address comparators. */
+        config->enable_ctrl2 = 0x0;
+
+        /* Bit 0 is address range comparator 1 */
+        config->enable_ctrl1 = ETMTECR1_ADDR_COMP_1;
+
+        /*
+         * On ETMv3.5:
+         * ETMACTRn[13,11] == Non-secure state comparison control
+         * ETMACTRn[12,10] == Secure state comparison control
+         *
+         * b00 == Match in all modes in this state
+         * b01 == Do not match in any more in this state
+         * b10 == Match in all modes excepts user mode in this state
+         * b11 == Match only in user mode in this state
+         */
+
+        /* Tracing in secure mode is not supported at this time */
+        flags |= (0 << 12 | 1 << 10);
+
+        if (mode & ETM_MODE_EXCL_USER) {
+                /* exclude user, match all modes except user mode */
+                flags |= (1 << 13 | 0 << 11);
+        } else {
+                /* exclude kernel, match only in user mode */
+                flags |= (1 << 13 | 1 << 11);
+        }
+
+        /*
+         * The ETMEEVR register is already set to "hard wire A".  As such
+         * all there is to do is setup an address comparator that spans
+         * the entire address range and configure the state and mode bits.
+         */
+        config->addr_val[0] = (u32) 0x0;
+        config->addr_val[1] = (u32) ~0x0;
+        config->addr_acctype[0] = flags;
+        config->addr_acctype[1] = flags;
+        config->addr_type[0] = ETM_ADDR_TYPE_RANGE;
+        config->addr_type[1] = ETM_ADDR_TYPE_RANGE;
+}
+
+#define ETM3X_SUPPORTED_OPTIONS (ETMCR_CYC_ACC | ETMCR_TIMESTAMP_EN)
+
+static int etm_parse_event_config(struct etm_drvdata *drvdata,
+                                  struct perf_event_attr *attr)
+{
+        struct etm_config *config = &drvdata->config;
+
+        if (!attr)
+                return -EINVAL;
+
+        /* Clear configuration from previous run */
+        memset(config, 0, sizeof(struct etm_config));
+
+        if (attr->exclude_kernel)
+                config->mode = ETM_MODE_EXCL_KERN;
+
+        if (attr->exclude_user)
+                config->mode = ETM_MODE_EXCL_USER;
+
+        /* Always start from the default config */
+        etm_set_default(config);
+
+        /*
+         * By default the tracers are configured to trace the whole address
+         * range.  Narrow the field only if requested by user space.
+         */
+        if (config->mode)
+                etm_config_trace_mode(config);
+
+        /*
+         * At this time only cycle accurate and timestamp options are
+         * available.
+         */
+        if (attr->config & ~ETM3X_SUPPORTED_OPTIONS)
+                return -EINVAL;
+
+        config->ctrl = attr->config;
+
+        return 0;
 }
 
 static void etm_enable_hw(void *info)
@@ -252,6 +352,7 @@ static void etm_enable_hw(void *info)
         int i;
         u32 etmcr;
         struct etm_drvdata *drvdata = info;
+        struct etm_config *config = &drvdata->config;
 
         CS_UNLOCK(drvdata->base);
 
@@ -265,65 +366,74 @@ static void etm_enable_hw(void *info)
         etm_set_prog(drvdata);
 
         etmcr = etm_readl(drvdata, ETMCR);
-        etmcr &= (ETMCR_PWD_DWN | ETMCR_ETM_PRG);
+        /* Clear setting from a previous run if need be */
+        etmcr &= ~ETM3X_SUPPORTED_OPTIONS;
         etmcr |= drvdata->port_size;
-        etm_writel(drvdata, drvdata->ctrl | etmcr, ETMCR);
-        etm_writel(drvdata, drvdata->trigger_event, ETMTRIGGER);
-        etm_writel(drvdata, drvdata->startstop_ctrl, ETMTSSCR);
-        etm_writel(drvdata, drvdata->enable_event, ETMTEEVR);
-        etm_writel(drvdata, drvdata->enable_ctrl1, ETMTECR1);
-        etm_writel(drvdata, drvdata->fifofull_level, ETMFFLR);
+        etmcr |= ETMCR_ETM_EN;
+        etm_writel(drvdata, config->ctrl | etmcr, ETMCR);
+        etm_writel(drvdata, config->trigger_event, ETMTRIGGER);
+        etm_writel(drvdata, config->startstop_ctrl, ETMTSSCR);
+        etm_writel(drvdata, config->enable_event, ETMTEEVR);
+        etm_writel(drvdata, config->enable_ctrl1, ETMTECR1);
+        etm_writel(drvdata, config->fifofull_level, ETMFFLR);
         for (i = 0; i < drvdata->nr_addr_cmp; i++) {
-                etm_writel(drvdata, drvdata->addr_val[i], ETMACVRn(i));
-                etm_writel(drvdata, drvdata->addr_acctype[i], ETMACTRn(i));
+                etm_writel(drvdata, config->addr_val[i], ETMACVRn(i));
+                etm_writel(drvdata, config->addr_acctype[i], ETMACTRn(i));
         }
         for (i = 0; i < drvdata->nr_cntr; i++) {
-                etm_writel(drvdata, drvdata->cntr_rld_val[i], ETMCNTRLDVRn(i));
-                etm_writel(drvdata, drvdata->cntr_event[i], ETMCNTENRn(i));
-                etm_writel(drvdata, drvdata->cntr_rld_event[i],
+                etm_writel(drvdata, config->cntr_rld_val[i], ETMCNTRLDVRn(i));
+                etm_writel(drvdata, config->cntr_event[i], ETMCNTENRn(i));
+                etm_writel(drvdata, config->cntr_rld_event[i],
                            ETMCNTRLDEVRn(i));
-                etm_writel(drvdata, drvdata->cntr_val[i], ETMCNTVRn(i));
-        }
-        etm_writel(drvdata, drvdata->seq_12_event, ETMSQ12EVR);
-        etm_writel(drvdata, drvdata->seq_21_event, ETMSQ21EVR);
-        etm_writel(drvdata, drvdata->seq_23_event, ETMSQ23EVR);
-        etm_writel(drvdata, drvdata->seq_31_event, ETMSQ31EVR);
-        etm_writel(drvdata, drvdata->seq_32_event, ETMSQ32EVR);
-        etm_writel(drvdata, drvdata->seq_13_event, ETMSQ13EVR);
-        etm_writel(drvdata, drvdata->seq_curr_state, ETMSQR);
+                etm_writel(drvdata, config->cntr_val[i], ETMCNTVRn(i));
+        }
+        etm_writel(drvdata, config->seq_12_event, ETMSQ12EVR);
+        etm_writel(drvdata, config->seq_21_event, ETMSQ21EVR);
+        etm_writel(drvdata, config->seq_23_event, ETMSQ23EVR);
+        etm_writel(drvdata, config->seq_31_event, ETMSQ31EVR);
+        etm_writel(drvdata, config->seq_32_event, ETMSQ32EVR);
+        etm_writel(drvdata, config->seq_13_event, ETMSQ13EVR);
+        etm_writel(drvdata, config->seq_curr_state, ETMSQR);
         for (i = 0; i < drvdata->nr_ext_out; i++)
                 etm_writel(drvdata, ETM_DEFAULT_EVENT_VAL, ETMEXTOUTEVRn(i));
         for (i = 0; i < drvdata->nr_ctxid_cmp; i++)
-                etm_writel(drvdata, drvdata->ctxid_pid[i], ETMCIDCVRn(i));
-        etm_writel(drvdata, drvdata->ctxid_mask, ETMCIDCMR);
-        etm_writel(drvdata, drvdata->sync_freq, ETMSYNCFR);
+                etm_writel(drvdata, config->ctxid_pid[i], ETMCIDCVRn(i));
+        etm_writel(drvdata, config->ctxid_mask, ETMCIDCMR);
+        etm_writel(drvdata, config->sync_freq, ETMSYNCFR);
         /* No external input selected */
         etm_writel(drvdata, 0x0, ETMEXTINSELR);
-        etm_writel(drvdata, drvdata->timestamp_event, ETMTSEVR);
+        etm_writel(drvdata, config->timestamp_event, ETMTSEVR);
         /* No auxiliary control selected */
         etm_writel(drvdata, 0x0, ETMAUXCR);
         etm_writel(drvdata, drvdata->traceid, ETMTRACEIDR);
         /* No VMID comparator value selected */
         etm_writel(drvdata, 0x0, ETMVMIDCVR);
 
-        /* Ensures trace output is enabled from this ETM */
-        etm_writel(drvdata, drvdata->ctrl | ETMCR_ETM_EN | etmcr, ETMCR);
-
         etm_clr_prog(drvdata);
         CS_LOCK(drvdata->base);
 
         dev_dbg(drvdata->dev, "cpu: %d enable smp call done\n", drvdata->cpu);
 }
 
-static int etm_trace_id(struct coresight_device *csdev)
+static int etm_cpu_id(struct coresight_device *csdev)
 {
         struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        return drvdata->cpu;
+}
+
+int etm_get_trace_id(struct etm_drvdata *drvdata)
+{
         unsigned long flags;
         int trace_id = -1;
 
-        if (!drvdata->enable)
+        if (!drvdata)
+                goto out;
+
+        if (!local_read(&drvdata->mode))
                 return drvdata->traceid;
-        pm_runtime_get_sync(csdev->dev.parent);
+
+        pm_runtime_get_sync(drvdata->dev);
 
         spin_lock_irqsave(&drvdata->spinlock, flags);
 
@@ -332,17 +442,41 @@ static int etm_trace_id(struct coresight_device *csdev)
         CS_LOCK(drvdata->base);
 
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
-        pm_runtime_put(csdev->dev.parent);
+        pm_runtime_put(drvdata->dev);
 
+out:
         return trace_id;
+
+}
+
+static int etm_trace_id(struct coresight_device *csdev)
+{
+        struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        return etm_get_trace_id(drvdata);
 }
 
-static int etm_enable(struct coresight_device *csdev)
+static int etm_enable_perf(struct coresight_device *csdev,
+                           struct perf_event_attr *attr)
+{
+        struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        if (WARN_ON_ONCE(drvdata->cpu != smp_processor_id()))
+                return -EINVAL;
+
+        /* Configure the tracer based on the session's specifics */
+        etm_parse_event_config(drvdata, attr);
+        /* And enable it */
+        etm_enable_hw(drvdata);
+
+        return 0;
+}
+
+static int etm_enable_sysfs(struct coresight_device *csdev)
 {
         struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
         int ret;
 
-        pm_runtime_get_sync(csdev->dev.parent);
         spin_lock(&drvdata->spinlock);
 
         /*
@@ -357,16 +491,45 @@ static int etm_enable(struct coresight_device *csdev)
                         goto err;
         }
 
-        drvdata->enable = true;
         drvdata->sticky_enable = true;
-
         spin_unlock(&drvdata->spinlock);
 
         dev_info(drvdata->dev, "ETM tracing enabled\n");
         return 0;
+
 err:
         spin_unlock(&drvdata->spinlock);
-        pm_runtime_put(csdev->dev.parent);
+        return ret;
+}
+
+static int etm_enable(struct coresight_device *csdev,
+                      struct perf_event_attr *attr, u32 mode)
+{
+        int ret;
+        u32 val;
+        struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        val = local_cmpxchg(&drvdata->mode, CS_MODE_DISABLED, mode);
+
+        /* Someone is already using the tracer */
+        if (val)
+                return -EBUSY;
+
+        switch (mode) {
+        case CS_MODE_SYSFS:
+                ret = etm_enable_sysfs(csdev);
+                break;
+        case CS_MODE_PERF:
+                ret = etm_enable_perf(csdev, attr);
+                break;
+        default:
+                ret = -EINVAL;
+        }
+
+        /* The tracer didn't start */
+        if (ret)
+                local_set(&drvdata->mode, CS_MODE_DISABLED);
+
         return ret;
 }
 
@@ -374,18 +537,16 @@ static void etm_disable_hw(void *info)
 {
         int i;
         struct etm_drvdata *drvdata = info;
+        struct etm_config *config = &drvdata->config;
 
         CS_UNLOCK(drvdata->base);
         etm_set_prog(drvdata);
 
-        /* Program trace enable to low by using always false event */
-        etm_writel(drvdata, ETM_HARD_WIRE_RES_A | ETM_EVENT_NOT_A, ETMTEEVR);
-
         /* Read back sequencer and counters for post trace analysis */
-        drvdata->seq_curr_state = (etm_readl(drvdata, ETMSQR) & ETM_SQR_MASK);
+        config->seq_curr_state = (etm_readl(drvdata, ETMSQR) & ETM_SQR_MASK);
 
         for (i = 0; i < drvdata->nr_cntr; i++)
-                drvdata->cntr_val[i] = etm_readl(drvdata, ETMCNTVRn(i));
+                config->cntr_val[i] = etm_readl(drvdata, ETMCNTVRn(i));
 
         etm_set_pwrdwn(drvdata);
         CS_LOCK(drvdata->base);
@@ -393,7 +554,28 @@ static void etm_disable_hw(void *info)
         dev_dbg(drvdata->dev, "cpu: %d disable smp call done\n", drvdata->cpu);
 }
 
-static void etm_disable(struct coresight_device *csdev)
+static void etm_disable_perf(struct coresight_device *csdev)
+{
+        struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        if (WARN_ON_ONCE(drvdata->cpu != smp_processor_id()))
+                return;
+
+        CS_UNLOCK(drvdata->base);
+
+        /* Setting the prog bit disables tracing immediately */
+        etm_set_prog(drvdata);
+
+        /*
+         * There is no way to know when the tracer will be used again so
+         * power down the tracer.
+         */
+        etm_set_pwrdwn(drvdata);
+
+        CS_LOCK(drvdata->base);
+}
+
+static void etm_disable_sysfs(struct coresight_device *csdev)
 {
         struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
@@ -411,1235 +593,52 @@ static void etm_disable(struct coresight_device *csdev)
          * ensures that register writes occur when cpu is powered.
          */
         smp_call_function_single(drvdata->cpu, etm_disable_hw, drvdata, 1);
-        drvdata->enable = false;
 
         spin_unlock(&drvdata->spinlock);
         put_online_cpus();
-        pm_runtime_put(csdev->dev.parent);
 
         dev_info(drvdata->dev, "ETM tracing disabled\n");
 }
 
-static const struct coresight_ops_source etm_source_ops = {
-        .trace_id       = etm_trace_id,
-        .enable         = etm_enable,
-        .disable        = etm_disable,
-};
-
-static const struct coresight_ops etm_cs_ops = {
-        .source_ops     = &etm_source_ops,
-};
-
-static ssize_t nr_addr_cmp_show(struct device *dev,
-                                struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->nr_addr_cmp;
-        return sprintf(buf, "%#lx\n", val);
-}
-static DEVICE_ATTR_RO(nr_addr_cmp);
-
-static ssize_t nr_cntr_show(struct device *dev,
-                            struct device_attribute *attr, char *buf)
-{       unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->nr_cntr;
-        return sprintf(buf, "%#lx\n", val);
-}
-static DEVICE_ATTR_RO(nr_cntr);
-
-static ssize_t nr_ctxid_cmp_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->nr_ctxid_cmp;
-        return sprintf(buf, "%#lx\n", val);
-}
-static DEVICE_ATTR_RO(nr_ctxid_cmp);
-
-static ssize_t etmsr_show(struct device *dev,
-                          struct device_attribute *attr, char *buf)
-{
-        unsigned long flags, val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        pm_runtime_get_sync(drvdata->dev);
-        spin_lock_irqsave(&drvdata->spinlock, flags);
-        CS_UNLOCK(drvdata->base);
-
-        val = etm_readl(drvdata, ETMSR);
-
-        CS_LOCK(drvdata->base);
-        spin_unlock_irqrestore(&drvdata->spinlock, flags);
-        pm_runtime_put(drvdata->dev);
-
-        return sprintf(buf, "%#lx\n", val);
-}
-static DEVICE_ATTR_RO(etmsr);
-
-static ssize_t reset_store(struct device *dev,
-                           struct device_attribute *attr,
-                           const char *buf, size_t size)
-{
-        int i, ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        if (val) {
-                spin_lock(&drvdata->spinlock);
-                drvdata->mode = ETM_MODE_EXCLUDE;
-                drvdata->ctrl = 0x0;
-                drvdata->trigger_event = ETM_DEFAULT_EVENT_VAL;
-                drvdata->startstop_ctrl = 0x0;
-                drvdata->addr_idx = 0x0;
-                for (i = 0; i < drvdata->nr_addr_cmp; i++) {
-                        drvdata->addr_val[i] = 0x0;
-                        drvdata->addr_acctype[i] = 0x0;
-                        drvdata->addr_type[i] = ETM_ADDR_TYPE_NONE;
-                }
-                drvdata->cntr_idx = 0x0;
-
-                etm_set_default(drvdata);
-                spin_unlock(&drvdata->spinlock);
-        }
-
-        return size;
-}
-static DEVICE_ATTR_WO(reset);
-
-static ssize_t mode_show(struct device *dev,
-                         struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->mode;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t mode_store(struct device *dev,
-                          struct device_attribute *attr,
-                          const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        spin_lock(&drvdata->spinlock);
-        drvdata->mode = val & ETM_MODE_ALL;
-
-        if (drvdata->mode & ETM_MODE_EXCLUDE)
-                drvdata->enable_ctrl1 |= ETMTECR1_INC_EXC;
-        else
-                drvdata->enable_ctrl1 &= ~ETMTECR1_INC_EXC;
-
-        if (drvdata->mode & ETM_MODE_CYCACC)
-                drvdata->ctrl |= ETMCR_CYC_ACC;
-        else
-                drvdata->ctrl &= ~ETMCR_CYC_ACC;
-
-        if (drvdata->mode & ETM_MODE_STALL) {
-                if (!(drvdata->etmccr & ETMCCR_FIFOFULL)) {
-                        dev_warn(drvdata->dev, "stall mode not supported\n");
-                        ret = -EINVAL;
-                        goto err_unlock;
-                }
-                drvdata->ctrl |= ETMCR_STALL_MODE;
-         } else
-                drvdata->ctrl &= ~ETMCR_STALL_MODE;
-
-        if (drvdata->mode & ETM_MODE_TIMESTAMP) {
-                if (!(drvdata->etmccer & ETMCCER_TIMESTAMP)) {
-                        dev_warn(drvdata->dev, "timestamp not supported\n");
-                        ret = -EINVAL;
-                        goto err_unlock;
-                }
-                drvdata->ctrl |= ETMCR_TIMESTAMP_EN;
-        } else
-                drvdata->ctrl &= ~ETMCR_TIMESTAMP_EN;
-
-        if (drvdata->mode & ETM_MODE_CTXID)
-                drvdata->ctrl |= ETMCR_CTXID_SIZE;
-        else
-                drvdata->ctrl &= ~ETMCR_CTXID_SIZE;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-
-err_unlock:
-        spin_unlock(&drvdata->spinlock);
-        return ret;
-}
-static DEVICE_ATTR_RW(mode);
-
-static ssize_t trigger_event_show(struct device *dev,
-                                  struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->trigger_event;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t trigger_event_store(struct device *dev,
-                                   struct device_attribute *attr,
-                                   const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->trigger_event = val & ETM_EVENT_MASK;
-
-        return size;
-}
-static DEVICE_ATTR_RW(trigger_event);
-
-static ssize_t enable_event_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->enable_event;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t enable_event_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->enable_event = val & ETM_EVENT_MASK;
-
-        return size;
-}
-static DEVICE_ATTR_RW(enable_event);
-
-static ssize_t fifofull_level_show(struct device *dev,
-                                   struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->fifofull_level;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t fifofull_level_store(struct device *dev,
-                                    struct device_attribute *attr,
-                                    const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->fifofull_level = val;
-
-        return size;
-}
-static DEVICE_ATTR_RW(fifofull_level);
-
-static ssize_t addr_idx_show(struct device *dev,
-                             struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->addr_idx;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t addr_idx_store(struct device *dev,
-                              struct device_attribute *attr,
-                              const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        if (val >= drvdata->nr_addr_cmp)
-                return -EINVAL;
-
-        /*
-         * Use spinlock to ensure index doesn't change while it gets
-         * dereferenced multiple times within a spinlock block elsewhere.
-         */
-        spin_lock(&drvdata->spinlock);
-        drvdata->addr_idx = val;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(addr_idx);
-
-static ssize_t addr_single_show(struct device *dev,
-                                struct device_attribute *attr, char *buf)
-{
-        u8 idx;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        spin_lock(&drvdata->spinlock);
-        idx = drvdata->addr_idx;
-        if (!(drvdata->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
-              drvdata->addr_type[idx] == ETM_ADDR_TYPE_SINGLE)) {
-                spin_unlock(&drvdata->spinlock);
-                return -EINVAL;
-        }
-
-        val = drvdata->addr_val[idx];
-        spin_unlock(&drvdata->spinlock);
-
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t addr_single_store(struct device *dev,
-                                 struct device_attribute *attr,
-                                 const char *buf, size_t size)
-{
-        u8 idx;
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        spin_lock(&drvdata->spinlock);
-        idx = drvdata->addr_idx;
-        if (!(drvdata->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
-              drvdata->addr_type[idx] == ETM_ADDR_TYPE_SINGLE)) {
-                spin_unlock(&drvdata->spinlock);
-                return -EINVAL;
-        }
-
-        drvdata->addr_val[idx] = val;
-        drvdata->addr_type[idx] = ETM_ADDR_TYPE_SINGLE;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(addr_single);
-
-static ssize_t addr_range_show(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        u8 idx;
-        unsigned long val1, val2;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        spin_lock(&drvdata->spinlock);
-        idx = drvdata->addr_idx;
-        if (idx % 2 != 0) {
-                spin_unlock(&drvdata->spinlock);
-                return -EPERM;
-        }
-        if (!((drvdata->addr_type[idx] == ETM_ADDR_TYPE_NONE &&
-               drvdata->addr_type[idx + 1] == ETM_ADDR_TYPE_NONE) ||
-              (drvdata->addr_type[idx] == ETM_ADDR_TYPE_RANGE &&
-               drvdata->addr_type[idx + 1] == ETM_ADDR_TYPE_RANGE))) {
-                spin_unlock(&drvdata->spinlock);
-                return -EPERM;
-        }
-
-        val1 = drvdata->addr_val[idx];
-        val2 = drvdata->addr_val[idx + 1];
-        spin_unlock(&drvdata->spinlock);
-
-        return sprintf(buf, "%#lx %#lx\n", val1, val2);
-}
-
-static ssize_t addr_range_store(struct device *dev,
-                              struct device_attribute *attr,
-                              const char *buf, size_t size)
-{
-        u8 idx;
-        unsigned long val1, val2;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        if (sscanf(buf, "%lx %lx", &val1, &val2) != 2)
-                return -EINVAL;
-        /* Lower address comparator cannot have a higher address value */
-        if (val1 > val2)
-                return -EINVAL;
-
-        spin_lock(&drvdata->spinlock);
-        idx = drvdata->addr_idx;
-        if (idx % 2 != 0) {
-                spin_unlock(&drvdata->spinlock);
-                return -EPERM;
-        }
-        if (!((drvdata->addr_type[idx] == ETM_ADDR_TYPE_NONE &&
-               drvdata->addr_type[idx + 1] == ETM_ADDR_TYPE_NONE) ||
-              (drvdata->addr_type[idx] == ETM_ADDR_TYPE_RANGE &&
-               drvdata->addr_type[idx + 1] == ETM_ADDR_TYPE_RANGE))) {
-                spin_unlock(&drvdata->spinlock);
-                return -EPERM;
-        }
-
-        drvdata->addr_val[idx] = val1;
-        drvdata->addr_type[idx] = ETM_ADDR_TYPE_RANGE;
-        drvdata->addr_val[idx + 1] = val2;
-        drvdata->addr_type[idx + 1] = ETM_ADDR_TYPE_RANGE;
-        drvdata->enable_ctrl1 |= (1 << (idx/2));
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(addr_range);
-
-static ssize_t addr_start_show(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        u8 idx;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        spin_lock(&drvdata->spinlock);
-        idx = drvdata->addr_idx;
-        if (!(drvdata->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
-              drvdata->addr_type[idx] == ETM_ADDR_TYPE_START)) {
-                spin_unlock(&drvdata->spinlock);
-                return -EPERM;
-        }
-
-        val = drvdata->addr_val[idx];
-        spin_unlock(&drvdata->spinlock);
-
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t addr_start_store(struct device *dev,
-                                struct device_attribute *attr,
-                                const char *buf, size_t size)
-{
-        u8 idx;
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        spin_lock(&drvdata->spinlock);
-        idx = drvdata->addr_idx;
-        if (!(drvdata->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
-              drvdata->addr_type[idx] == ETM_ADDR_TYPE_START)) {
-                spin_unlock(&drvdata->spinlock);
-                return -EPERM;
-        }
-
-        drvdata->addr_val[idx] = val;
-        drvdata->addr_type[idx] = ETM_ADDR_TYPE_START;
-        drvdata->startstop_ctrl |= (1 << idx);
-        drvdata->enable_ctrl1 |= BIT(25);
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(addr_start);
-
-static ssize_t addr_stop_show(struct device *dev,
-                              struct device_attribute *attr, char *buf)
-{
-        u8 idx;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        spin_lock(&drvdata->spinlock);
-        idx = drvdata->addr_idx;
-        if (!(drvdata->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
-              drvdata->addr_type[idx] == ETM_ADDR_TYPE_STOP)) {
-                spin_unlock(&drvdata->spinlock);
-                return -EPERM;
-        }
-
-        val = drvdata->addr_val[idx];
-        spin_unlock(&drvdata->spinlock);
-
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t addr_stop_store(struct device *dev,
-                               struct device_attribute *attr,
-                               const char *buf, size_t size)
-{
-        u8 idx;
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        spin_lock(&drvdata->spinlock);
-        idx = drvdata->addr_idx;
-        if (!(drvdata->addr_type[idx] == ETM_ADDR_TYPE_NONE ||
-              drvdata->addr_type[idx] == ETM_ADDR_TYPE_STOP)) {
-                spin_unlock(&drvdata->spinlock);
-                return -EPERM;
-        }
-
-        drvdata->addr_val[idx] = val;
-        drvdata->addr_type[idx] = ETM_ADDR_TYPE_STOP;
-        drvdata->startstop_ctrl |= (1 << (idx + 16));
-        drvdata->enable_ctrl1 |= ETMTECR1_START_STOP;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(addr_stop);
-
-static ssize_t addr_acctype_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        spin_lock(&drvdata->spinlock);
-        val = drvdata->addr_acctype[drvdata->addr_idx];
-        spin_unlock(&drvdata->spinlock);
-
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t addr_acctype_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        spin_lock(&drvdata->spinlock);
-        drvdata->addr_acctype[drvdata->addr_idx] = val;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(addr_acctype);
-
-static ssize_t cntr_idx_show(struct device *dev,
-                             struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->cntr_idx;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t cntr_idx_store(struct device *dev,
-                              struct device_attribute *attr,
-                              const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        if (val >= drvdata->nr_cntr)
-                return -EINVAL;
-        /*
-         * Use spinlock to ensure index doesn't change while it gets
-         * dereferenced multiple times within a spinlock block elsewhere.
-         */
-        spin_lock(&drvdata->spinlock);
-        drvdata->cntr_idx = val;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(cntr_idx);
-
-static ssize_t cntr_rld_val_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        spin_lock(&drvdata->spinlock);
-        val = drvdata->cntr_rld_val[drvdata->cntr_idx];
-        spin_unlock(&drvdata->spinlock);
-
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t cntr_rld_val_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        spin_lock(&drvdata->spinlock);
-        drvdata->cntr_rld_val[drvdata->cntr_idx] = val;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(cntr_rld_val);
-
-static ssize_t cntr_event_show(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        spin_lock(&drvdata->spinlock);
-        val = drvdata->cntr_event[drvdata->cntr_idx];
-        spin_unlock(&drvdata->spinlock);
-
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t cntr_event_store(struct device *dev,
-                                struct device_attribute *attr,
-                                const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        spin_lock(&drvdata->spinlock);
-        drvdata->cntr_event[drvdata->cntr_idx] = val & ETM_EVENT_MASK;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(cntr_event);
-
-static ssize_t cntr_rld_event_show(struct device *dev,
-                                   struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        spin_lock(&drvdata->spinlock);
-        val = drvdata->cntr_rld_event[drvdata->cntr_idx];
-        spin_unlock(&drvdata->spinlock);
-
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t cntr_rld_event_store(struct device *dev,
-                                    struct device_attribute *attr,
-                                    const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        spin_lock(&drvdata->spinlock);
-        drvdata->cntr_rld_event[drvdata->cntr_idx] = val & ETM_EVENT_MASK;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(cntr_rld_event);
-
-static ssize_t cntr_val_show(struct device *dev,
-                             struct device_attribute *attr, char *buf)
-{
-        int i, ret = 0;
-        u32 val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        if (!drvdata->enable) {
-                spin_lock(&drvdata->spinlock);
-                for (i = 0; i < drvdata->nr_cntr; i++)
-                        ret += sprintf(buf, "counter %d: %x\n",
-                                       i, drvdata->cntr_val[i]);
-                spin_unlock(&drvdata->spinlock);
-                return ret;
-        }
-
-        for (i = 0; i < drvdata->nr_cntr; i++) {
-                val = etm_readl(drvdata, ETMCNTVRn(i));
-                ret += sprintf(buf, "counter %d: %x\n", i, val);
-        }
-
-        return ret;
-}
-
-static ssize_t cntr_val_store(struct device *dev,
-                              struct device_attribute *attr,
-                              const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        spin_lock(&drvdata->spinlock);
-        drvdata->cntr_val[drvdata->cntr_idx] = val;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(cntr_val);
-
-static ssize_t seq_12_event_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->seq_12_event;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t seq_12_event_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->seq_12_event = val & ETM_EVENT_MASK;
-        return size;
-}
-static DEVICE_ATTR_RW(seq_12_event);
-
-static ssize_t seq_21_event_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->seq_21_event;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t seq_21_event_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->seq_21_event = val & ETM_EVENT_MASK;
-        return size;
-}
-static DEVICE_ATTR_RW(seq_21_event);
-
-static ssize_t seq_23_event_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->seq_23_event;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t seq_23_event_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->seq_23_event = val & ETM_EVENT_MASK;
-        return size;
-}
-static DEVICE_ATTR_RW(seq_23_event);
-
-static ssize_t seq_31_event_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->seq_31_event;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t seq_31_event_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->seq_31_event = val & ETM_EVENT_MASK;
-        return size;
-}
-static DEVICE_ATTR_RW(seq_31_event);
-
-static ssize_t seq_32_event_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->seq_32_event;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t seq_32_event_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->seq_32_event = val & ETM_EVENT_MASK;
-        return size;
-}
-static DEVICE_ATTR_RW(seq_32_event);
-
-static ssize_t seq_13_event_show(struct device *dev,
-                                 struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->seq_13_event;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t seq_13_event_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->seq_13_event = val & ETM_EVENT_MASK;
-        return size;
-}
-static DEVICE_ATTR_RW(seq_13_event);
-
-static ssize_t seq_curr_state_show(struct device *dev,
-                                   struct device_attribute *attr, char *buf)
-{
-        unsigned long val, flags;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        if (!drvdata->enable) {
-                val = drvdata->seq_curr_state;
-                goto out;
-        }
-
-        pm_runtime_get_sync(drvdata->dev);
-        spin_lock_irqsave(&drvdata->spinlock, flags);
-
-        CS_UNLOCK(drvdata->base);
-        val = (etm_readl(drvdata, ETMSQR) & ETM_SQR_MASK);
-        CS_LOCK(drvdata->base);
-
-        spin_unlock_irqrestore(&drvdata->spinlock, flags);
-        pm_runtime_put(drvdata->dev);
-out:
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t seq_curr_state_store(struct device *dev,
-                                    struct device_attribute *attr,
-                                    const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        if (val > ETM_SEQ_STATE_MAX_VAL)
-                return -EINVAL;
-
-        drvdata->seq_curr_state = val;
-
-        return size;
-}
-static DEVICE_ATTR_RW(seq_curr_state);
-
-static ssize_t ctxid_idx_show(struct device *dev,
-                              struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->ctxid_idx;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t ctxid_idx_store(struct device *dev,
-                                struct device_attribute *attr,
-                                const char *buf, size_t size)
+static void etm_disable(struct coresight_device *csdev)
 {
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        if (val >= drvdata->nr_ctxid_cmp)
-                return -EINVAL;
+        u32 mode;
+        struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
         /*
-         * Use spinlock to ensure index doesn't change while it gets
-         * dereferenced multiple times within a spinlock block elsewhere.
+         * For as long as the tracer isn't disabled another entity can't
+         * change its status.  As such we can read the status here without
+         * fearing it will change under us.
          */
-        spin_lock(&drvdata->spinlock);
-        drvdata->ctxid_idx = val;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(ctxid_idx);
-
-static ssize_t ctxid_pid_show(struct device *dev,
-                              struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        spin_lock(&drvdata->spinlock);
-        val = drvdata->ctxid_vpid[drvdata->ctxid_idx];
-        spin_unlock(&drvdata->spinlock);
+        mode = local_read(&drvdata->mode);
 
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t ctxid_pid_store(struct device *dev,
-                               struct device_attribute *attr,
-                               const char *buf, size_t size)
-{
-        int ret;
-        unsigned long vpid, pid;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &vpid);
-        if (ret)
-                return ret;
-
-        pid = coresight_vpid_to_pid(vpid);
-
-        spin_lock(&drvdata->spinlock);
-        drvdata->ctxid_pid[drvdata->ctxid_idx] = pid;
-        drvdata->ctxid_vpid[drvdata->ctxid_idx] = vpid;
-        spin_unlock(&drvdata->spinlock);
-
-        return size;
-}
-static DEVICE_ATTR_RW(ctxid_pid);
-
-static ssize_t ctxid_mask_show(struct device *dev,
-                               struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->ctxid_mask;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t ctxid_mask_store(struct device *dev,
-                                struct device_attribute *attr,
-                                const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->ctxid_mask = val;
-        return size;
-}
-static DEVICE_ATTR_RW(ctxid_mask);
-
-static ssize_t sync_freq_show(struct device *dev,
-                              struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->sync_freq;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t sync_freq_store(struct device *dev,
-                               struct device_attribute *attr,
-                               const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->sync_freq = val & ETM_SYNC_MASK;
-        return size;
-}
-static DEVICE_ATTR_RW(sync_freq);
-
-static ssize_t timestamp_event_show(struct device *dev,
-                                    struct device_attribute *attr, char *buf)
-{
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->timestamp_event;
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t timestamp_event_store(struct device *dev,
-                                     struct device_attribute *attr,
-                                     const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->timestamp_event = val & ETM_EVENT_MASK;
-        return size;
-}
-static DEVICE_ATTR_RW(timestamp_event);
-
-static ssize_t cpu_show(struct device *dev,
-                        struct device_attribute *attr, char *buf)
-{
-        int val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        val = drvdata->cpu;
-        return scnprintf(buf, PAGE_SIZE, "%d\n", val);
-
-}
-static DEVICE_ATTR_RO(cpu);
-
-static ssize_t traceid_show(struct device *dev,
-                            struct device_attribute *attr, char *buf)
-{
-        unsigned long val, flags;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        if (!drvdata->enable) {
-                val = drvdata->traceid;
-                goto out;
+        switch (mode) {
+        case CS_MODE_DISABLED:
+                break;
+        case CS_MODE_SYSFS:
+                etm_disable_sysfs(csdev);
+                break;
+        case CS_MODE_PERF:
+                etm_disable_perf(csdev);
+                break;
+        default:
+                WARN_ON_ONCE(mode);
+                return;
         }
 
-        pm_runtime_get_sync(drvdata->dev);
-        spin_lock_irqsave(&drvdata->spinlock, flags);
-        CS_UNLOCK(drvdata->base);
-
-        val = (etm_readl(drvdata, ETMTRACEIDR) & ETM_TRACEID_MASK);
-
-        CS_LOCK(drvdata->base);
-        spin_unlock_irqrestore(&drvdata->spinlock, flags);
-        pm_runtime_put(drvdata->dev);
-out:
-        return sprintf(buf, "%#lx\n", val);
-}
-
-static ssize_t traceid_store(struct device *dev,
-                             struct device_attribute *attr,
-                             const char *buf, size_t size)
-{
-        int ret;
-        unsigned long val;
-        struct etm_drvdata *drvdata = dev_get_drvdata(dev->parent);
-
-        ret = kstrtoul(buf, 16, &val);
-        if (ret)
-                return ret;
-
-        drvdata->traceid = val & ETM_TRACEID_MASK;
-        return size;
+        if (mode)
+                local_set(&drvdata->mode, CS_MODE_DISABLED);
 }
-static DEVICE_ATTR_RW(traceid);
-
-static struct attribute *coresight_etm_attrs[] = {
-        &dev_attr_nr_addr_cmp.attr,
-        &dev_attr_nr_cntr.attr,
-        &dev_attr_nr_ctxid_cmp.attr,
-        &dev_attr_etmsr.attr,
-        &dev_attr_reset.attr,
-        &dev_attr_mode.attr,
-        &dev_attr_trigger_event.attr,
-        &dev_attr_enable_event.attr,
-        &dev_attr_fifofull_level.attr,
-        &dev_attr_addr_idx.attr,
-        &dev_attr_addr_single.attr,
-        &dev_attr_addr_range.attr,
-        &dev_attr_addr_start.attr,
-        &dev_attr_addr_stop.attr,
-        &dev_attr_addr_acctype.attr,
-        &dev_attr_cntr_idx.attr,
-        &dev_attr_cntr_rld_val.attr,
-        &dev_attr_cntr_event.attr,
-        &dev_attr_cntr_rld_event.attr,
-        &dev_attr_cntr_val.attr,
-        &dev_attr_seq_12_event.attr,
-        &dev_attr_seq_21_event.attr,
-        &dev_attr_seq_23_event.attr,
-        &dev_attr_seq_31_event.attr,
-        &dev_attr_seq_32_event.attr,
-        &dev_attr_seq_13_event.attr,
-        &dev_attr_seq_curr_state.attr,
-        &dev_attr_ctxid_idx.attr,
-        &dev_attr_ctxid_pid.attr,
-        &dev_attr_ctxid_mask.attr,
-        &dev_attr_sync_freq.attr,
-        &dev_attr_timestamp_event.attr,
-        &dev_attr_traceid.attr,
-        &dev_attr_cpu.attr,
-        NULL,
-};
-
-#define coresight_simple_func(name, offset)                             \
-static ssize_t name##_show(struct device *_dev,                         \
-                           struct device_attribute *attr, char *buf)    \
-{                                                                       \
-        struct etm_drvdata *drvdata = dev_get_drvdata(_dev->parent);    \
-        return scnprintf(buf, PAGE_SIZE, "0x%x\n",                      \
-                         readl_relaxed(drvdata->base + offset));        \
-}                                                                       \
-DEVICE_ATTR_RO(name)
-
-coresight_simple_func(etmccr, ETMCCR);
-coresight_simple_func(etmccer, ETMCCER);
-coresight_simple_func(etmscr, ETMSCR);
-coresight_simple_func(etmidr, ETMIDR);
-coresight_simple_func(etmcr, ETMCR);
-coresight_simple_func(etmtraceidr, ETMTRACEIDR);
-coresight_simple_func(etmteevr, ETMTEEVR);
-coresight_simple_func(etmtssvr, ETMTSSCR);
-coresight_simple_func(etmtecr1, ETMTECR1);
-coresight_simple_func(etmtecr2, ETMTECR2);
-
-static struct attribute *coresight_etm_mgmt_attrs[] = {
-        &dev_attr_etmccr.attr,
-        &dev_attr_etmccer.attr,
-        &dev_attr_etmscr.attr,
-        &dev_attr_etmidr.attr,
-        &dev_attr_etmcr.attr,
-        &dev_attr_etmtraceidr.attr,
-        &dev_attr_etmteevr.attr,
-        &dev_attr_etmtssvr.attr,
-        &dev_attr_etmtecr1.attr,
-        &dev_attr_etmtecr2.attr,
-        NULL,
-};
 
-static const struct attribute_group coresight_etm_group = {
-        .attrs = coresight_etm_attrs,
-};
-
-
-static const struct attribute_group coresight_etm_mgmt_group = {
-        .attrs = coresight_etm_mgmt_attrs,
-        .name = "mgmt",
+static const struct coresight_ops_source etm_source_ops = {
+        .cpu_id         = etm_cpu_id,
+        .trace_id       = etm_trace_id,
+        .enable         = etm_enable,
+        .disable        = etm_disable,
 };
 
-static const struct attribute_group *coresight_etm_groups[] = {
-        &coresight_etm_group,
-        &coresight_etm_mgmt_group,
-        NULL,
+static const struct coresight_ops etm_cs_ops = {
+        .source_ops     = &etm_source_ops,
 };
 
 static int etm_cpu_callback(struct notifier_block *nfb, unsigned long action,
@@ -1658,7 +657,7 @@ static int etm_cpu_callback(struct notifier_block *nfb, unsigned long action,
                         etmdrvdata[cpu]->os_unlock = true;
                 }
 
-                if (etmdrvdata[cpu]->enable)
+                if (local_read(&etmdrvdata[cpu]->mode))
                         etm_enable_hw(etmdrvdata[cpu]);
                 spin_unlock(&etmdrvdata[cpu]->spinlock);
                 break;
@@ -1671,7 +670,7 @@ static int etm_cpu_callback(struct notifier_block *nfb, unsigned long action,
 
         case CPU_DYING:
                 spin_lock(&etmdrvdata[cpu]->spinlock);
-                if (etmdrvdata[cpu]->enable)
+                if (local_read(&etmdrvdata[cpu]->mode))
                         etm_disable_hw(etmdrvdata[cpu]);
                 spin_unlock(&etmdrvdata[cpu]->spinlock);
                 break;
@@ -1707,6 +706,9 @@ static void etm_init_arch_data(void *info)
         u32 etmccr;
         struct etm_drvdata *drvdata = info;
 
+        /* Make sure all registers are accessible */
+        etm_os_unlock(drvdata);
+
         CS_UNLOCK(drvdata->base);
 
         /* First dummy read */
@@ -1743,40 +745,9 @@ static void etm_init_arch_data(void *info)
         CS_LOCK(drvdata->base);
 }
 
-static void etm_init_default_data(struct etm_drvdata *drvdata)
+static void etm_init_trace_id(struct etm_drvdata *drvdata)
 {
-        /*
-         * A trace ID of value 0 is invalid, so let's start at some
-         * random value that fits in 7 bits and will be just as good.
-         */
-        static int etm3x_traceid = 0x10;
-
-        u32 flags = (1 << 0 | /* instruction execute*/
-                     3 << 3 | /* ARM instruction */
-                     0 << 5 | /* No data value comparison */
-                     0 << 7 | /* No exact mach */
-                     0 << 8 | /* Ignore context ID */
-                     0 << 10); /* Security ignored */
-
-        /*
-         * Initial configuration only - guarantees sources handled by
-         * this driver have a unique ID at startup time but not between
-         * all other types of sources.  For that we lean on the core
-         * framework.
-         */
-        drvdata->traceid = etm3x_traceid++;
-        drvdata->ctrl = (ETMCR_CYC_ACC | ETMCR_TIMESTAMP_EN);
-        drvdata->enable_ctrl1 = ETMTECR1_ADDR_COMP_1;
-        if (drvdata->nr_addr_cmp >= 2) {
-                drvdata->addr_val[0] = (u32) _stext;
-                drvdata->addr_val[1] = (u32) _etext;
-                drvdata->addr_acctype[0] = flags;
-                drvdata->addr_acctype[1] = flags;
-                drvdata->addr_type[0] = ETM_ADDR_TYPE_RANGE;
-                drvdata->addr_type[1] = ETM_ADDR_TYPE_RANGE;
-        }
-
-        etm_set_default(drvdata);
+        drvdata->traceid = coresight_get_trace_id(drvdata->cpu);
 }
 
 static int etm_probe(struct amba_device *adev, const struct amba_id *id)
@@ -1831,9 +802,6 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
         get_online_cpus();
         etmdrvdata[drvdata->cpu] = drvdata;
 
-        if (!smp_call_function_single(drvdata->cpu, etm_os_unlock, drvdata, 1))
-                drvdata->os_unlock = true;
-
         if (smp_call_function_single(drvdata->cpu,
                                      etm_init_arch_data,  drvdata, 1))
                 dev_err(dev, "ETM arch init failed\n");
@@ -1847,7 +815,9 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
                 ret = -EINVAL;
                 goto err_arch_supported;
         }
-        etm_init_default_data(drvdata);
+
+        etm_init_trace_id(drvdata);
+        etm_set_default(&drvdata->config);
 
         desc->type = CORESIGHT_DEV_TYPE_SOURCE;
         desc->subtype.source_subtype = CORESIGHT_DEV_SUBTYPE_SOURCE_PROC;
@@ -1861,6 +831,12 @@ static int etm_probe(struct amba_device *adev, const struct amba_id *id)
                 goto err_arch_supported;
         }
 
+        ret = etm_perf_symlink(drvdata->csdev, true);
+        if (ret) {
+                coresight_unregister(drvdata->csdev);
+                goto err_arch_supported;
+        }
+
         pm_runtime_put(&adev->dev);
         dev_info(dev, "%s initialized\n", (char *)id->data);
 
@@ -1877,17 +853,6 @@ err_arch_supported:
         return ret;
 }
 
-static int etm_remove(struct amba_device *adev)
-{
-        struct etm_drvdata *drvdata = amba_get_drvdata(adev);
-
-        coresight_unregister(drvdata->csdev);
-        if (--etm_count == 0)
-                unregister_hotcpu_notifier(&etm_cpu_notifier);
-
-        return 0;
-}
-
 #ifdef CONFIG_PM
 static int etm_runtime_suspend(struct device *dev)
 {
@@ -1948,13 +913,9 @@ static struct amba_driver etm_driver = {
                 .name   = "coresight-etm3x",
                 .owner  = THIS_MODULE,
                 .pm     = &etm_dev_pm_ops,
+                .suppress_bind_attrs = true,
         },
         .probe          = etm_probe,
-        .remove         = etm_remove,
         .id_table       = etm_ids,
 };
-
-module_amba_driver(etm_driver);
-
-MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("CoreSight Program Flow Trace driver");
+builtin_amba_driver(etm_driver);
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
index a6707642bb23..1c59bd36834c 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x.c
@@ -15,7 +15,6 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/device.h>
-#include <linux/module.h>
 #include <linux/io.h>
 #include <linux/err.h>
 #include <linux/fs.h>
@@ -32,6 +31,7 @@
 #include <linux/seq_file.h>
 #include <linux/uaccess.h>
 #include <linux/pm_runtime.h>
+#include <linux/perf_event.h>
 #include <asm/sections.h>
 
 #include "coresight-etm4x.h"
@@ -63,6 +63,13 @@ static bool etm4_arch_supported(u8 arch)
         return true;
 }
 
+static int etm4_cpu_id(struct coresight_device *csdev)
+{
+        struct etmv4_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        return drvdata->cpu;
+}
+
 static int etm4_trace_id(struct coresight_device *csdev)
 {
         struct etmv4_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
@@ -72,7 +79,6 @@ static int etm4_trace_id(struct coresight_device *csdev)
         if (!drvdata->enable)
                 return drvdata->trcid;
 
-        pm_runtime_get_sync(drvdata->dev);
         spin_lock_irqsave(&drvdata->spinlock, flags);
 
         CS_UNLOCK(drvdata->base);
@@ -81,7 +87,6 @@ static int etm4_trace_id(struct coresight_device *csdev)
         CS_LOCK(drvdata->base);
 
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
-        pm_runtime_put(drvdata->dev);
 
         return trace_id;
 }
@@ -182,12 +187,12 @@ static void etm4_enable_hw(void *info)
         dev_dbg(drvdata->dev, "cpu: %d enable smp call done\n", drvdata->cpu);
 }
 
-static int etm4_enable(struct coresight_device *csdev)
+static int etm4_enable(struct coresight_device *csdev,
+                       struct perf_event_attr *attr, u32 mode)
 {
         struct etmv4_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
         int ret;
 
-        pm_runtime_get_sync(drvdata->dev);
         spin_lock(&drvdata->spinlock);
 
         /*
@@ -207,7 +212,6 @@ static int etm4_enable(struct coresight_device *csdev)
         return 0;
 err:
         spin_unlock(&drvdata->spinlock);
-        pm_runtime_put(drvdata->dev);
         return ret;
 }
 
@@ -256,12 +260,11 @@ static void etm4_disable(struct coresight_device *csdev)
         spin_unlock(&drvdata->spinlock);
         put_online_cpus();
 
-        pm_runtime_put(drvdata->dev);
-
         dev_info(drvdata->dev, "ETM tracing disabled\n");
 }
 
 static const struct coresight_ops_source etm4_source_ops = {
+        .cpu_id         = etm4_cpu_id,
         .trace_id       = etm4_trace_id,
         .enable         = etm4_enable,
         .disable        = etm4_disable,
@@ -2219,7 +2222,7 @@ static ssize_t name##_show(struct device *_dev,				\
         return scnprintf(buf, PAGE_SIZE, "0x%x\n",                      \
                          readl_relaxed(drvdata->base + offset));        \
 }                                                                       \
-DEVICE_ATTR_RO(name)
+static DEVICE_ATTR_RO(name)
 
 coresight_simple_func(trcoslsr, TRCOSLSR);
 coresight_simple_func(trcpdcr, TRCPDCR);
@@ -2684,17 +2687,6 @@ err_coresight_register:
         return ret;
 }
 
-static int etm4_remove(struct amba_device *adev)
-{
-        struct etmv4_drvdata *drvdata = amba_get_drvdata(adev);
-
-        coresight_unregister(drvdata->csdev);
-        if (--etm4_count == 0)
-                unregister_hotcpu_notifier(&etm4_cpu_notifier);
-
-        return 0;
-}
-
 static struct amba_id etm4_ids[] = {
         {       /* ETM 4.0 - Qualcomm */
                 .id     = 0x0003b95d,
@@ -2712,10 +2704,9 @@ static struct amba_id etm4_ids[] = {
 static struct amba_driver etm4x_driver = {
         .drv = {
                 .name   = "coresight-etm4x",
+                .suppress_bind_attrs = true,
         },
         .probe          = etm4_probe,
-        .remove         = etm4_remove,
         .id_table       = etm4_ids,
 };
-
-module_amba_driver(etm4x_driver);
+builtin_amba_driver(etm4x_driver);
diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
index 2e36bde7fcb4..0600ca30649d 100644
--- a/drivers/hwtracing/coresight/coresight-funnel.c
+++ b/drivers/hwtracing/coresight/coresight-funnel.c
@@ -1,5 +1,7 @@
 /* Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
  *
+ * Description: CoreSight Funnel driver
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
  * only version 2 as published by the Free Software Foundation.
@@ -11,7 +13,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/device.h>
@@ -69,7 +70,6 @@ static int funnel_enable(struct coresight_device *csdev, int inport,
 {
         struct funnel_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        pm_runtime_get_sync(drvdata->dev);
         funnel_enable_hw(drvdata, inport);
 
         dev_info(drvdata->dev, "FUNNEL inport %d enabled\n", inport);
@@ -95,7 +95,6 @@ static void funnel_disable(struct coresight_device *csdev, int inport,
         struct funnel_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
         funnel_disable_hw(drvdata, inport);
-        pm_runtime_put(drvdata->dev);
 
         dev_info(drvdata->dev, "FUNNEL inport %d disabled\n", inport);
 }
@@ -226,14 +225,6 @@ static int funnel_probe(struct amba_device *adev, const struct amba_id *id)
         return 0;
 }
 
-static int funnel_remove(struct amba_device *adev)
-{
-        struct funnel_drvdata *drvdata = amba_get_drvdata(adev);
-
-        coresight_unregister(drvdata->csdev);
-        return 0;
-}
-
 #ifdef CONFIG_PM
 static int funnel_runtime_suspend(struct device *dev)
 {
@@ -273,13 +264,9 @@ static struct amba_driver funnel_driver = {
                 .name   = "coresight-funnel",
                 .owner  = THIS_MODULE,
                 .pm     = &funnel_dev_pm_ops,
+                .suppress_bind_attrs = true,
         },
         .probe          = funnel_probe,
-        .remove         = funnel_remove,
         .id_table       = funnel_ids,
 };
-
-module_amba_driver(funnel_driver);
-
-MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("CoreSight Funnel driver");
+builtin_amba_driver(funnel_driver);
diff --git a/drivers/hwtracing/coresight/coresight-priv.h b/drivers/hwtracing/coresight/coresight-priv.h
index 62fcd98cc7cf..333eddaed339 100644
--- a/drivers/hwtracing/coresight/coresight-priv.h
+++ b/drivers/hwtracing/coresight/coresight-priv.h
@@ -34,6 +34,15 @@
 #define TIMEOUT_US              100
 #define BMVAL(val, lsb, msb)    ((val & GENMASK(msb, lsb)) >> lsb)
 
+#define ETM_MODE_EXCL_KERN      BIT(30)
+#define ETM_MODE_EXCL_USER      BIT(31)
+
+enum cs_mode {
+        CS_MODE_DISABLED,
+        CS_MODE_SYSFS,
+        CS_MODE_PERF,
+};
+
 static inline void CS_LOCK(void __iomem *addr)
 {
         do {
@@ -52,6 +61,12 @@ static inline void CS_UNLOCK(void __iomem *addr)
         } while (0);
 }
 
+void coresight_disable_path(struct list_head *path);
+int coresight_enable_path(struct list_head *path, u32 mode);
+struct coresight_device *coresight_get_sink(struct list_head *path);
+struct list_head *coresight_build_path(struct coresight_device *csdev);
+void coresight_release_path(struct list_head *path);
+
 #ifdef CONFIG_CORESIGHT_SOURCE_ETM3X
 extern int etm_readl_cp14(u32 off, unsigned int *val);
 extern int etm_writel_cp14(u32 off, u32 val);
diff --git a/drivers/hwtracing/coresight/coresight-replicator-qcom.c b/drivers/hwtracing/coresight/coresight-replicator-qcom.c
index 584059e9e866..700f710e4bfa 100644
--- a/drivers/hwtracing/coresight/coresight-replicator-qcom.c
+++ b/drivers/hwtracing/coresight/coresight-replicator-qcom.c
@@ -15,7 +15,6 @@
 #include <linux/clk.h>
 #include <linux/coresight.h>
 #include <linux/device.h>
-#include <linux/module.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/io.h>
@@ -48,8 +47,6 @@ static int replicator_enable(struct coresight_device *csdev, int inport,
 {
         struct replicator_state *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        pm_runtime_get_sync(drvdata->dev);
-
         CS_UNLOCK(drvdata->base);
 
         /*
@@ -86,8 +83,6 @@ static void replicator_disable(struct coresight_device *csdev, int inport,
 
         CS_LOCK(drvdata->base);
 
-        pm_runtime_put(drvdata->dev);
-
         dev_info(drvdata->dev, "REPLICATOR disabled\n");
 }
 
@@ -156,15 +151,6 @@ static int replicator_probe(struct amba_device *adev, const struct amba_id *id)
         return 0;
 }
 
-static int replicator_remove(struct amba_device *adev)
-{
-        struct replicator_state *drvdata = amba_get_drvdata(adev);
-
-        pm_runtime_disable(&adev->dev);
-        coresight_unregister(drvdata->csdev);
-        return 0;
-}
-
 #ifdef CONFIG_PM
 static int replicator_runtime_suspend(struct device *dev)
 {
@@ -206,10 +192,9 @@ static struct amba_driver replicator_driver = {
         .drv = {
                 .name   = "coresight-replicator-qcom",
                 .pm     = &replicator_dev_pm_ops,
+                .suppress_bind_attrs = true,
         },
         .probe          = replicator_probe,
-        .remove         = replicator_remove,
         .id_table       = replicator_ids,
 };
-
-module_amba_driver(replicator_driver);
+builtin_amba_driver(replicator_driver);
diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
index 963ac197c253..4299c0569340 100644
--- a/drivers/hwtracing/coresight/coresight-replicator.c
+++ b/drivers/hwtracing/coresight/coresight-replicator.c
@@ -1,5 +1,7 @@
 /* Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
  *
+ * Description: CoreSight Replicator driver
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
  * only version 2 as published by the Free Software Foundation.
@@ -11,7 +13,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/device.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
@@ -41,7 +42,6 @@ static int replicator_enable(struct coresight_device *csdev, int inport,
 {
         struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        pm_runtime_get_sync(drvdata->dev);
         dev_info(drvdata->dev, "REPLICATOR enabled\n");
         return 0;
 }
@@ -51,7 +51,6 @@ static void replicator_disable(struct coresight_device *csdev, int inport,
 {
         struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        pm_runtime_put(drvdata->dev);
         dev_info(drvdata->dev, "REPLICATOR disabled\n");
 }
 
@@ -127,20 +126,6 @@ out_disable_pm:
         return ret;
 }
 
-static int replicator_remove(struct platform_device *pdev)
-{
-        struct replicator_drvdata *drvdata = platform_get_drvdata(pdev);
-
-        coresight_unregister(drvdata->csdev);
-        pm_runtime_get_sync(&pdev->dev);
-        if (!IS_ERR(drvdata->atclk))
-                clk_disable_unprepare(drvdata->atclk);
-        pm_runtime_put_noidle(&pdev->dev);
-        pm_runtime_disable(&pdev->dev);
-
-        return 0;
-}
-
 #ifdef CONFIG_PM
 static int replicator_runtime_suspend(struct device *dev)
 {
@@ -175,15 +160,11 @@ static const struct of_device_id replicator_match[] = {
 
 static struct platform_driver replicator_driver = {
         .probe          = replicator_probe,
-        .remove         = replicator_remove,
         .driver         = {
                 .name   = "coresight-replicator",
                 .of_match_table = replicator_match,
                 .pm     = &replicator_dev_pm_ops,
+                .suppress_bind_attrs = true,
         },
 };
-
 builtin_platform_driver(replicator_driver);
-
-MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("CoreSight Replicator driver");
diff --git a/drivers/hwtracing/coresight/coresight-tmc.c b/drivers/hwtracing/coresight/coresight-tmc.c
index a57c7ec1661f..1be191f5d39c 100644
--- a/drivers/hwtracing/coresight/coresight-tmc.c
+++ b/drivers/hwtracing/coresight/coresight-tmc.c
@@ -1,5 +1,7 @@
 /* Copyright (c) 2012, The Linux Foundation. All rights reserved.
  *
+ * Description: CoreSight Trace Memory Controller driver
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
  * only version 2 as published by the Free Software Foundation.
@@ -11,7 +13,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/device.h>
@@ -124,7 +125,7 @@ struct tmc_drvdata {
         bool                    reading;
         char                    *buf;
         dma_addr_t              paddr;
-        void __iomem            *vaddr;
+        void                    *vaddr;
         u32                     size;
         bool                    enable;
         enum tmc_config_type    config_type;
@@ -242,12 +243,9 @@ static int tmc_enable(struct tmc_drvdata *drvdata, enum tmc_mode mode)
 {
         unsigned long flags;
 
-        pm_runtime_get_sync(drvdata->dev);
-
         spin_lock_irqsave(&drvdata->spinlock, flags);
         if (drvdata->reading) {
                 spin_unlock_irqrestore(&drvdata->spinlock, flags);
-                pm_runtime_put(drvdata->dev);
                 return -EBUSY;
         }
 
@@ -268,7 +266,7 @@ static int tmc_enable(struct tmc_drvdata *drvdata, enum tmc_mode mode)
         return 0;
 }
 
-static int tmc_enable_sink(struct coresight_device *csdev)
+static int tmc_enable_sink(struct coresight_device *csdev, u32 mode)
 {
         struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
@@ -381,8 +379,6 @@ out:
         drvdata->enable = false;
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-        pm_runtime_put(drvdata->dev);
-
         dev_info(drvdata->dev, "TMC disabled\n");
 }
 
@@ -766,23 +762,10 @@ err_misc_register:
 err_devm_kzalloc:
         if (drvdata->config_type == TMC_CONFIG_TYPE_ETR)
                 dma_free_coherent(dev, drvdata->size,
-                                &drvdata->paddr, GFP_KERNEL);
+                                drvdata->vaddr, drvdata->paddr);
         return ret;
 }
 
-static int tmc_remove(struct amba_device *adev)
-{
-        struct tmc_drvdata *drvdata = amba_get_drvdata(adev);
-
-        misc_deregister(&drvdata->miscdev);
-        coresight_unregister(drvdata->csdev);
-        if (drvdata->config_type == TMC_CONFIG_TYPE_ETR)
-                dma_free_coherent(drvdata->dev, drvdata->size,
-                                  &drvdata->paddr, GFP_KERNEL);
-
-        return 0;
-}
-
 static struct amba_id tmc_ids[] = {
         {
                 .id     = 0x0003b961,
@@ -795,13 +778,9 @@ static struct amba_driver tmc_driver = {
         .drv = {
                 .name   = "coresight-tmc",
                 .owner  = THIS_MODULE,
+                .suppress_bind_attrs = true,
         },
         .probe          = tmc_probe,
-        .remove         = tmc_remove,
         .id_table       = tmc_ids,
 };
-
-module_amba_driver(tmc_driver);
-
-MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("CoreSight Trace Memory Controller driver");
+builtin_amba_driver(tmc_driver);
diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
index 7214efd10db5..8fb09d9237ab 100644
--- a/drivers/hwtracing/coresight/coresight-tpiu.c
+++ b/drivers/hwtracing/coresight/coresight-tpiu.c
@@ -1,5 +1,7 @@
 /* Copyright (c) 2011-2012, The Linux Foundation. All rights reserved.
  *
+ * Description: CoreSight Trace Port Interface Unit driver
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
  * only version 2 as published by the Free Software Foundation.
@@ -11,7 +13,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/init.h>
 #include <linux/device.h>
 #include <linux/io.h>
@@ -70,11 +71,10 @@ static void tpiu_enable_hw(struct tpiu_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
-static int tpiu_enable(struct coresight_device *csdev)
+static int tpiu_enable(struct coresight_device *csdev, u32 mode)
 {
         struct tpiu_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        pm_runtime_get_sync(csdev->dev.parent);
         tpiu_enable_hw(drvdata);
 
         dev_info(drvdata->dev, "TPIU enabled\n");
@@ -98,7 +98,6 @@ static void tpiu_disable(struct coresight_device *csdev)
         struct tpiu_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
         tpiu_disable_hw(drvdata);
-        pm_runtime_put(csdev->dev.parent);
 
         dev_info(drvdata->dev, "TPIU disabled\n");
 }
@@ -172,14 +171,6 @@ static int tpiu_probe(struct amba_device *adev, const struct amba_id *id)
         return 0;
 }
 
-static int tpiu_remove(struct amba_device *adev)
-{
-        struct tpiu_drvdata *drvdata = amba_get_drvdata(adev);
-
-        coresight_unregister(drvdata->csdev);
-        return 0;
-}
-
 #ifdef CONFIG_PM
 static int tpiu_runtime_suspend(struct device *dev)
 {
@@ -223,13 +214,9 @@ static struct amba_driver tpiu_driver = {
                 .name   = "coresight-tpiu",
                 .owner  = THIS_MODULE,
                 .pm     = &tpiu_dev_pm_ops,
+                .suppress_bind_attrs = true,
         },
         .probe          = tpiu_probe,
-        .remove         = tpiu_remove,
         .id_table       = tpiu_ids,
 };
-
-module_amba_driver(tpiu_driver);
-
-MODULE_LICENSE("GPL v2");
-MODULE_DESCRIPTION("CoreSight Trace Port Interface Unit driver");
+builtin_amba_driver(tpiu_driver);
diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
index 93738dfbf631..2ea5961092c1 100644
--- a/drivers/hwtracing/coresight/coresight.c
+++ b/drivers/hwtracing/coresight/coresight.c
@@ -11,7 +11,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/module.h>
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/device.h>
@@ -24,11 +23,28 @@
 #include <linux/coresight.h>
 #include <linux/of_platform.h>
 #include <linux/delay.h>
+#include <linux/pm_runtime.h>
 
 #include "coresight-priv.h"
 
 static DEFINE_MUTEX(coresight_mutex);
 
+/**
+ * struct coresight_node - elements of a path, from source to sink
+ * @csdev:      Address of an element.
+ * @link:       hook to the list.
+ */
+struct coresight_node {
+        struct coresight_device *csdev;
+        struct list_head link;
+};
+
+/*
+ * When operating Coresight drivers from the sysFS interface, only a single
+ * path can exist from a tracer (associated to a CPU) to a sink.
+ */
+static DEFINE_PER_CPU(struct list_head *, sysfs_path);
+
 static int coresight_id_match(struct device *dev, void *data)
 {
         int trace_id, i_trace_id;
@@ -68,15 +84,12 @@ static int coresight_source_is_unique(struct coresight_device *csdev)
                                  csdev, coresight_id_match);
 }
 
-static int coresight_find_link_inport(struct coresight_device *csdev)
+static int coresight_find_link_inport(struct coresight_device *csdev,
+                                      struct coresight_device *parent)
 {
         int i;
-        struct coresight_device *parent;
         struct coresight_connection *conn;
 
-        parent = container_of(csdev->path_link.next,
-                              struct coresight_device, path_link);
-
         for (i = 0; i < parent->nr_outport; i++) {
                 conn = &parent->conns[i];
                 if (conn->child_dev == csdev)
@@ -89,15 +102,12 @@ static int coresight_find_link_inport(struct coresight_device *csdev)
         return 0;
 }
 
-static int coresight_find_link_outport(struct coresight_device *csdev)
+static int coresight_find_link_outport(struct coresight_device *csdev,
+                                       struct coresight_device *child)
 {
         int i;
-        struct coresight_device *child;
         struct coresight_connection *conn;
 
-        child = container_of(csdev->path_link.prev,
-                             struct coresight_device, path_link);
-
         for (i = 0; i < csdev->nr_outport; i++) {
                 conn = &csdev->conns[i];
                 if (conn->child_dev == child)
@@ -110,13 +120,13 @@ static int coresight_find_link_outport(struct coresight_device *csdev)
         return 0;
 }
 
-static int coresight_enable_sink(struct coresight_device *csdev)
+static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
 {
         int ret;
 
         if (!csdev->enable) {
                 if (sink_ops(csdev)->enable) {
-                        ret = sink_ops(csdev)->enable(csdev);
+                        ret = sink_ops(csdev)->enable(csdev, mode);
                         if (ret)
                                 return ret;
                 }
@@ -138,14 +148,19 @@ static void coresight_disable_sink(struct coresight_device *csdev)
         }
 }
 
-static int coresight_enable_link(struct coresight_device *csdev)
+static int coresight_enable_link(struct coresight_device *csdev,
+                                 struct coresight_device *parent,
+                                 struct coresight_device *child)
 {
         int ret;
         int link_subtype;
         int refport, inport, outport;
 
-        inport = coresight_find_link_inport(csdev);
-        outport = coresight_find_link_outport(csdev);
+        if (!parent || !child)
+                return -EINVAL;
+
+        inport = coresight_find_link_inport(csdev, parent);
+        outport = coresight_find_link_outport(csdev, child);
         link_subtype = csdev->subtype.link_subtype;
 
         if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG)
@@ -168,14 +183,19 @@ static int coresight_enable_link(struct coresight_device *csdev)
         return 0;
 }
 
-static void coresight_disable_link(struct coresight_device *csdev)
+static void coresight_disable_link(struct coresight_device *csdev,
+                                   struct coresight_device *parent,
+                                   struct coresight_device *child)
 {
         int i, nr_conns;
         int link_subtype;
         int refport, inport, outport;
 
-        inport = coresight_find_link_inport(csdev);
-        outport = coresight_find_link_outport(csdev);
+        if (!parent || !child)
+                return;
+
+        inport = coresight_find_link_inport(csdev, parent);
+        outport = coresight_find_link_outport(csdev, child);
         link_subtype = csdev->subtype.link_subtype;
 
         if (link_subtype == CORESIGHT_DEV_SUBTYPE_LINK_MERG) {
@@ -201,7 +221,7 @@ static void coresight_disable_link(struct coresight_device *csdev)
         csdev->enable = false;
 }
 
-static int coresight_enable_source(struct coresight_device *csdev)
+static int coresight_enable_source(struct coresight_device *csdev, u32 mode)
 {
         int ret;
 
@@ -213,7 +233,7 @@ static int coresight_enable_source(struct coresight_device *csdev)
 
         if (!csdev->enable) {
                 if (source_ops(csdev)->enable) {
-                        ret = source_ops(csdev)->enable(csdev);
+                        ret = source_ops(csdev)->enable(csdev, NULL, mode);
                         if (ret)
                                 return ret;
                 }
@@ -235,109 +255,188 @@ static void coresight_disable_source(struct coresight_device *csdev)
         }
 }
 
-static int coresight_enable_path(struct list_head *path)
+void coresight_disable_path(struct list_head *path)
 {
-        int ret = 0;
-        struct coresight_device *cd;
-
-        /*
-         * At this point we have a full @path, from source to sink.  The
-         * sink is the first entry and the source the last one.  Go through
-         * all the components and enable them one by one.
-         */
-        list_for_each_entry(cd, path, path_link) {
-                if (cd == list_first_entry(path, struct coresight_device,
-                                           path_link)) {
-                        ret = coresight_enable_sink(cd);
-                } else if (list_is_last(&cd->path_link, path)) {
-                        /*
-                         * Don't enable the source just yet - this needs to
-                         * happen at the very end when all links and sink
-                         * along the path have been configured properly.
-                         */
-                        ;
-                } else {
-                        ret = coresight_enable_link(cd);
+        struct coresight_node *nd;
+        struct coresight_device *csdev, *parent, *child;
+
+        list_for_each_entry(nd, path, link) {
+                csdev = nd->csdev;
+
+                switch (csdev->type) {
+                case CORESIGHT_DEV_TYPE_SINK:
+                case CORESIGHT_DEV_TYPE_LINKSINK:
+                        coresight_disable_sink(csdev);
+                        break;
+                case CORESIGHT_DEV_TYPE_SOURCE:
+                        /* sources are disabled from either sysFS or Perf */
+                        break;
+                case CORESIGHT_DEV_TYPE_LINK:
+                        parent = list_prev_entry(nd, link)->csdev;
+                        child = list_next_entry(nd, link)->csdev;
+                        coresight_disable_link(csdev, parent, child);
+                        break;
+                default:
+                        break;
                 }
-                if (ret)
-                        goto err;
         }
+}
 
-        return 0;
-err:
-        list_for_each_entry_continue_reverse(cd, path, path_link) {
-                if (cd == list_first_entry(path, struct coresight_device,
-                                           path_link)) {
-                        coresight_disable_sink(cd);
-                } else if (list_is_last(&cd->path_link, path)) {
-                        ;
-                } else {
-                        coresight_disable_link(cd);
+int coresight_enable_path(struct list_head *path, u32 mode)
+{
+
+        int ret = 0;
+        struct coresight_node *nd;
+        struct coresight_device *csdev, *parent, *child;
+
+        list_for_each_entry_reverse(nd, path, link) {
+                csdev = nd->csdev;
+
+                switch (csdev->type) {
+                case CORESIGHT_DEV_TYPE_SINK:
+                case CORESIGHT_DEV_TYPE_LINKSINK:
+                        ret = coresight_enable_sink(csdev, mode);
+                        if (ret)
+                                goto err;
+                        break;
+                case CORESIGHT_DEV_TYPE_SOURCE:
+                        /* sources are enabled from either sysFS or Perf */
+                        break;
+                case CORESIGHT_DEV_TYPE_LINK:
+                        parent = list_prev_entry(nd, link)->csdev;
+                        child = list_next_entry(nd, link)->csdev;
+                        ret = coresight_enable_link(csdev, parent, child);
+                        if (ret)
+                                goto err;
+                        break;
+                default:
+                        goto err;
                 }
         }
 
+out:
         return ret;
+err:
+        coresight_disable_path(path);
+        goto out;
 }
 
-static int coresight_disable_path(struct list_head *path)
+struct coresight_device *coresight_get_sink(struct list_head *path)
 {
-        struct coresight_device *cd;
+        struct coresight_device *csdev;
 
-        list_for_each_entry_reverse(cd, path, path_link) {
-                if (cd == list_first_entry(path, struct coresight_device,
-                                           path_link)) {
-                        coresight_disable_sink(cd);
-                } else if (list_is_last(&cd->path_link, path)) {
-                        /*
-                         * The source has already been stopped, no need
-                         * to do it again here.
-                         */
-                        ;
-                } else {
-                        coresight_disable_link(cd);
+        if (!path)
+                return NULL;
+
+        csdev = list_last_entry(path, struct coresight_node, link)->csdev;
+        if (csdev->type != CORESIGHT_DEV_TYPE_SINK &&
+            csdev->type != CORESIGHT_DEV_TYPE_LINKSINK)
+                return NULL;
+
+        return csdev;
+}
+
+/**
+ * _coresight_build_path - recursively build a path from a @csdev to a sink.
+ * @csdev:      The device to start from.
+ * @path:       The list to add devices to.
+ *
+ * The tree of Coresight device is traversed until an activated sink is
+ * found.  From there the sink is added to the list along with all the
+ * devices that led to that point - the end result is a list from source
+ * to sink. In that list the source is the first device and the sink the
+ * last one.
+ */
+static int _coresight_build_path(struct coresight_device *csdev,
+                                 struct list_head *path)
+{
+        int i;
+        bool found = false;
+        struct coresight_node *node;
+        struct coresight_connection *conn;
+
+        /* An activated sink has been found.  Enqueue the element */
+        if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
+             csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) && csdev->activated)
+                goto out;
+
+        /* Not a sink - recursively explore each port found on this element */
+        for (i = 0; i < csdev->nr_outport; i++) {
+                conn = &csdev->conns[i];
+                if (_coresight_build_path(conn->child_dev, path) == 0) {
+                        found = true;
+                        break;
                 }
         }
 
+        if (!found)
+                return -ENODEV;
+
+out:
+        /*
+         * A path from this element to a sink has been found.  The elements
+         * leading to the sink are already enqueued, all that is left to do
+         * is tell the PM runtime core we need this element and add a node
+         * for it.
+         */
+        node = kzalloc(sizeof(struct coresight_node), GFP_KERNEL);
+        if (!node)
+                return -ENOMEM;
+
+        node->csdev = csdev;
+        list_add(&node->link, path);
+        pm_runtime_get_sync(csdev->dev.parent);
+
         return 0;
 }
 
-static int coresight_build_paths(struct coresight_device *csdev,
-                                 struct list_head *path,
-                                 bool enable)
+struct list_head *coresight_build_path(struct coresight_device *csdev)
 {
-        int i, ret = -EINVAL;
-        struct coresight_connection *conn;
+        struct list_head *path;
 
-        list_add(&csdev->path_link, path);
+        path = kzalloc(sizeof(struct list_head), GFP_KERNEL);
+        if (!path)
+                return NULL;
 
-        if ((csdev->type == CORESIGHT_DEV_TYPE_SINK ||
-            csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) &&
-            csdev->activated) {
-                if (enable)
-                        ret = coresight_enable_path(path);
-                else
-                        ret = coresight_disable_path(path);
-        } else {
-                for (i = 0; i < csdev->nr_outport; i++) {
-                        conn = &csdev->conns[i];
-                        if (coresight_build_paths(conn->child_dev,
-                                                    path, enable) == 0)
-                                ret = 0;
-                }
+        INIT_LIST_HEAD(path);
+
+        if (_coresight_build_path(csdev, path)) {
+                kfree(path);
+                path = NULL;
         }
 
-        if (list_first_entry(path, struct coresight_device, path_link) != csdev)
-                dev_err(&csdev->dev, "wrong device in %s\n", __func__);
+        return path;
+}
 
-        list_del(&csdev->path_link);
+/**
+ * coresight_release_path - release a previously built path.
+ * @path:       the path to release.
+ *
+ * Go through all the elements of a path and 1) removed it from the list and
+ * 2) free the memory allocated for each node.
+ */
+void coresight_release_path(struct list_head *path)
+{
+        struct coresight_device *csdev;
+        struct coresight_node *nd, *next;
 
-        return ret;
+        list_for_each_entry_safe(nd, next, path, link) {
+                csdev = nd->csdev;
+
+                pm_runtime_put_sync(csdev->dev.parent);
+                list_del(&nd->link);
+                kfree(nd);
+        }
+
+        kfree(path);
+        path = NULL;
 }
 
 int coresight_enable(struct coresight_device *csdev)
 {
         int ret = 0;
-        LIST_HEAD(path);
+        int cpu;
+        struct list_head *path;
 
         mutex_lock(&coresight_mutex);
         if (csdev->type != CORESIGHT_DEV_TYPE_SOURCE) {
@@ -348,22 +447,47 @@ int coresight_enable(struct coresight_device *csdev)
         if (csdev->enable)
                 goto out;
 
-        if (coresight_build_paths(csdev, &path, true)) {
-                dev_err(&csdev->dev, "building path(s) failed\n");
+        path = coresight_build_path(csdev);
+        if (!path) {
+                pr_err("building path(s) failed\n");
                 goto out;
         }
 
-        if (coresight_enable_source(csdev))
-                dev_err(&csdev->dev, "source enable failed\n");
+        ret = coresight_enable_path(path, CS_MODE_SYSFS);
+        if (ret)
+                goto err_path;
+
+        ret = coresight_enable_source(csdev, CS_MODE_SYSFS);
+        if (ret)
+                goto err_source;
+
+        /*
+         * When working from sysFS it is important to keep track
+         * of the paths that were created so that they can be
+         * undone in 'coresight_disable()'.  Since there can only
+         * be a single session per tracer (when working from sysFS)
+         * a per-cpu variable will do just fine.
+         */
+        cpu = source_ops(csdev)->cpu_id(csdev);
+        per_cpu(sysfs_path, cpu) = path;
+
 out:
         mutex_unlock(&coresight_mutex);
         return ret;
+
+err_source:
+        coresight_disable_path(path);
+
+err_path:
+        coresight_release_path(path);
+        goto out;
 }
 EXPORT_SYMBOL_GPL(coresight_enable);
 
 void coresight_disable(struct coresight_device *csdev)
 {
-        LIST_HEAD(path);
+        int cpu;
+        struct list_head *path;
 
         mutex_lock(&coresight_mutex);
         if (csdev->type != CORESIGHT_DEV_TYPE_SOURCE) {
@@ -373,9 +497,12 @@ void coresight_disable(struct coresight_device *csdev)
         if (!csdev->enable)
                 goto out;
 
+        cpu = source_ops(csdev)->cpu_id(csdev);
+        path = per_cpu(sysfs_path, cpu);
         coresight_disable_source(csdev);
-        if (coresight_build_paths(csdev, &path, false))
-                dev_err(&csdev->dev, "releasing path(s) failed\n");
+        coresight_disable_path(path);
+        coresight_release_path(path);
+        per_cpu(sysfs_path, cpu) = NULL;
 
 out:
         mutex_unlock(&coresight_mutex);
@@ -481,6 +608,8 @@ static void coresight_device_release(struct device *dev)
 {
         struct coresight_device *csdev = to_coresight_device(dev);
 
+        kfree(csdev->conns);
+        kfree(csdev->refcnt);
         kfree(csdev);
 }
 
@@ -536,7 +665,7 @@ static void coresight_fixup_orphan_conns(struct coresight_device *csdev)
          * are hooked-up with each newly added component.
          */
         bus_for_each_dev(&coresight_bustype, NULL,
-                                 csdev, coresight_orphan_match);
+                         csdev, coresight_orphan_match);
 }
 
 
@@ -568,6 +697,8 @@ static void coresight_fixup_device_conns(struct coresight_device *csdev)
 
                 if (dev) {
                         conn->child_dev = to_coresight_device(dev);
+                        /* and put reference from 'bus_find_device()' */
+                        put_device(dev);
                 } else {
                         csdev->orphan = true;
                         conn->child_dev = NULL;
@@ -575,6 +706,50 @@ static void coresight_fixup_device_conns(struct coresight_device *csdev)
         }
 }
 
+static int coresight_remove_match(struct device *dev, void *data)
+{
+        int i;
+        struct coresight_device *csdev, *iterator;
+        struct coresight_connection *conn;
+
+        csdev = data;
+        iterator = to_coresight_device(dev);
+
+        /* No need to check oneself */
+        if (csdev == iterator)
+                return 0;
+
+        /*
+         * Circle throuch all the connection of that component.  If we find
+         * a connection whose name matches @csdev, remove it.
+         */
+        for (i = 0; i < iterator->nr_outport; i++) {
+                conn = &iterator->conns[i];
+
+                if (conn->child_dev == NULL)
+                        continue;
+
+                if (!strcmp(dev_name(&csdev->dev), conn->child_name)) {
+                        iterator->orphan = true;
+                        conn->child_dev = NULL;
+                        /* No need to continue */
+                        break;
+                }
+        }
+
+        /*
+         * Returning '0' ensures that all known component on the
+         * bus will be checked.
+         */
+        return 0;
+}
+
+static void coresight_remove_conns(struct coresight_device *csdev)
+{
+        bus_for_each_dev(&coresight_bustype, NULL,
+                         csdev, coresight_remove_match);
+}
+
 /**
  * coresight_timeout - loop until a bit has changed to a specific state.
  * @addr: base address of the area of interest.
@@ -713,13 +888,8 @@ EXPORT_SYMBOL_GPL(coresight_register);
 
 void coresight_unregister(struct coresight_device *csdev)
 {
-        mutex_lock(&coresight_mutex);
-
-        kfree(csdev->conns);
+        /* Remove references of that device in the topology */
+        coresight_remove_conns(csdev);
         device_unregister(&csdev->dev);
-
-        mutex_unlock(&coresight_mutex);
 }
 EXPORT_SYMBOL_GPL(coresight_unregister);
-
-MODULE_LICENSE("GPL v2");
diff --git a/drivers/hwtracing/coresight/of_coresight.c b/drivers/hwtracing/coresight/of_coresight.c
index b0973617826f..b68da1888fd5 100644
--- a/drivers/hwtracing/coresight/of_coresight.c
+++ b/drivers/hwtracing/coresight/of_coresight.c
@@ -10,7 +10,6 @@
  * GNU General Public License for more details.
  */
 
-#include <linux/module.h>
 #include <linux/types.h>
 #include <linux/err.h>
 #include <linux/slab.h>
@@ -86,7 +85,7 @@ static int of_coresight_alloc_memory(struct device *dev,
                 return -ENOMEM;
 
         /* Children connected to this component via @outports */
-         pdata->child_names = devm_kzalloc(dev, pdata->nr_outport *
+        pdata->child_names = devm_kzalloc(dev, pdata->nr_outport *
                                           sizeof(*pdata->child_names),
                                           GFP_KERNEL);
         if (!pdata->child_names)
diff --git a/drivers/hwtracing/intel_th/Kconfig b/drivers/hwtracing/intel_th/Kconfig
index b7a9073d968b..1b412f8a56b5 100644
--- a/drivers/hwtracing/intel_th/Kconfig
+++ b/drivers/hwtracing/intel_th/Kconfig
@@ -1,5 +1,6 @@
 config INTEL_TH
         tristate "Intel(R) Trace Hub controller"
+        depends on HAS_DMA && HAS_IOMEM
         help
           Intel(R) Trace Hub (TH) is a set of hardware blocks (subdevices) that
           produce, switch and output trace data from multiple hardware and
diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c
index 165d3001c301..4272f2ce5f6e 100644
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -124,17 +124,34 @@ static struct device_type intel_th_source_device_type = {
         .release        = intel_th_device_release,
 };
 
+static struct intel_th *to_intel_th(struct intel_th_device *thdev)
+{
+        /*
+         * subdevice tree is flat: if this one is not a switch, its
+         * parent must be
+         */
+        if (thdev->type != INTEL_TH_SWITCH)
+                thdev = to_intel_th_hub(thdev);
+
+        if (WARN_ON_ONCE(!thdev || thdev->type != INTEL_TH_SWITCH))
+                return NULL;
+
+        return dev_get_drvdata(thdev->dev.parent);
+}
+
 static char *intel_th_output_devnode(struct device *dev, umode_t *mode,
                                      kuid_t *uid, kgid_t *gid)
 {
         struct intel_th_device *thdev = to_intel_th_device(dev);
+        struct intel_th *th = to_intel_th(thdev);
         char *node;
 
         if (thdev->id >= 0)
-                node = kasprintf(GFP_KERNEL, "intel_th%d/%s%d", 0, thdev->name,
-                                 thdev->id);
+                node = kasprintf(GFP_KERNEL, "intel_th%d/%s%d", th->id,
+                                 thdev->name, thdev->id);
         else
-                node = kasprintf(GFP_KERNEL, "intel_th%d/%s", 0, thdev->name);
+                node = kasprintf(GFP_KERNEL, "intel_th%d/%s", th->id,
+                                 thdev->name);
 
         return node;
 }
@@ -319,6 +336,7 @@ static struct intel_th_subdevice {
         unsigned                nres;
         unsigned                type;
         unsigned                otype;
+        unsigned                scrpd;
         int                     id;
 } intel_th_subdevices[TH_SUBDEVICE_MAX] = {
         {
@@ -352,6 +370,7 @@ static struct intel_th_subdevice {
                 .id     = 0,
                 .type   = INTEL_TH_OUTPUT,
                 .otype  = GTH_MSU,
+                .scrpd  = SCRPD_MEM_IS_PRIM_DEST | SCRPD_MSC0_IS_ENABLED,
         },
         {
                 .nres   = 2,
@@ -371,6 +390,7 @@ static struct intel_th_subdevice {
                 .id     = 1,
                 .type   = INTEL_TH_OUTPUT,
                 .otype  = GTH_MSU,
+                .scrpd  = SCRPD_MEM_IS_PRIM_DEST | SCRPD_MSC1_IS_ENABLED,
         },
         {
                 .nres   = 2,
@@ -403,6 +423,7 @@ static struct intel_th_subdevice {
                 .name   = "pti",
                 .type   = INTEL_TH_OUTPUT,
                 .otype  = GTH_PTI,
+                .scrpd  = SCRPD_PTI_IS_PRIM_DEST,
         },
         {
                 .nres   = 1,
@@ -477,6 +498,7 @@ static int intel_th_populate(struct intel_th *th, struct resource *devres,
                         thdev->dev.devt = MKDEV(th->major, i);
                         thdev->output.type = subdev->otype;
                         thdev->output.port = -1;
+                        thdev->output.scratchpad = subdev->scrpd;
                 }
 
                 err = device_add(&thdev->dev);
@@ -579,6 +601,8 @@ intel_th_alloc(struct device *dev, struct resource *devres,
         }
         th->dev = dev;
 
+        dev_set_drvdata(dev, th);
+
         err = intel_th_populate(th, devres, ndevres, irq);
         if (err)
                 goto err_chrdev;
diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c
index 2dc5378ccd3a..9beea0b54231 100644
--- a/drivers/hwtracing/intel_th/gth.c
+++ b/drivers/hwtracing/intel_th/gth.c
@@ -146,24 +146,6 @@ gth_master_set(struct gth_device *gth, unsigned int master, int port)
         iowrite32(val, gth->base + reg);
 }
 
-/*static int gth_master_get(struct gth_device *gth, unsigned int master)
-{
-        unsigned int reg = REG_GTH_SWDEST0 + ((master >> 1) & ~3u);
-        unsigned int shift = (master & 0x7) * 4;
-        u32 val;
-
-        if (master >= 256) {
-                reg = REG_GTH_GSWTDEST;
-                shift = 0;
-        }
-
-        val = ioread32(gth->base + reg);
-        val &= (0xf << shift);
-        val >>= shift;
-
-        return val ? val & 0x7 : -1;
-        }*/
-
 static ssize_t master_attr_show(struct device *dev,
                                 struct device_attribute *attr,
                                 char *buf)
@@ -304,6 +286,10 @@ static int intel_th_gth_reset(struct gth_device *gth)
         if (scratchpad & SCRPD_DEBUGGER_IN_USE)
                 return -EBUSY;
 
+        /* Always save/restore STH and TU registers in S0ix entry/exit */
+        scratchpad |= SCRPD_STH_IS_ENABLED | SCRPD_TRIGGER_IS_ENABLED;
+        iowrite32(scratchpad, gth->base + REG_GTH_SCRPD0);
+
         /* output ports */
         for (port = 0; port < 8; port++) {
                 if (gth_output_parm_get(gth, port, TH_OUTPUT_PARM(port)) ==
@@ -506,6 +492,10 @@ static void intel_th_gth_disable(struct intel_th_device *thdev,
         if (!count)
                 dev_dbg(&thdev->dev, "timeout waiting for GTH[%d] PLE\n",
                         output->port);
+
+        reg = ioread32(gth->base + REG_GTH_SCRPD0);
+        reg &= ~output->scratchpad;
+        iowrite32(reg, gth->base + REG_GTH_SCRPD0);
 }
 
 /**
@@ -520,7 +510,7 @@ static void intel_th_gth_enable(struct intel_th_device *thdev,
                                 struct intel_th_output *output)
 {
         struct gth_device *gth = dev_get_drvdata(&thdev->dev);
-        u32 scr = 0xfc0000;
+        u32 scr = 0xfc0000, scrpd;
         int master;
 
         spin_lock(&gth->gth_lock);
@@ -535,6 +525,10 @@ static void intel_th_gth_enable(struct intel_th_device *thdev,
         output->active = true;
         spin_unlock(&gth->gth_lock);
 
+        scrpd = ioread32(gth->base + REG_GTH_SCRPD0);
+        scrpd |= output->scratchpad;
+        iowrite32(scrpd, gth->base + REG_GTH_SCRPD0);
+
         iowrite32(scr, gth->base + REG_GTH_SCR);
         iowrite32(0, gth->base + REG_GTH_SCR2);
 }
diff --git a/drivers/hwtracing/intel_th/gth.h b/drivers/hwtracing/intel_th/gth.h
index 3b714b7a61db..56f0d2620577 100644
--- a/drivers/hwtracing/intel_th/gth.h
+++ b/drivers/hwtracing/intel_th/gth.h
@@ -57,9 +57,6 @@ enum {
         REG_GTH_SCRPD3          = 0xec, /* ScratchPad[3] */
 };
 
-/* Externall debugger is using Intel TH */
-#define SCRPD_DEBUGGER_IN_USE   BIT(24)
-
 /* waiting for Pipeline Empty bit(s) to assert for GTH */
 #define GTH_PLE_WAITLOOP_DEPTH  10000
 
diff --git a/drivers/hwtracing/intel_th/intel_th.h b/drivers/hwtracing/intel_th/intel_th.h
index 57fd72b20fae..eedd09332db6 100644
--- a/drivers/hwtracing/intel_th/intel_th.h
+++ b/drivers/hwtracing/intel_th/intel_th.h
@@ -30,6 +30,7 @@ enum {
  * struct intel_th_output - descriptor INTEL_TH_OUTPUT type devices
  * @port:       output port number, assigned by the switch
  * @type:       GTH_{MSU,CTP,PTI}
+ * @scratchpad: scratchpad bits to flag when this output is enabled
  * @multiblock: true for multiblock output configuration
  * @active:     true when this output is enabled
  *
@@ -41,6 +42,7 @@ enum {
 struct intel_th_output {
         int             port;
         unsigned int    type;
+        unsigned int    scratchpad;
         bool            multiblock;
         bool            active;
 };
@@ -241,4 +243,43 @@ enum {
         GTH_PTI = 4,    /* MIPI-PTI */
 };
 
+/*
+ * Scratchpad bits: tell firmware and external debuggers
+ * what we are up to.
+ */
+enum {
+        /* Memory is the primary destination */
+        SCRPD_MEM_IS_PRIM_DEST          = BIT(0),
+        /* XHCI DbC is the primary destination */
+        SCRPD_DBC_IS_PRIM_DEST          = BIT(1),
+        /* PTI is the primary destination */
+        SCRPD_PTI_IS_PRIM_DEST          = BIT(2),
+        /* BSSB is the primary destination */
+        SCRPD_BSSB_IS_PRIM_DEST         = BIT(3),
+        /* PTI is the alternate destination */
+        SCRPD_PTI_IS_ALT_DEST           = BIT(4),
+        /* BSSB is the alternate destination */
+        SCRPD_BSSB_IS_ALT_DEST          = BIT(5),
+        /* DeepSx exit occurred */
+        SCRPD_DEEPSX_EXIT               = BIT(6),
+        /* S4 exit occurred */
+        SCRPD_S4_EXIT                   = BIT(7),
+        /* S5 exit occurred */
+        SCRPD_S5_EXIT                   = BIT(8),
+        /* MSU controller 0/1 is enabled */
+        SCRPD_MSC0_IS_ENABLED           = BIT(9),
+        SCRPD_MSC1_IS_ENABLED           = BIT(10),
+        /* Sx exit occurred */
+        SCRPD_SX_EXIT                   = BIT(11),
+        /* Trigger Unit is enabled */
+        SCRPD_TRIGGER_IS_ENABLED        = BIT(12),
+        SCRPD_ODLA_IS_ENABLED           = BIT(13),
+        SCRPD_SOCHAP_IS_ENABLED         = BIT(14),
+        SCRPD_STH_IS_ENABLED            = BIT(15),
+        SCRPD_DCIH_IS_ENABLED           = BIT(16),
+        SCRPD_VER_IS_ENABLED            = BIT(17),
+        /* External debugger is using Intel TH */
+        SCRPD_DEBUGGER_IN_USE           = BIT(24),
+};
+
 #endif
diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c
index 70ca27e45602..d9d6022c5aca 100644
--- a/drivers/hwtracing/intel_th/msu.c
+++ b/drivers/hwtracing/intel_th/msu.c
@@ -408,7 +408,7 @@ msc_buffer_iterate(struct msc_iter *iter, size_t size, void *data,
                  * Second time (wrap_count==1), it's just like any other block,
                  * containing data in the range of [MSC_BDESC..data_bytes].
                  */
-                if (iter->block == iter->start_block && iter->wrap_count) {
+                if (iter->block == iter->start_block && iter->wrap_count == 2) {
                         tocopy = DATA_IN_PAGE - data_bytes;
                         src += data_bytes;
                 }
@@ -1112,12 +1112,11 @@ static ssize_t intel_th_msc_read(struct file *file, char __user *buf,
                 size = msc->nr_pages << PAGE_SHIFT;
 
         if (!size)
-                return 0;
+                goto put_count;
 
-        if (off >= size) {
-                len = 0;
+        if (off >= size)
                 goto put_count;
-        }
+
         if (off + len >= size)
                 len = size - off;
 
diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index 641e87936064..bca7a2ac00d6 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -46,8 +46,6 @@ static int intel_th_pci_probe(struct pci_dev *pdev,
         if (IS_ERR(th))
                 return PTR_ERR(th);
 
-        pci_set_drvdata(pdev, th);
-
         return 0;
 }
 
@@ -67,6 +65,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa126),
                 .driver_data = (kernel_ulong_t)0,
         },
+        {
+                /* Apollo Lake */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x5a8e),
+                .driver_data = (kernel_ulong_t)0,
+        },
+        {
+                /* Broxton */
+                PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0a80),
+                .driver_data = (kernel_ulong_t)0,
+        },
         { 0 },
 };
 
diff --git a/drivers/hwtracing/intel_th/sth.c b/drivers/hwtracing/intel_th/sth.c
index 56101c33e10f..e1aee61dd7b3 100644
--- a/drivers/hwtracing/intel_th/sth.c
+++ b/drivers/hwtracing/intel_th/sth.c
@@ -94,10 +94,13 @@ static ssize_t sth_stm_packet(struct stm_data *stm_data, unsigned int master,
         case STP_PACKET_TRIG:
                 if (flags & STP_PACKET_TIMESTAMPED)
                         reg += 4;
-                iowrite8(*payload, sth->base + reg);
+                writeb_relaxed(*payload, sth->base + reg);
                 break;
 
         case STP_PACKET_MERR:
+                if (size > 4)
+                        size = 4;
+
                 sth_iowrite(&out->MERR, payload, size);
                 break;
 
@@ -107,8 +110,8 @@ static ssize_t sth_stm_packet(struct stm_data *stm_data, unsigned int master,
                 else
                         outp = (u64 __iomem *)&out->FLAG;
 
-                size = 1;
-                sth_iowrite(outp, payload, size);
+                size = 0;
+                writeb_relaxed(0, outp);
                 break;
 
         case STP_PACKET_USER:
@@ -129,6 +132,8 @@ static ssize_t sth_stm_packet(struct stm_data *stm_data, unsigned int master,
 
                 sth_iowrite(outp, payload, size);
                 break;
+        default:
+                return -ENOTSUPP;
         }
 
         return size;
diff --git a/drivers/hwtracing/stm/Kconfig b/drivers/hwtracing/stm/Kconfig
index 83e9f591a54b..847a39b35307 100644
--- a/drivers/hwtracing/stm/Kconfig
+++ b/drivers/hwtracing/stm/Kconfig
@@ -1,6 +1,7 @@
 config STM
         tristate "System Trace Module devices"
         select CONFIGFS_FS
+        select SRCU
         help
           A System Trace Module (STM) is a device exporting data in System
           Trace Protocol (STP) format as defined by MIPI STP standards.
@@ -8,6 +9,8 @@ config STM
 
           Say Y here to enable System Trace Module device support.
 
+if STM
+
 config STM_DUMMY
         tristate "Dummy STM driver"
         help
@@ -24,3 +27,16 @@ config STM_SOURCE_CONSOLE
 
           If you want to send kernel console messages over STM devices,
           say Y.
+
+config STM_SOURCE_HEARTBEAT
+        tristate "Heartbeat over STM devices"
+        help
+          This is a kernel space trace source that sends periodic
+          heartbeat messages to trace hosts over STM devices. It is
+          also useful for testing stm class drivers and the stm class
+          framework itself.
+
+          If you want to send heartbeat messages over STM devices,
+          say Y.
+
+endif
diff --git a/drivers/hwtracing/stm/Makefile b/drivers/hwtracing/stm/Makefile
index f9312c38dd7a..a9ce3d487e57 100644
--- a/drivers/hwtracing/stm/Makefile
+++ b/drivers/hwtracing/stm/Makefile
@@ -5,5 +5,7 @@ stm_core-y		:= core.o policy.o
 obj-$(CONFIG_STM_DUMMY) += dummy_stm.o
 
 obj-$(CONFIG_STM_SOURCE_CONSOLE)        += stm_console.o
+obj-$(CONFIG_STM_SOURCE_HEARTBEAT)      += stm_heartbeat.o
 
 stm_console-y           := console.o
+stm_heartbeat-y         := heartbeat.o
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index b6445d9e5453..de80d45d8df9 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -113,6 +113,7 @@ struct stm_device *stm_find_device(const char *buf)
 
         stm = to_stm_device(dev);
         if (!try_module_get(stm->owner)) {
+                /* matches class_find_device() above */
                 put_device(dev);
                 return NULL;
         }
@@ -125,7 +126,7 @@ struct stm_device *stm_find_device(const char *buf)
  * @stm:        stm device, previously acquired by stm_find_device()
  *
  * This drops the module reference and device reference taken by
- * stm_find_device().
+ * stm_find_device() or stm_char_open().
  */
 void stm_put_device(struct stm_device *stm)
 {
@@ -185,6 +186,9 @@ static void stm_output_claim(struct stm_device *stm, struct stm_output *output)
 {
         struct stp_master *master = stm_master(stm, output->master);
 
+        lockdep_assert_held(&stm->mc_lock);
+        lockdep_assert_held(&output->lock);
+
         if (WARN_ON_ONCE(master->nr_free < output->nr_chans))
                 return;
 
@@ -199,6 +203,9 @@ stm_output_disclaim(struct stm_device *stm, struct stm_output *output)
 {
         struct stp_master *master = stm_master(stm, output->master);
 
+        lockdep_assert_held(&stm->mc_lock);
+        lockdep_assert_held(&output->lock);
+
         bitmap_release_region(&master->chan_map[0], output->channel,
                               ilog2(output->nr_chans));
 
@@ -233,7 +240,7 @@ static int find_free_channels(unsigned long *bitmap, unsigned int start,
         return -1;
 }
 
-static unsigned int
+static int
 stm_find_master_chan(struct stm_device *stm, unsigned int width,
                      unsigned int *mstart, unsigned int mend,
                      unsigned int *cstart, unsigned int cend)
@@ -288,12 +295,13 @@ static int stm_output_assign(struct stm_device *stm, unsigned int width,
         }
 
         spin_lock(&stm->mc_lock);
+        spin_lock(&output->lock);
         /* output is already assigned -- shouldn't happen */
         if (WARN_ON_ONCE(output->nr_chans))
                 goto unlock;
 
         ret = stm_find_master_chan(stm, width, &midx, mend, &cidx, cend);
-        if (ret)
+        if (ret < 0)
                 goto unlock;
 
         output->master = midx;
@@ -304,6 +312,7 @@ static int stm_output_assign(struct stm_device *stm, unsigned int width,
 
         ret = 0;
 unlock:
+        spin_unlock(&output->lock);
         spin_unlock(&stm->mc_lock);
 
         return ret;
@@ -312,11 +321,18 @@ unlock:
 static void stm_output_free(struct stm_device *stm, struct stm_output *output)
 {
         spin_lock(&stm->mc_lock);
+        spin_lock(&output->lock);
         if (output->nr_chans)
                 stm_output_disclaim(stm, output);
+        spin_unlock(&output->lock);
         spin_unlock(&stm->mc_lock);
 }
 
+static void stm_output_init(struct stm_output *output)
+{
+        spin_lock_init(&output->lock);
+}
+
 static int major_match(struct device *dev, const void *data)
 {
         unsigned int major = *(unsigned int *)data;
@@ -339,6 +355,7 @@ static int stm_char_open(struct inode *inode, struct file *file)
         if (!stmf)
                 return -ENOMEM;
 
+        stm_output_init(&stmf->output);
         stmf->stm = to_stm_device(dev);
 
         if (!try_module_get(stmf->stm->owner))
@@ -349,6 +366,8 @@ static int stm_char_open(struct inode *inode, struct file *file)
         return nonseekable_open(inode, file);
 
 err_free:
+        /* matches class_find_device() above */
+        put_device(dev);
         kfree(stmf);
 
         return err;
@@ -357,9 +376,19 @@ err_free:
 static int stm_char_release(struct inode *inode, struct file *file)
 {
         struct stm_file *stmf = file->private_data;
+        struct stm_device *stm = stmf->stm;
+
+        if (stm->data->unlink)
+                stm->data->unlink(stm->data, stmf->output.master,
+                                  stmf->output.channel);
 
-        stm_output_free(stmf->stm, &stmf->output);
-        stm_put_device(stmf->stm);
+        stm_output_free(stm, &stmf->output);
+
+        /*
+         * matches the stm_char_open()'s
+         * class_find_device() + try_module_get()
+         */
+        stm_put_device(stm);
         kfree(stmf);
 
         return 0;
@@ -380,8 +409,8 @@ static int stm_file_assign(struct stm_file *stmf, char *id, unsigned int width)
         return ret;
 }
 
-static void stm_write(struct stm_data *data, unsigned int master,
-                      unsigned int channel, const char *buf, size_t count)
+static ssize_t stm_write(struct stm_data *data, unsigned int master,
+                          unsigned int channel, const char *buf, size_t count)
 {
         unsigned int flags = STP_PACKET_TIMESTAMPED;
         const unsigned char *p = buf, nil = 0;
@@ -393,9 +422,14 @@ static void stm_write(struct stm_data *data, unsigned int master,
                 sz = data->packet(data, master, channel, STP_PACKET_DATA, flags,
                                   sz, p);
                 flags = 0;
+
+                if (sz < 0)
+                        break;
         }
 
         data->packet(data, master, channel, STP_PACKET_FLAG, 0, 0, &nil);
+
+        return pos;
 }
 
 static ssize_t stm_char_write(struct file *file, const char __user *buf,
@@ -406,6 +440,9 @@ static ssize_t stm_char_write(struct file *file, const char __user *buf,
         char *kbuf;
         int err;
 
+        if (count + 1 > PAGE_SIZE)
+                count = PAGE_SIZE - 1;
+
         /*
          * if no m/c have been assigned to this writer up to this
          * point, use "default" policy entry
@@ -430,8 +467,8 @@ static ssize_t stm_char_write(struct file *file, const char __user *buf,
                 return -EFAULT;
         }
 
-        stm_write(stm->data, stmf->output.master, stmf->output.channel, kbuf,
-                  count);
+        count = stm_write(stm->data, stmf->output.master, stmf->output.channel,
+                          kbuf, count);
 
         kfree(kbuf);
 
@@ -515,10 +552,8 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg)
                 ret = stm->data->link(stm->data, stmf->output.master,
                                       stmf->output.channel);
 
-        if (ret) {
+        if (ret)
                 stm_output_free(stmf->stm, &stmf->output);
-                stm_put_device(stmf->stm);
-        }
 
 err_free:
         kfree(id);
@@ -618,7 +653,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
         if (!stm_data->packet || !stm_data->sw_nchannels)
                 return -EINVAL;
 
-        nmasters = stm_data->sw_end - stm_data->sw_start;
+        nmasters = stm_data->sw_end - stm_data->sw_start + 1;
         stm = kzalloc(sizeof(*stm) + nmasters * sizeof(void *), GFP_KERNEL);
         if (!stm)
                 return -ENOMEM;
@@ -641,6 +676,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
         if (err)
                 goto err_device;
 
+        mutex_init(&stm->link_mutex);
         spin_lock_init(&stm->link_lock);
         INIT_LIST_HEAD(&stm->link_list);
 
@@ -654,6 +690,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data,
         return 0;
 
 err_device:
+        /* matches device_initialize() above */
         put_device(&stm->dev);
 err_free:
         kfree(stm);
@@ -662,20 +699,28 @@ err_free:
 }
 EXPORT_SYMBOL_GPL(stm_register_device);
 
-static void __stm_source_link_drop(struct stm_source_device *src,
-                                   struct stm_device *stm);
+static int __stm_source_link_drop(struct stm_source_device *src,
+                                  struct stm_device *stm);
 
 void stm_unregister_device(struct stm_data *stm_data)
 {
         struct stm_device *stm = stm_data->stm;
         struct stm_source_device *src, *iter;
-        int i;
+        int i, ret;
 
-        spin_lock(&stm->link_lock);
+        mutex_lock(&stm->link_mutex);
         list_for_each_entry_safe(src, iter, &stm->link_list, link_entry) {
-                __stm_source_link_drop(src, stm);
+                ret = __stm_source_link_drop(src, stm);
+                /*
+                 * src <-> stm link must not change under the same
+                 * stm::link_mutex, so complain loudly if it has;
+                 * also in this situation ret!=0 means this src is
+                 * not connected to this stm and it should be otherwise
+                 * safe to proceed with the tear-down of stm.
+                 */
+                WARN_ON_ONCE(ret);
         }
-        spin_unlock(&stm->link_lock);
+        mutex_unlock(&stm->link_mutex);
 
         synchronize_srcu(&stm_source_srcu);
 
@@ -686,7 +731,7 @@ void stm_unregister_device(struct stm_data *stm_data)
                 stp_policy_unbind(stm->policy);
         mutex_unlock(&stm->policy_mutex);
 
-        for (i = 0; i < stm->sw_nmasters; i++)
+        for (i = stm->data->sw_start; i <= stm->data->sw_end; i++)
                 stp_master_free(stm, i);
 
         device_unregister(&stm->dev);
@@ -694,6 +739,17 @@ void stm_unregister_device(struct stm_data *stm_data)
 }
 EXPORT_SYMBOL_GPL(stm_unregister_device);
 
+/*
+ * stm::link_list access serialization uses a spinlock and a mutex; holding
+ * either of them guarantees that the list is stable; modification requires
+ * holding both of them.
+ *
+ * Lock ordering is as follows:
+ *   stm::link_mutex
+ *     stm::link_lock
+ *       src::link_lock
+ */
+
 /**
  * stm_source_link_add() - connect an stm_source device to an stm device
  * @src:        stm_source device
@@ -710,6 +766,7 @@ static int stm_source_link_add(struct stm_source_device *src,
         char *id;
         int err;
 
+        mutex_lock(&stm->link_mutex);
         spin_lock(&stm->link_lock);
         spin_lock(&src->link_lock);
 
@@ -719,6 +776,7 @@ static int stm_source_link_add(struct stm_source_device *src,
 
         spin_unlock(&src->link_lock);
         spin_unlock(&stm->link_lock);
+        mutex_unlock(&stm->link_mutex);
 
         id = kstrdup(src->data->name, GFP_KERNEL);
         if (id) {
@@ -753,9 +811,9 @@ static int stm_source_link_add(struct stm_source_device *src,
 
 fail_free_output:
         stm_output_free(stm, &src->output);
-        stm_put_device(stm);
 
 fail_detach:
+        mutex_lock(&stm->link_mutex);
         spin_lock(&stm->link_lock);
         spin_lock(&src->link_lock);
 
@@ -764,6 +822,7 @@ fail_detach:
 
         spin_unlock(&src->link_lock);
         spin_unlock(&stm->link_lock);
+        mutex_unlock(&stm->link_mutex);
 
         return err;
 }
@@ -776,28 +835,55 @@ fail_detach:
  * If @stm is @src::link, disconnect them from one another and put the
  * reference on the @stm device.
  *
- * Caller must hold stm::link_lock.
+ * Caller must hold stm::link_mutex.
  */
-static void __stm_source_link_drop(struct stm_source_device *src,
-                                   struct stm_device *stm)
+static int __stm_source_link_drop(struct stm_source_device *src,
+                                  struct stm_device *stm)
 {
         struct stm_device *link;
+        int ret = 0;
+
+        lockdep_assert_held(&stm->link_mutex);
 
+        /* for stm::link_list modification, we hold both mutex and spinlock */
+        spin_lock(&stm->link_lock);
         spin_lock(&src->link_lock);
         link = srcu_dereference_check(src->link, &stm_source_srcu, 1);
-        if (WARN_ON_ONCE(link != stm)) {
-                spin_unlock(&src->link_lock);
-                return;
+
+        /*
+         * The linked device may have changed since we last looked, because
+         * we weren't holding the src::link_lock back then; if this is the
+         * case, tell the caller to retry.
+         */
+        if (link != stm) {
+                ret = -EAGAIN;
+                goto unlock;
         }
 
         stm_output_free(link, &src->output);
-        /* caller must hold stm::link_lock */
         list_del_init(&src->link_entry);
         /* matches stm_find_device() from stm_source_link_store() */
         stm_put_device(link);
         rcu_assign_pointer(src->link, NULL);
 
+unlock:
         spin_unlock(&src->link_lock);
+        spin_unlock(&stm->link_lock);
+
+        /*
+         * Call the unlink callbacks for both source and stm, when we know
+         * that we have actually performed the unlinking.
+         */
+        if (!ret) {
+                if (src->data->unlink)
+                        src->data->unlink(src->data);
+
+                if (stm->data->unlink)
+                        stm->data->unlink(stm->data, src->output.master,
+                                          src->output.channel);
+        }
+
+        return ret;
 }
 
 /**
@@ -813,21 +899,29 @@ static void __stm_source_link_drop(struct stm_source_device *src,
 static void stm_source_link_drop(struct stm_source_device *src)
 {
         struct stm_device *stm;
-        int idx;
+        int idx, ret;
 
+retry:
         idx = srcu_read_lock(&stm_source_srcu);
+        /*
+         * The stm device will be valid for the duration of this
+         * read section, but the link may change before we grab
+         * the src::link_lock in __stm_source_link_drop().
+         */
         stm = srcu_dereference(src->link, &stm_source_srcu);
 
+        ret = 0;
         if (stm) {
-                if (src->data->unlink)
-                        src->data->unlink(src->data);
-
-                spin_lock(&stm->link_lock);
-                __stm_source_link_drop(src, stm);
-                spin_unlock(&stm->link_lock);
+                mutex_lock(&stm->link_mutex);
+                ret = __stm_source_link_drop(src, stm);
+                mutex_unlock(&stm->link_mutex);
         }
 
         srcu_read_unlock(&stm_source_srcu, idx);
+
+        /* if it did change, retry */
+        if (ret == -EAGAIN)
+                goto retry;
 }
 
 static ssize_t stm_source_link_show(struct device *dev,
@@ -862,8 +956,10 @@ static ssize_t stm_source_link_store(struct device *dev,
                 return -EINVAL;
 
         err = stm_source_link_add(src, link);
-        if (err)
+        if (err) {
+                /* matches the stm_find_device() above */
                 stm_put_device(link);
+        }
 
         return err ? : count;
 }
@@ -925,6 +1021,7 @@ int stm_source_register_device(struct device *parent,
         if (err)
                 goto err;
 
+        stm_output_init(&src->output);
         spin_lock_init(&src->link_lock);
         INIT_LIST_HEAD(&src->link_entry);
         src->data = data;
@@ -973,9 +1070,9 @@ int stm_source_write(struct stm_source_data *data, unsigned int chan,
 
         stm = srcu_dereference(src->link, &stm_source_srcu);
         if (stm)
-                stm_write(stm->data, src->output.master,
-                          src->output.channel + chan,
-                          buf, count);
+                count = stm_write(stm->data, src->output.master,
+                                  src->output.channel + chan,
+                                  buf, count);
         else
                 count = -ENODEV;
 
diff --git a/drivers/hwtracing/stm/dummy_stm.c b/drivers/hwtracing/stm/dummy_stm.c
index 3709bef0b21f..310adf57e7a1 100644
--- a/drivers/hwtracing/stm/dummy_stm.c
+++ b/drivers/hwtracing/stm/dummy_stm.c
@@ -40,22 +40,75 @@ dummy_stm_packet(struct stm_data *stm_data, unsigned int master,
         return size;
 }
 
-static struct stm_data dummy_stm = {
-        .name           = "dummy_stm",
-        .sw_start       = 0x0000,
-        .sw_end         = 0xffff,
-        .sw_nchannels   = 0xffff,
-        .packet         = dummy_stm_packet,
-};
+#define DUMMY_STM_MAX 32
+
+static struct stm_data dummy_stm[DUMMY_STM_MAX];
+
+static int nr_dummies = 4;
+
+module_param(nr_dummies, int, 0600);
+
+static unsigned int dummy_stm_nr;
+
+static unsigned int fail_mode;
+
+module_param(fail_mode, int, 0600);
+
+static int dummy_stm_link(struct stm_data *data, unsigned int master,
+                          unsigned int channel)
+{
+        if (fail_mode && (channel & fail_mode))
+                return -EINVAL;
+
+        return 0;
+}
 
 static int dummy_stm_init(void)
 {
-        return stm_register_device(NULL, &dummy_stm, THIS_MODULE);
+        int i, ret = -ENOMEM, __nr_dummies = ACCESS_ONCE(nr_dummies);
+
+        if (__nr_dummies < 0 || __nr_dummies > DUMMY_STM_MAX)
+                return -EINVAL;
+
+        for (i = 0; i < __nr_dummies; i++) {
+                dummy_stm[i].name = kasprintf(GFP_KERNEL, "dummy_stm.%d", i);
+                if (!dummy_stm[i].name)
+                        goto fail_unregister;
+
+                dummy_stm[i].sw_start           = 0x0000;
+                dummy_stm[i].sw_end             = 0xffff;
+                dummy_stm[i].sw_nchannels       = 0xffff;
+                dummy_stm[i].packet             = dummy_stm_packet;
+                dummy_stm[i].link               = dummy_stm_link;
+
+                ret = stm_register_device(NULL, &dummy_stm[i], THIS_MODULE);
+                if (ret)
+                        goto fail_free;
+        }
+
+        dummy_stm_nr = __nr_dummies;
+
+        return 0;
+
+fail_unregister:
+        for (i--; i >= 0; i--) {
+                stm_unregister_device(&dummy_stm[i]);
+fail_free:
+                kfree(dummy_stm[i].name);
+        }
+
+        return ret;
+
 }
 
 static void dummy_stm_exit(void)
 {
-        stm_unregister_device(&dummy_stm);
+        int i;
+
+        for (i = 0; i < dummy_stm_nr; i++) {
+                stm_unregister_device(&dummy_stm[i]);
+                kfree(dummy_stm[i].name);
+        }
 }
 
 module_init(dummy_stm_init);
diff --git a/drivers/hwtracing/stm/heartbeat.c b/drivers/hwtracing/stm/heartbeat.c
new file mode 100644
index 000000000000..0133571b506f
--- /dev/null
+++ b/drivers/hwtracing/stm/heartbeat.c
@@ -0,0 +1,130 @@
+/*
+ * Simple heartbeat STM source driver
+ * Copyright (c) 2016, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * Heartbeat STM source will send repetitive messages over STM devices to a
+ * trace host.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/hrtimer.h>
+#include <linux/slab.h>
+#include <linux/stm.h>
+
+#define STM_HEARTBEAT_MAX       32
+
+static int nr_devs = 4;
+static int interval_ms = 10;
+
+module_param(nr_devs, int, 0600);
+module_param(interval_ms, int, 0600);
+
+static struct stm_heartbeat {
+        struct stm_source_data  data;
+        struct hrtimer          hrtimer;
+        unsigned int            active;
+} stm_heartbeat[STM_HEARTBEAT_MAX];
+
+static unsigned int nr_instances;
+
+static const char str[] = "heartbeat stm source driver is here to serve you";
+
+static enum hrtimer_restart stm_heartbeat_hrtimer_handler(struct hrtimer *hr)
+{
+        struct stm_heartbeat *heartbeat = container_of(hr, struct stm_heartbeat,
+                                                       hrtimer);
+
+        stm_source_write(&heartbeat->data, 0, str, sizeof str);
+        if (heartbeat->active)
+                hrtimer_forward_now(hr, ms_to_ktime(interval_ms));
+
+        return heartbeat->active ? HRTIMER_RESTART : HRTIMER_NORESTART;
+}
+
+static int stm_heartbeat_link(struct stm_source_data *data)
+{
+        struct stm_heartbeat *heartbeat =
+                container_of(data, struct stm_heartbeat, data);
+
+        heartbeat->active = 1;
+        hrtimer_start(&heartbeat->hrtimer, ms_to_ktime(interval_ms),
+                      HRTIMER_MODE_ABS);
+
+        return 0;
+}
+
+static void stm_heartbeat_unlink(struct stm_source_data *data)
+{
+        struct stm_heartbeat *heartbeat =
+                container_of(data, struct stm_heartbeat, data);
+
+        heartbeat->active = 0;
+        hrtimer_cancel(&heartbeat->hrtimer);
+}
+
+static int stm_heartbeat_init(void)
+{
+        int i, ret = -ENOMEM, __nr_instances = ACCESS_ONCE(nr_devs);
+
+        if (__nr_instances < 0 || __nr_instances > STM_HEARTBEAT_MAX)
+                return -EINVAL;
+
+        for (i = 0; i < __nr_instances; i++) {
+                stm_heartbeat[i].data.name =
+                        kasprintf(GFP_KERNEL, "heartbeat.%d", i);
+                if (!stm_heartbeat[i].data.name)
+                        goto fail_unregister;
+
+                stm_heartbeat[i].data.nr_chans  = 1;
+                stm_heartbeat[i].data.link              = stm_heartbeat_link;
+                stm_heartbeat[i].data.unlink    = stm_heartbeat_unlink;
+                hrtimer_init(&stm_heartbeat[i].hrtimer, CLOCK_MONOTONIC,
+                             HRTIMER_MODE_ABS);
+                stm_heartbeat[i].hrtimer.function =
+                        stm_heartbeat_hrtimer_handler;
+
+                ret = stm_source_register_device(NULL, &stm_heartbeat[i].data);
+                if (ret)
+                        goto fail_free;
+        }
+
+        nr_instances = __nr_instances;
+
+        return 0;
+
+fail_unregister:
+        for (i--; i >= 0; i--) {
+                stm_source_unregister_device(&stm_heartbeat[i].data);
+fail_free:
+                kfree(stm_heartbeat[i].data.name);
+        }
+
+        return ret;
+}
+
+static void stm_heartbeat_exit(void)
+{
+        int i;
+
+        for (i = 0; i < nr_instances; i++) {
+                stm_source_unregister_device(&stm_heartbeat[i].data);
+                kfree(stm_heartbeat[i].data.name);
+        }
+}
+
+module_init(stm_heartbeat_init);
+module_exit(stm_heartbeat_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("stm_heartbeat driver");
+MODULE_AUTHOR("Alexander Shishkin <alexander.shishkin@linux.intel.com>");
diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c
index 11ab6d01adf6..1db189657b2b 100644
--- a/drivers/hwtracing/stm/policy.c
+++ b/drivers/hwtracing/stm/policy.c
@@ -272,13 +272,17 @@ void stp_policy_unbind(struct stp_policy *policy)
 {
         struct stm_device *stm = policy->stm;
 
+        /*
+         * stp_policy_release() will not call here if the policy is already
+         * unbound; other users should not either, as no link exists between
+         * this policy and anything else in that case
+         */
         if (WARN_ON_ONCE(!policy->stm))
                 return;
 
-        mutex_lock(&stm->policy_mutex);
-        stm->policy = NULL;
-        mutex_unlock(&stm->policy_mutex);
+        lockdep_assert_held(&stm->policy_mutex);
 
+        stm->policy = NULL;
         policy->stm = NULL;
 
         stm_put_device(stm);
@@ -287,8 +291,16 @@ void stp_policy_unbind(struct stp_policy *policy)
 static void stp_policy_release(struct config_item *item)
 {
         struct stp_policy *policy = to_stp_policy(item);
+        struct stm_device *stm = policy->stm;
 
+        /* a policy *can* be unbound and still exist in configfs tree */
+        if (!stm)
+                return;
+
+        mutex_lock(&stm->policy_mutex);
         stp_policy_unbind(policy);
+        mutex_unlock(&stm->policy_mutex);
+
         kfree(policy);
 }
 
@@ -320,10 +332,11 @@ stp_policies_make(struct config_group *group, const char *name)
 
         /*
          * node must look like <device_name>.<policy_name>, where
-         * <device_name> is the name of an existing stm device and
-         * <policy_name> is an arbitrary string
+         * <device_name> is the name of an existing stm device; may
+         *               contain dots;
+         * <policy_name> is an arbitrary string; may not contain dots
          */
-        p = strchr(devname, '.');
+        p = strrchr(devname, '.');
         if (!p) {
                 kfree(devname);
                 return ERR_PTR(-EINVAL);
diff --git a/drivers/hwtracing/stm/stm.h b/drivers/hwtracing/stm/stm.h
index 95ece0292c99..4e8c6926260f 100644
--- a/drivers/hwtracing/stm/stm.h
+++ b/drivers/hwtracing/stm/stm.h
@@ -45,6 +45,7 @@ struct stm_device {
         int                     major;
         unsigned int            sw_nmasters;
         struct stm_data         *data;
+        struct mutex            link_mutex;
         spinlock_t              link_lock;
         struct list_head        link_list;
         /* master allocation */
@@ -56,6 +57,7 @@ struct stm_device {
         container_of((_d), struct stm_device, dev)
 
 struct stm_output {
+        spinlock_t              lock;
         unsigned int            master;
         unsigned int            channel;
         unsigned int            nr_chans;
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 3de93517efe4..14606afbfaa8 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -336,7 +336,6 @@ static ssize_t _show_port_gid_attr(struct ib_port *p,
         union ib_gid gid;
         struct ib_gid_attr gid_attr = {};
         ssize_t ret;
-        va_list args;
 
         ret = ib_query_gid(p->ibdev, p->port_num, tab_attr->index, &gid,
                            &gid_attr);
@@ -348,7 +347,6 @@ static ssize_t _show_port_gid_attr(struct ib_port *p,
 err:
         if (gid_attr.ndev)
                 dev_put(gid_attr.ndev);
-        va_end(args);
         return ret;
 }
 
@@ -722,12 +720,11 @@ static struct attribute_group *get_counter_table(struct ib_device *dev,
 
         if (get_perf_mad(dev, port_num, IB_PMA_CLASS_PORT_INFO,
                                 &cpi, 40, sizeof(cpi)) >= 0) {
-
-                if (cpi.capability_mask && IB_PMA_CLASS_CAP_EXT_WIDTH)
+                if (cpi.capability_mask & IB_PMA_CLASS_CAP_EXT_WIDTH)
                         /* We have extended counters */
                         return &pma_group_ext;
 
-                if (cpi.capability_mask && IB_PMA_CLASS_CAP_EXT_WIDTH_NOIETF)
+                if (cpi.capability_mask & IB_PMA_CLASS_CAP_EXT_WIDTH_NOIETF)
                         /* But not the IETF ones */
                         return &pma_group_noietf;
         }
diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
index 9116bc3988a6..34cb8e87c7b8 100644
--- a/drivers/infiniband/hw/mlx5/qp.c
+++ b/drivers/infiniband/hw/mlx5/qp.c
@@ -270,8 +270,10 @@ static int sq_overhead(enum ib_qp_type qp_type)
                 /* fall through */
         case IB_QPT_RC:
                 size += sizeof(struct mlx5_wqe_ctrl_seg) +
-                        sizeof(struct mlx5_wqe_atomic_seg) +
-                        sizeof(struct mlx5_wqe_raddr_seg);
+                        max(sizeof(struct mlx5_wqe_atomic_seg) +
+                            sizeof(struct mlx5_wqe_raddr_seg),
+                            sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+                            sizeof(struct mlx5_mkey_seg));
                 break;
 
         case IB_QPT_XRC_TGT:
@@ -279,9 +281,9 @@ static int sq_overhead(enum ib_qp_type qp_type)
 
         case IB_QPT_UC:
                 size += sizeof(struct mlx5_wqe_ctrl_seg) +
-                        sizeof(struct mlx5_wqe_raddr_seg) +
-                        sizeof(struct mlx5_wqe_umr_ctrl_seg) +
-                        sizeof(struct mlx5_mkey_seg);
+                        max(sizeof(struct mlx5_wqe_raddr_seg),
+                            sizeof(struct mlx5_wqe_umr_ctrl_seg) +
+                            sizeof(struct mlx5_mkey_seg));
                 break;
 
         case IB_QPT_UD:
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_main.c b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
index 573849354cb9..f38743018cb4 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_main.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_main.c
@@ -228,6 +228,11 @@ static int ocrdma_alloc_resources(struct ocrdma_dev *dev)
 
         ocrdma_alloc_pd_pool(dev);
 
+        if (!ocrdma_alloc_stats_resources(dev)) {
+                pr_err("%s: stats resource allocation failed\n", __func__);
+                goto alloc_err;
+        }
+
         spin_lock_init(&dev->av_tbl.lock);
         spin_lock_init(&dev->flush_q_lock);
         return 0;
@@ -238,6 +243,7 @@ alloc_err:
 
 static void ocrdma_free_resources(struct ocrdma_dev *dev)
 {
+        ocrdma_release_stats_resources(dev);
         kfree(dev->stag_arr);
         kfree(dev->qp_tbl);
         kfree(dev->cq_tbl);
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
index 86c303a620c1..255f774080a4 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c
@@ -64,10 +64,11 @@ static int ocrdma_add_stat(char *start, char *pcur,
         return cpy_len;
 }
 
-static bool ocrdma_alloc_stats_mem(struct ocrdma_dev *dev)
+bool ocrdma_alloc_stats_resources(struct ocrdma_dev *dev)
 {
         struct stats_mem *mem = &dev->stats_mem;
 
+        mutex_init(&dev->stats_lock);
         /* Alloc mbox command mem*/
         mem->size = max_t(u32, sizeof(struct ocrdma_rdma_stats_req),
                         sizeof(struct ocrdma_rdma_stats_resp));
@@ -91,13 +92,14 @@ static bool ocrdma_alloc_stats_mem(struct ocrdma_dev *dev)
         return true;
 }
 
-static void ocrdma_release_stats_mem(struct ocrdma_dev *dev)
+void ocrdma_release_stats_resources(struct ocrdma_dev *dev)
 {
         struct stats_mem *mem = &dev->stats_mem;
 
         if (mem->va)
                 dma_free_coherent(&dev->nic_info.pdev->dev, mem->size,
                                   mem->va, mem->pa);
+        mem->va = NULL;
         kfree(mem->debugfs_mem);
 }
 
@@ -838,15 +840,9 @@ void ocrdma_add_port_stats(struct ocrdma_dev *dev)
                                 &dev->reset_stats, &ocrdma_dbg_ops))
                 goto err;
 
-        /* Now create dma_mem for stats mbx command */
-        if (!ocrdma_alloc_stats_mem(dev))
-                goto err;
-
-        mutex_init(&dev->stats_lock);
 
         return;
 err:
-        ocrdma_release_stats_mem(dev);
         debugfs_remove_recursive(dev->dir);
         dev->dir = NULL;
 }
@@ -855,9 +851,7 @@ void ocrdma_rem_port_stats(struct ocrdma_dev *dev)
 {
         if (!dev->dir)
                 return;
-        debugfs_remove(dev->dir);
-        mutex_destroy(&dev->stats_lock);
-        ocrdma_release_stats_mem(dev);
+        debugfs_remove_recursive(dev->dir);
 }
 
 void ocrdma_init_debugfs(void)
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
index c9e58d04c7b8..bba1fec4f11f 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.h
@@ -65,6 +65,8 @@ enum OCRDMA_STATS_TYPE {
 
 void ocrdma_rem_debugfs(void);
 void ocrdma_init_debugfs(void);
+bool ocrdma_alloc_stats_resources(struct ocrdma_dev *dev);
+void ocrdma_release_stats_resources(struct ocrdma_dev *dev);
 void ocrdma_rem_port_stats(struct ocrdma_dev *dev);
 void ocrdma_add_port_stats(struct ocrdma_dev *dev);
 int ocrdma_pma_counters(struct ocrdma_dev *dev,
diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
index d4c687b548d8..37620b4baafb 100644
--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
@@ -125,8 +125,8 @@ int ocrdma_query_device(struct ib_device *ibdev, struct ib_device_attr *attr,
                                         IB_DEVICE_SYS_IMAGE_GUID |
                                         IB_DEVICE_LOCAL_DMA_LKEY |
                                         IB_DEVICE_MEM_MGT_EXTENSIONS;
-        attr->max_sge = min(dev->attr.max_send_sge, dev->attr.max_srq_sge);
-        attr->max_sge_rd = 0;
+        attr->max_sge = dev->attr.max_send_sge;
+        attr->max_sge_rd = attr->max_sge;
         attr->max_cq = dev->attr.max_cq;
         attr->max_cqe = dev->attr.max_cqe;
         attr->max_mr = dev->attr.max_mr;
@@ -2726,8 +2726,7 @@ static int ocrdma_update_ud_rcqe(struct ib_wc *ibwc, struct ocrdma_cqe *cqe)
                 OCRDMA_CQE_UD_STATUS_MASK) >> OCRDMA_CQE_UD_STATUS_SHIFT;
         ibwc->src_qp = le32_to_cpu(cqe->flags_status_srcqpn) &
                                                 OCRDMA_CQE_SRCQP_MASK;
-        ibwc->pkey_index = le32_to_cpu(cqe->ud.rxlen_pkey) &
-                                                OCRDMA_CQE_PKEY_MASK;
+        ibwc->pkey_index = 0;
         ibwc->wc_flags = IB_WC_GRH;
         ibwc->byte_len = (le32_to_cpu(cqe->ud.rxlen_pkey) >>
                                         OCRDMA_CQE_UD_XFER_LEN_SHIFT);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 5ea0c14070d1..fa9c42ff1fb0 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -245,8 +245,6 @@ static void ipoib_ib_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
         skb_reset_mac_header(skb);
         skb_pull(skb, IPOIB_ENCAP_LEN);
 
-        skb->truesize = SKB_TRUESIZE(skb->len);
-
         ++dev->stats.rx_packets;
         dev->stats.rx_bytes += skb->len;
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 050dfa175d16..25889311b1e9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -456,7 +456,10 @@ out_locked:
         return status;
 }
 
-static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
+/*
+ * Caller must hold 'priv->lock'
+ */
+static int ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
         struct ib_sa_multicast *multicast;
@@ -466,6 +469,10 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
         ib_sa_comp_mask comp_mask;
         int ret = 0;
 
+        if (!priv->broadcast ||
+            !test_bit(IPOIB_FLAG_OPER_UP, &priv->flags))
+                return -EINVAL;
+
         ipoib_dbg_mcast(priv, "joining MGID %pI6\n", mcast->mcmember.mgid.raw);
 
         rec.mgid     = mcast->mcmember.mgid;
@@ -525,20 +532,23 @@ static void ipoib_mcast_join(struct net_device *dev, struct ipoib_mcast *mcast)
                         rec.join_state = 4;
 #endif
         }
+        spin_unlock_irq(&priv->lock);
 
         multicast = ib_sa_join_multicast(&ipoib_sa_client, priv->ca, priv->port,
                                          &rec, comp_mask, GFP_KERNEL,
                                          ipoib_mcast_join_complete, mcast);
+        spin_lock_irq(&priv->lock);
         if (IS_ERR(multicast)) {
                 ret = PTR_ERR(multicast);
                 ipoib_warn(priv, "ib_sa_join_multicast failed, status %d\n", ret);
-                spin_lock_irq(&priv->lock);
                 /* Requeue this join task with a backoff delay */
                 __ipoib_mcast_schedule_join_thread(priv, mcast, 1);
                 clear_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
                 spin_unlock_irq(&priv->lock);
                 complete(&mcast->done);
+                spin_lock_irq(&priv->lock);
         }
+        return 0;
 }
 
 void ipoib_mcast_join_task(struct work_struct *work)
@@ -620,9 +630,10 @@ void ipoib_mcast_join_task(struct work_struct *work)
                                 /* Found the next unjoined group */
                                 init_completion(&mcast->done);
                                 set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
-                                spin_unlock_irq(&priv->lock);
-                                ipoib_mcast_join(dev, mcast);
-                                spin_lock_irq(&priv->lock);
+                                if (ipoib_mcast_join(dev, mcast)) {
+                                        spin_unlock_irq(&priv->lock);
+                                        return;
+                                }
                         } else if (!delay_until ||
                                  time_before(mcast->delay_until, delay_until))
                                 delay_until = mcast->delay_until;
@@ -641,10 +652,9 @@ out:
         if (mcast) {
                 init_completion(&mcast->done);
                 set_bit(IPOIB_MCAST_FLAG_BUSY, &mcast->flags);
+                ipoib_mcast_join(dev, mcast);
         }
         spin_unlock_irq(&priv->lock);
-        if (mcast)
-                ipoib_mcast_join(dev, mcast);
 }
 
 int ipoib_mcast_start_thread(struct net_device *dev)
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 6727954ab74b..e8a84d12b7ff 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1207,7 +1207,6 @@ static void xpad_led_disconnect(struct usb_xpad *xpad)
 #else
 static int xpad_led_probe(struct usb_xpad *xpad) { return 0; }
 static void xpad_led_disconnect(struct usb_xpad *xpad) { }
-static void xpad_identify_controller(struct usb_xpad *xpad) { }
 #endif
 
 static int xpad_start_input(struct usb_xpad *xpad)
diff --git a/drivers/input/keyboard/adp5589-keys.c b/drivers/input/keyboard/adp5589-keys.c
index 4d446d5085aa..c01a1d648f9f 100644
--- a/drivers/input/keyboard/adp5589-keys.c
+++ b/drivers/input/keyboard/adp5589-keys.c
@@ -235,7 +235,7 @@ struct adp5589_kpad {
         unsigned short gpimapsize;
         unsigned extend_cfg;
         bool is_adp5585;
-        bool adp5585_support_row5;
+        bool support_row5;
 #ifdef CONFIG_GPIOLIB
         unsigned char gpiomap[ADP5589_MAXGPIO];
         bool export_gpio;
@@ -485,7 +485,7 @@ static int adp5589_build_gpiomap(struct adp5589_kpad *kpad,
         if (kpad->extend_cfg & C4_EXTEND_CFG)
                 pin_used[kpad->var->c4_extend_cfg] = true;
 
-        if (!kpad->adp5585_support_row5)
+        if (!kpad->support_row5)
                 pin_used[5] = true;
 
         for (i = 0; i < kpad->var->maxgpio; i++)
@@ -884,12 +884,13 @@ static int adp5589_probe(struct i2c_client *client,
 
         switch (id->driver_data) {
         case ADP5585_02:
-                kpad->adp5585_support_row5 = true;
+                kpad->support_row5 = true;
         case ADP5585_01:
                 kpad->is_adp5585 = true;
                 kpad->var = &const_adp5585;
                 break;
         case ADP5589:
+                kpad->support_row5 = true;
                 kpad->var = &const_adp5589;
                 break;
         }
diff --git a/drivers/input/keyboard/cap11xx.c b/drivers/input/keyboard/cap11xx.c
index 378db10001df..4401be225d64 100644
--- a/drivers/input/keyboard/cap11xx.c
+++ b/drivers/input/keyboard/cap11xx.c
@@ -304,8 +304,10 @@ static int cap11xx_init_leds(struct device *dev,
                 led->cdev.brightness = LED_OFF;
 
                 error = of_property_read_u32(child, "reg", &reg);
-                if (error != 0 || reg >= num_leds)
+                if (error != 0 || reg >= num_leds) {
+                        of_node_put(child);
                         return -EINVAL;
+                }
 
                 led->reg = reg;
                 led->priv = priv;
@@ -313,8 +315,10 @@ static int cap11xx_init_leds(struct device *dev,
                 INIT_WORK(&led->work, cap11xx_led_work);
 
                 error = devm_led_classdev_register(dev, &led->cdev);
-                if (error)
+                if (error) {
+                        of_node_put(child);
                         return error;
+                }
 
                 priv->num_leds++;
                 led++;
diff --git a/drivers/input/misc/Kconfig b/drivers/input/misc/Kconfig
index d6d16fa78281..1f2337abcf2f 100644
--- a/drivers/input/misc/Kconfig
+++ b/drivers/input/misc/Kconfig
@@ -733,7 +733,7 @@ config INPUT_XEN_KBDDEV_FRONTEND
           module will be called xen-kbdfront.
 
 config INPUT_SIRFSOC_ONKEY
-        bool "CSR SiRFSoC power on/off/suspend key support"
+        tristate "CSR SiRFSoC power on/off/suspend key support"
         depends on ARCH_SIRF && OF
         default y
         help
diff --git a/drivers/input/misc/sirfsoc-onkey.c b/drivers/input/misc/sirfsoc-onkey.c
index 9d5b89befe6f..ed7237f19539 100644
--- a/drivers/input/misc/sirfsoc-onkey.c
+++ b/drivers/input/misc/sirfsoc-onkey.c
@@ -101,7 +101,7 @@ static void sirfsoc_pwrc_close(struct input_dev *input)
 static const struct of_device_id sirfsoc_pwrc_of_match[] = {
         { .compatible = "sirf,prima2-pwrc" },
         {},
-}
+};
 MODULE_DEVICE_TABLE(of, sirfsoc_pwrc_of_match);
 
 static int sirfsoc_pwrc_probe(struct platform_device *pdev)
diff --git a/drivers/input/mouse/vmmouse.c b/drivers/input/mouse/vmmouse.c
index e272f06258ce..a3f0f5a47490 100644
--- a/drivers/input/mouse/vmmouse.c
+++ b/drivers/input/mouse/vmmouse.c
@@ -458,8 +458,6 @@ int vmmouse_init(struct psmouse *psmouse)
         priv->abs_dev = abs_dev;
         psmouse->private = priv;
 
-        input_set_capability(rel_dev, EV_REL, REL_WHEEL);
-
         /* Set up and register absolute device */
         snprintf(priv->phys, sizeof(priv->phys), "%s/input1",
                  psmouse->ps2dev.serio->phys);
@@ -475,10 +473,6 @@ int vmmouse_init(struct psmouse *psmouse)
         abs_dev->id.version = psmouse->model;
         abs_dev->dev.parent = &psmouse->ps2dev.serio->dev;
 
-        error = input_register_device(priv->abs_dev);
-        if (error)
-                goto init_fail;
-
         /* Set absolute device capabilities */
         input_set_capability(abs_dev, EV_KEY, BTN_LEFT);
         input_set_capability(abs_dev, EV_KEY, BTN_RIGHT);
@@ -488,6 +482,13 @@ int vmmouse_init(struct psmouse *psmouse)
         input_set_abs_params(abs_dev, ABS_X, 0, VMMOUSE_MAX_X, 0, 0);
         input_set_abs_params(abs_dev, ABS_Y, 0, VMMOUSE_MAX_Y, 0, 0);
 
+        error = input_register_device(priv->abs_dev);
+        if (error)
+                goto init_fail;
+
+        /* Add wheel capability to the relative device */
+        input_set_capability(rel_dev, EV_REL, REL_WHEEL);
+
         psmouse->protocol_handler = vmmouse_process_byte;
         psmouse->disconnect = vmmouse_disconnect;
         psmouse->reconnect = vmmouse_reconnect;
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 8f828975ab10..1ca7f551e2da 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -134,7 +134,7 @@ static void serio_find_driver(struct serio *serio)
         int error;
 
         error = device_attach(&serio->dev);
-        if (error < 0)
+        if (error < 0 && error != -EPROBE_DEFER)
                 dev_warn(&serio->dev,
                          "device_attach() failed for %s (%s), error: %d\n",
                          serio->phys, serio->name, error);
diff --git a/drivers/input/touchscreen/colibri-vf50-ts.c b/drivers/input/touchscreen/colibri-vf50-ts.c
index 5d4903a402cc..69828d015d45 100644
--- a/drivers/input/touchscreen/colibri-vf50-ts.c
+++ b/drivers/input/touchscreen/colibri-vf50-ts.c
@@ -21,6 +21,7 @@
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/pinctrl/consumer.h>
 #include <linux/platform_device.h>
 #include <linux/slab.h>
diff --git a/drivers/input/touchscreen/edt-ft5x06.c b/drivers/input/touchscreen/edt-ft5x06.c
index 0b0f8c17f3f7..23fbe382da8b 100644
--- a/drivers/input/touchscreen/edt-ft5x06.c
+++ b/drivers/input/touchscreen/edt-ft5x06.c
@@ -822,16 +822,22 @@ static void edt_ft5x06_ts_get_defaults(struct device *dev,
         int error;
 
         error = device_property_read_u32(dev, "threshold", &val);
-        if (!error)
-                reg_addr->reg_threshold = val;
+        if (!error) {
+                edt_ft5x06_register_write(tsdata, reg_addr->reg_threshold, val);
+                tsdata->threshold = val;
+        }
 
         error = device_property_read_u32(dev, "gain", &val);
-        if (!error)
-                reg_addr->reg_gain = val;
+        if (!error) {
+                edt_ft5x06_register_write(tsdata, reg_addr->reg_gain, val);
+                tsdata->gain = val;
+        }
 
         error = device_property_read_u32(dev, "offset", &val);
-        if (!error)
-                reg_addr->reg_offset = val;
+        if (!error) {
+                edt_ft5x06_register_write(tsdata, reg_addr->reg_offset, val);
+                tsdata->offset = val;
+        }
 }
 
 static void
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 3447549fcc93..0a73632b28d5 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -66,7 +66,10 @@ struct its_node {
         unsigned long           phys_base;
         struct its_cmd_block    *cmd_base;
         struct its_cmd_block    *cmd_write;
-        void                    *tables[GITS_BASER_NR_REGS];
+        struct {
+                void            *base;
+                u32             order;
+        } tables[GITS_BASER_NR_REGS];
         struct its_collection   *collections;
         struct list_head        its_device_list;
         u64                     flags;
@@ -807,9 +810,10 @@ static void its_free_tables(struct its_node *its)
         int i;
 
         for (i = 0; i < GITS_BASER_NR_REGS; i++) {
-                if (its->tables[i]) {
-                        free_page((unsigned long)its->tables[i]);
-                        its->tables[i] = NULL;
+                if (its->tables[i].base) {
+                        free_pages((unsigned long)its->tables[i].base,
+                                   its->tables[i].order);
+                        its->tables[i].base = NULL;
                 }
         }
 }
@@ -890,7 +894,8 @@ retry_alloc_baser:
                         goto out_free;
                 }
 
-                its->tables[i] = base;
+                its->tables[i].base = base;
+                its->tables[i].order = order;
 
 retry_baser:
                 val = (virt_to_phys(base)                                |
@@ -940,7 +945,7 @@ retry_baser:
                          * something is horribly wrong...
                          */
                         free_pages((unsigned long)base, order);
-                        its->tables[i] = NULL;
+                        its->tables[i].base = NULL;
 
                         switch (psz) {
                         case SZ_16K:
diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
index 911758c056c1..8f9ebf714e2b 100644
--- a/drivers/irqchip/irq-gic.c
+++ b/drivers/irqchip/irq-gic.c
@@ -384,9 +384,6 @@ static struct irq_chip gic_chip = {
         .irq_unmask             = gic_unmask_irq,
         .irq_eoi                = gic_eoi_irq,
         .irq_set_type           = gic_set_type,
-#ifdef CONFIG_SMP
-        .irq_set_affinity       = gic_set_affinity,
-#endif
         .irq_get_irqchip_state  = gic_irq_get_irqchip_state,
         .irq_set_irqchip_state  = gic_irq_set_irqchip_state,
         .flags                  = IRQCHIP_SET_TYPE_MASKED |
@@ -400,9 +397,6 @@ static struct irq_chip gic_eoimode1_chip = {
         .irq_unmask             = gic_unmask_irq,
         .irq_eoi                = gic_eoimode1_eoi_irq,
         .irq_set_type           = gic_set_type,
-#ifdef CONFIG_SMP
-        .irq_set_affinity       = gic_set_affinity,
-#endif
         .irq_get_irqchip_state  = gic_irq_get_irqchip_state,
         .irq_set_irqchip_state  = gic_irq_set_irqchip_state,
         .irq_set_vcpu_affinity  = gic_irq_set_vcpu_affinity,
@@ -443,7 +437,7 @@ static void gic_cpu_if_up(struct gic_chip_data *gic)
         u32 bypass = 0;
         u32 mode = 0;
 
-        if (static_key_true(&supports_deactivate))
+        if (gic == &gic_data[0] && static_key_true(&supports_deactivate))
                 mode = GIC_CPU_CTRL_EOImodeNS;
 
         /*
@@ -1039,6 +1033,11 @@ static void __init __gic_init_bases(unsigned int gic_nr, int irq_start,
                 gic->chip.name = kasprintf(GFP_KERNEL, "GIC-%d", gic_nr);
         }
 
+#ifdef CONFIG_SMP
+        if (gic_nr == 0)
+                gic->chip.irq_set_affinity = gic_set_affinity;
+#endif
+
 #ifdef CONFIG_GIC_NON_BANKED
         if (percpu_offset) { /* Frankein-GIC without banked registers... */
                 unsigned int cpu;
diff --git a/drivers/irqchip/irq-sun4i.c b/drivers/irqchip/irq-sun4i.c
index 0704362f4c82..376b28074e0d 100644
--- a/drivers/irqchip/irq-sun4i.c
+++ b/drivers/irqchip/irq-sun4i.c
@@ -22,7 +22,6 @@
 #include <linux/of_irq.h>
 
 #include <asm/exception.h>
-#include <asm/mach/irq.h>
 
 #define SUN4I_IRQ_VECTOR_REG            0x00
 #define SUN4I_IRQ_PROTECTION_REG        0x08
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index e6e4bacb09ee..12099b09a9a7 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2048,6 +2048,7 @@ int db8500_prcmu_config_hotmon(u8 low, u8 high)
 
         return 0;
 }
+EXPORT_SYMBOL_GPL(db8500_prcmu_config_hotmon);
 
 static int config_hot_period(u16 val)
 {
@@ -2074,11 +2075,13 @@ int db8500_prcmu_start_temp_sense(u16 cycles32k)
 
         return config_hot_period(cycles32k);
 }
+EXPORT_SYMBOL_GPL(db8500_prcmu_start_temp_sense);
 
 int db8500_prcmu_stop_temp_sense(void)
 {
         return config_hot_period(0xFFFF);
 }
+EXPORT_SYMBOL_GPL(db8500_prcmu_stop_temp_sense);
 
 static int prcmu_a9wdog(u8 cmd, u8 d0, u8 d1, u8 d2, u8 d3)
 {
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index f0ba78289504..a216b4667742 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -440,7 +440,7 @@ config ARM_CHARLCD
           still useful.
 
 config BMP085
-        bool
+        tristate
         depends on SYSFS
 
 config BMP085_I2C
@@ -470,7 +470,7 @@ config BMP085_SPI
 config PCH_PHUB
         tristate "Intel EG20T PCH/LAPIS Semicon IOH(ML7213/ML7223/ML7831) PHUB"
         select GENERIC_NET_UTILS
-        depends on PCI && (X86_32 || COMPILE_TEST)
+        depends on PCI && (X86_32 || MIPS || COMPILE_TEST)
         help
           This driver is for PCH(Platform controller Hub) PHUB(Packet Hub) of
           Intel Topcliff which is an IOH(Input/Output Hub) for x86 embedded
diff --git a/drivers/misc/apds990x.c b/drivers/misc/apds990x.c
index a3e789b85cc8..dfb72ecfa604 100644
--- a/drivers/misc/apds990x.c
+++ b/drivers/misc/apds990x.c
@@ -1215,7 +1215,7 @@ static int apds990x_remove(struct i2c_client *client)
 #ifdef CONFIG_PM_SLEEP
 static int apds990x_suspend(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct apds990x_chip *chip = i2c_get_clientdata(client);
 
         apds990x_chip_off(chip);
@@ -1224,7 +1224,7 @@ static int apds990x_suspend(struct device *dev)
 
 static int apds990x_resume(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct apds990x_chip *chip = i2c_get_clientdata(client);
 
         /*
@@ -1240,7 +1240,7 @@ static int apds990x_resume(struct device *dev)
 #ifdef CONFIG_PM
 static int apds990x_runtime_suspend(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct apds990x_chip *chip = i2c_get_clientdata(client);
 
         apds990x_chip_off(chip);
@@ -1249,7 +1249,7 @@ static int apds990x_runtime_suspend(struct device *dev)
 
 static int apds990x_runtime_resume(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct apds990x_chip *chip = i2c_get_clientdata(client);
 
         apds990x_chip_on(chip);
diff --git a/drivers/misc/arm-charlcd.c b/drivers/misc/arm-charlcd.c
index c65b5ea5d5ef..b3176ee92b90 100644
--- a/drivers/misc/arm-charlcd.c
+++ b/drivers/misc/arm-charlcd.c
@@ -8,7 +8,6 @@
  * Author: Linus Walleij <triad@df.lth.se>
  */
 #include <linux/init.h>
-#include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
 #include <linux/of.h>
@@ -328,20 +327,6 @@ out_no_resource:
         return ret;
 }
 
-static int __exit charlcd_remove(struct platform_device *pdev)
-{
-        struct charlcd *lcd = platform_get_drvdata(pdev);
-
-        if (lcd) {
-                free_irq(lcd->irq, lcd);
-                iounmap(lcd->virtbase);
-                release_mem_region(lcd->phybase, lcd->physize);
-                kfree(lcd);
-        }
-
-        return 0;
-}
-
 static int charlcd_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
@@ -376,13 +361,8 @@ static struct platform_driver charlcd_driver = {
         .driver = {
                 .name = DRIVERNAME,
                 .pm = &charlcd_pm_ops,
+                .suppress_bind_attrs = true,
                 .of_match_table = of_match_ptr(charlcd_match),
         },
-        .remove = __exit_p(charlcd_remove),
 };
-
-module_platform_driver_probe(charlcd_driver, charlcd_probe);
-
-MODULE_AUTHOR("Linus Walleij <triad@df.lth.se>");
-MODULE_DESCRIPTION("ARM Character LCD Driver");
-MODULE_LICENSE("GPL v2");
+builtin_platform_driver_probe(charlcd_driver, charlcd_probe);
diff --git a/drivers/misc/bh1770glc.c b/drivers/misc/bh1770glc.c
index 753d7ecdadaa..845466e45b95 100644
--- a/drivers/misc/bh1770glc.c
+++ b/drivers/misc/bh1770glc.c
@@ -1323,7 +1323,7 @@ static int bh1770_remove(struct i2c_client *client)
 #ifdef CONFIG_PM_SLEEP
 static int bh1770_suspend(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct bh1770_chip *chip = i2c_get_clientdata(client);
 
         bh1770_chip_off(chip);
@@ -1333,7 +1333,7 @@ static int bh1770_suspend(struct device *dev)
 
 static int bh1770_resume(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct bh1770_chip *chip = i2c_get_clientdata(client);
         int ret = 0;
 
@@ -1361,7 +1361,7 @@ static int bh1770_resume(struct device *dev)
 #ifdef CONFIG_PM
 static int bh1770_runtime_suspend(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct bh1770_chip *chip = i2c_get_clientdata(client);
 
         bh1770_chip_off(chip);
@@ -1371,7 +1371,7 @@ static int bh1770_runtime_suspend(struct device *dev)
 
 static int bh1770_runtime_resume(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct bh1770_chip *chip = i2c_get_clientdata(client);
 
         bh1770_chip_on(chip);
diff --git a/drivers/misc/c2port/core.c b/drivers/misc/c2port/core.c
index cc8645b5369d..1922cb8f6b88 100644
--- a/drivers/misc/c2port/core.c
+++ b/drivers/misc/c2port/core.c
@@ -721,9 +721,7 @@ static ssize_t c2port_read_flash_data(struct file *filp, struct kobject *kobj,
                                 struct bin_attribute *attr,
                                 char *buffer, loff_t offset, size_t count)
 {
-        struct c2port_device *c2dev =
-                        dev_get_drvdata(container_of(kobj,
-                                                struct device, kobj));
+        struct c2port_device *c2dev = dev_get_drvdata(kobj_to_dev(kobj));
         ssize_t ret;
 
         /* Check the device and flash access status */
@@ -838,9 +836,7 @@ static ssize_t c2port_write_flash_data(struct file *filp, struct kobject *kobj,
                                 struct bin_attribute *attr,
                                 char *buffer, loff_t offset, size_t count)
 {
-        struct c2port_device *c2dev =
-                        dev_get_drvdata(container_of(kobj,
-                                                struct device, kobj));
+        struct c2port_device *c2dev = dev_get_drvdata(kobj_to_dev(kobj));
         int ret;
 
         /* Check the device access status */
diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c
index 02006f7109a8..038af5d45145 100644
--- a/drivers/misc/cxl/sysfs.c
+++ b/drivers/misc/cxl/sysfs.c
@@ -386,8 +386,7 @@ static ssize_t afu_eb_read(struct file *filp, struct kobject *kobj,
                                struct bin_attribute *bin_attr, char *buf,
                                loff_t off, size_t count)
 {
-        struct cxl_afu *afu = to_cxl_afu(container_of(kobj,
-                                                      struct device, kobj));
+        struct cxl_afu *afu = to_cxl_afu(kobj_to_dev(kobj));
 
         return cxl_afu_read_err_buffer(afu, buf, off, count);
 }
@@ -467,7 +466,7 @@ static ssize_t afu_read_config(struct file *filp, struct kobject *kobj,
                                loff_t off, size_t count)
 {
         struct afu_config_record *cr = to_cr(kobj);
-        struct cxl_afu *afu = to_cxl_afu(container_of(kobj->parent, struct device, kobj));
+        struct cxl_afu *afu = to_cxl_afu(kobj_to_dev(kobj->parent));
 
         u64 i, j, val;
 
diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c
index 5d7c0900fa1b..d105c2564400 100644
--- a/drivers/misc/eeprom/at24.c
+++ b/drivers/misc/eeprom/at24.c
@@ -289,7 +289,7 @@ static ssize_t at24_bin_read(struct file *filp, struct kobject *kobj,
 {
         struct at24_data *at24;
 
-        at24 = dev_get_drvdata(container_of(kobj, struct device, kobj));
+        at24 = dev_get_drvdata(kobj_to_dev(kobj));
         return at24_read(at24, buf, off, count);
 }
 
@@ -420,7 +420,7 @@ static ssize_t at24_bin_write(struct file *filp, struct kobject *kobj,
 {
         struct at24_data *at24;
 
-        at24 = dev_get_drvdata(container_of(kobj, struct device, kobj));
+        at24 = dev_get_drvdata(kobj_to_dev(kobj));
         return at24_write(at24, buf, off, count);
 }
 
diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c
index f850ef556bcc..3e9e5a28acaa 100644
--- a/drivers/misc/eeprom/at25.c
+++ b/drivers/misc/eeprom/at25.c
@@ -139,7 +139,7 @@ at25_bin_read(struct file *filp, struct kobject *kobj,
         struct device           *dev;
         struct at25_data        *at25;
 
-        dev = container_of(kobj, struct device, kobj);
+        dev = kobj_to_dev(kobj);
         at25 = dev_get_drvdata(dev);
 
         return at25_ee_read(at25, buf, off, count);
@@ -273,7 +273,7 @@ at25_bin_write(struct file *filp, struct kobject *kobj,
         struct device           *dev;
         struct at25_data        *at25;
 
-        dev = container_of(kobj, struct device, kobj);
+        dev = kobj_to_dev(kobj);
         at25 = dev_get_drvdata(dev);
 
         return at25_ee_write(at25, buf, off, count);
diff --git a/drivers/misc/eeprom/eeprom.c b/drivers/misc/eeprom/eeprom.c
index 7342fd637031..3d1d55157e5f 100644
--- a/drivers/misc/eeprom/eeprom.c
+++ b/drivers/misc/eeprom/eeprom.c
@@ -84,7 +84,7 @@ static ssize_t eeprom_read(struct file *filp, struct kobject *kobj,
                            struct bin_attribute *bin_attr,
                            char *buf, loff_t off, size_t count)
 {
-        struct i2c_client *client = to_i2c_client(container_of(kobj, struct device, kobj));
+        struct i2c_client *client = to_i2c_client(kobj_to_dev(kobj));
         struct eeprom_data *data = i2c_get_clientdata(client);
         u8 slice;
 
diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
index ff63f05edc76..f62ab29e293c 100644
--- a/drivers/misc/eeprom/eeprom_93xx46.c
+++ b/drivers/misc/eeprom/eeprom_93xx46.c
@@ -10,9 +10,13 @@
 
 #include <linux/delay.h>
 #include <linux/device.h>
+#include <linux/gpio/consumer.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
+#include <linux/of_gpio.h>
 #include <linux/slab.h>
 #include <linux/spi/spi.h>
 #include <linux/sysfs.h>
@@ -25,6 +29,15 @@
 #define ADDR_ERAL       0x20
 #define ADDR_EWEN       0x30
 
+struct eeprom_93xx46_devtype_data {
+        unsigned int quirks;
+};
+
+static const struct eeprom_93xx46_devtype_data atmel_at93c46d_data = {
+        .quirks = EEPROM_93XX46_QUIRK_SINGLE_WORD_READ |
+                  EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH,
+};
+
 struct eeprom_93xx46_dev {
         struct spi_device *spi;
         struct eeprom_93xx46_platform_data *pdata;
@@ -33,6 +46,16 @@ struct eeprom_93xx46_dev {
         int addrlen;
 };
 
+static inline bool has_quirk_single_word_read(struct eeprom_93xx46_dev *edev)
+{
+        return edev->pdata->quirks & EEPROM_93XX46_QUIRK_SINGLE_WORD_READ;
+}
+
+static inline bool has_quirk_instruction_length(struct eeprom_93xx46_dev *edev)
+{
+        return edev->pdata->quirks & EEPROM_93XX46_QUIRK_INSTRUCTION_LENGTH;
+}
+
 static ssize_t
 eeprom_93xx46_bin_read(struct file *filp, struct kobject *kobj,
                        struct bin_attribute *bin_attr,
@@ -40,58 +63,73 @@ eeprom_93xx46_bin_read(struct file *filp, struct kobject *kobj,
 {
         struct eeprom_93xx46_dev *edev;
         struct device *dev;
-        struct spi_message m;
-        struct spi_transfer t[2];
-        int bits, ret;
-        u16 cmd_addr;
+        ssize_t ret = 0;
 
-        dev = container_of(kobj, struct device, kobj);
+        dev = kobj_to_dev(kobj);
         edev = dev_get_drvdata(dev);
 
-        cmd_addr = OP_READ << edev->addrlen;
+        mutex_lock(&edev->lock);
 
-        if (edev->addrlen == 7) {
-                cmd_addr |= off & 0x7f;
-                bits = 10;
-        } else {
-                cmd_addr |= off & 0x3f;
-                bits = 9;
-        }
+        if (edev->pdata->prepare)
+                edev->pdata->prepare(edev);
 
-        dev_dbg(&edev->spi->dev, "read cmd 0x%x, %d Hz\n",
-                cmd_addr, edev->spi->max_speed_hz);
+        while (count) {
+                struct spi_message m;
+                struct spi_transfer t[2] = { { 0 } };
+                u16 cmd_addr = OP_READ << edev->addrlen;
+                size_t nbytes = count;
+                int bits;
+                int err;
+
+                if (edev->addrlen == 7) {
+                        cmd_addr |= off & 0x7f;
+                        bits = 10;
+                        if (has_quirk_single_word_read(edev))
+                                nbytes = 1;
+                } else {
+                        cmd_addr |= (off >> 1) & 0x3f;
+                        bits = 9;
+                        if (has_quirk_single_word_read(edev))
+                                nbytes = 2;
+                }
 
-        spi_message_init(&m);
-        memset(t, 0, sizeof(t));
+                dev_dbg(&edev->spi->dev, "read cmd 0x%x, %d Hz\n",
+                        cmd_addr, edev->spi->max_speed_hz);
 
-        t[0].tx_buf = (char *)&cmd_addr;
-        t[0].len = 2;
-        t[0].bits_per_word = bits;
-        spi_message_add_tail(&t[0], &m);
+                spi_message_init(&m);
 
-        t[1].rx_buf = buf;
-        t[1].len = count;
-        t[1].bits_per_word = 8;
-        spi_message_add_tail(&t[1], &m);
+                t[0].tx_buf = (char *)&cmd_addr;
+                t[0].len = 2;
+                t[0].bits_per_word = bits;
+                spi_message_add_tail(&t[0], &m);
 
-        mutex_lock(&edev->lock);
+                t[1].rx_buf = buf;
+                t[1].len = count;
+                t[1].bits_per_word = 8;
+                spi_message_add_tail(&t[1], &m);
 
-        if (edev->pdata->prepare)
-                edev->pdata->prepare(edev);
+                err = spi_sync(edev->spi, &m);
+                /* have to wait at least Tcsl ns */
+                ndelay(250);
 
-        ret = spi_sync(edev->spi, &m);
-        /* have to wait at least Tcsl ns */
-        ndelay(250);
-        if (ret) {
-                dev_err(&edev->spi->dev, "read %zu bytes at %d: err. %d\n",
-                        count, (int)off, ret);
+                if (err) {
+                        dev_err(&edev->spi->dev, "read %zu bytes at %d: err. %d\n",
+                                nbytes, (int)off, err);
+                        ret = err;
+                        break;
+                }
+
+                buf += nbytes;
+                off += nbytes;
+                count -= nbytes;
+                ret += nbytes;
         }
 
         if (edev->pdata->finish)
                 edev->pdata->finish(edev);
 
         mutex_unlock(&edev->lock);
-        return ret ? : count;
+        return ret;
 }
 
 static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on)
@@ -110,7 +148,13 @@ static int eeprom_93xx46_ew(struct eeprom_93xx46_dev *edev, int is_on)
                 bits = 9;
         }
 
-        dev_dbg(&edev->spi->dev, "ew cmd 0x%04x\n", cmd_addr);
+        if (has_quirk_instruction_length(edev)) {
+                cmd_addr <<= 2;
+                bits += 2;
+        }
+
+        dev_dbg(&edev->spi->dev, "ew%s cmd 0x%04x, %d bits\n",
+                        is_on ? "en" : "ds", cmd_addr, bits);
 
         spi_message_init(&m);
         memset(&t, 0, sizeof(t));
@@ -155,7 +199,7 @@ eeprom_93xx46_write_word(struct eeprom_93xx46_dev *edev,
                 bits = 10;
                 data_len = 1;
         } else {
-                cmd_addr |= off & 0x3f;
+                cmd_addr |= (off >> 1) & 0x3f;
                 bits = 9;
                 data_len = 2;
         }
@@ -190,7 +234,7 @@ eeprom_93xx46_bin_write(struct file *filp, struct kobject *kobj,
         struct device *dev;
         int i, ret, step = 1;
 
-        dev = container_of(kobj, struct device, kobj);
+        dev = kobj_to_dev(kobj);
         edev = dev_get_drvdata(dev);
 
         /* only write even number of bytes on 16-bit devices */
@@ -245,6 +289,13 @@ static int eeprom_93xx46_eral(struct eeprom_93xx46_dev *edev)
                 bits = 9;
         }
 
+        if (has_quirk_instruction_length(edev)) {
+                cmd_addr <<= 2;
+                bits += 2;
+        }
+
+        dev_dbg(&edev->spi->dev, "eral cmd 0x%04x, %d bits\n", cmd_addr, bits);
+
         spi_message_init(&m);
         memset(&t, 0, sizeof(t));
 
@@ -294,12 +345,100 @@ static ssize_t eeprom_93xx46_store_erase(struct device *dev,
 }
 static DEVICE_ATTR(erase, S_IWUSR, NULL, eeprom_93xx46_store_erase);
 
+static void select_assert(void *context)
+{
+        struct eeprom_93xx46_dev *edev = context;
+
+        gpiod_set_value_cansleep(edev->pdata->select, 1);
+}
+
+static void select_deassert(void *context)
+{
+        struct eeprom_93xx46_dev *edev = context;
+
+        gpiod_set_value_cansleep(edev->pdata->select, 0);
+}
+
+static const struct of_device_id eeprom_93xx46_of_table[] = {
+        { .compatible = "eeprom-93xx46", },
+        { .compatible = "atmel,at93c46d", .data = &atmel_at93c46d_data, },
+        {}
+};
+MODULE_DEVICE_TABLE(of, eeprom_93xx46_of_table);
+
+static int eeprom_93xx46_probe_dt(struct spi_device *spi)
+{
+        const struct of_device_id *of_id =
+                of_match_device(eeprom_93xx46_of_table, &spi->dev);
+        struct device_node *np = spi->dev.of_node;
+        struct eeprom_93xx46_platform_data *pd;
+        u32 tmp;
+        int gpio;
+        enum of_gpio_flags of_flags;
+        int ret;
+
+        pd = devm_kzalloc(&spi->dev, sizeof(*pd), GFP_KERNEL);
+        if (!pd)
+                return -ENOMEM;
+
+        ret = of_property_read_u32(np, "data-size", &tmp);
+        if (ret < 0) {
+                dev_err(&spi->dev, "data-size property not found\n");
+                return ret;
+        }
+
+        if (tmp == 8) {
+                pd->flags |= EE_ADDR8;
+        } else if (tmp == 16) {
+                pd->flags |= EE_ADDR16;
+        } else {
+                dev_err(&spi->dev, "invalid data-size (%d)\n", tmp);
+                return -EINVAL;
+        }
+
+        if (of_property_read_bool(np, "read-only"))
+                pd->flags |= EE_READONLY;
+
+        gpio = of_get_named_gpio_flags(np, "select-gpios", 0, &of_flags);
+        if (gpio_is_valid(gpio)) {
+                unsigned long flags =
+                        of_flags == OF_GPIO_ACTIVE_LOW ? GPIOF_ACTIVE_LOW : 0;
+
+                ret = devm_gpio_request_one(&spi->dev, gpio, flags,
+                                            "eeprom_93xx46_select");
+                if (ret)
+                        return ret;
+
+                pd->select = gpio_to_desc(gpio);
+                pd->prepare = select_assert;
+                pd->finish = select_deassert;
+
+                gpiod_direction_output(pd->select, 0);
+        }
+
+        if (of_id->data) {
+                const struct eeprom_93xx46_devtype_data *data = of_id->data;
+
+                pd->quirks = data->quirks;
+        }
+
+        spi->dev.platform_data = pd;
+
+        return 0;
+}
+
 static int eeprom_93xx46_probe(struct spi_device *spi)
 {
         struct eeprom_93xx46_platform_data *pd;
         struct eeprom_93xx46_dev *edev;
         int err;
 
+        if (spi->dev.of_node) {
+                err = eeprom_93xx46_probe_dt(spi);
+                if (err < 0)
+                        return err;
+        }
+
         pd = spi->dev.platform_data;
         if (!pd) {
                 dev_err(&spi->dev, "missing platform data\n");
@@ -370,6 +509,7 @@ static int eeprom_93xx46_remove(struct spi_device *spi)
 static struct spi_driver eeprom_93xx46_driver = {
         .driver = {
                 .name   = "93xx46",
+                .of_match_table = of_match_ptr(eeprom_93xx46_of_table),
         },
         .probe          = eeprom_93xx46_probe,
         .remove         = eeprom_93xx46_remove,
diff --git a/drivers/misc/genwqe/card_sysfs.c b/drivers/misc/genwqe/card_sysfs.c
index 6ab31eff0536..c24c9b7c1dd3 100644
--- a/drivers/misc/genwqe/card_sysfs.c
+++ b/drivers/misc/genwqe/card_sysfs.c
@@ -278,7 +278,7 @@ static umode_t genwqe_is_visible(struct kobject *kobj,
                                  struct attribute *attr, int n)
 {
         unsigned int j;
-        struct device *dev = container_of(kobj, struct device, kobj);
+        struct device *dev = kobj_to_dev(kobj);
         struct genwqe_dev *cd = dev_get_drvdata(dev);
         umode_t mode = attr->mode;
 
diff --git a/drivers/misc/ibmasm/ibmasm.h b/drivers/misc/ibmasm/ibmasm.h
index 5bd127727d8e..9fea49d2e15b 100644
--- a/drivers/misc/ibmasm/ibmasm.h
+++ b/drivers/misc/ibmasm/ibmasm.h
@@ -34,6 +34,7 @@
 #include <linux/kref.h>
 #include <linux/device.h>
 #include <linux/input.h>
+#include <linux/time64.h>
 
 /* Driver identification */
 #define DRIVER_NAME     "ibmasm"
@@ -53,9 +54,11 @@ extern int ibmasm_debug;
 
 static inline char *get_timestamp(char *buf)
 {
-        struct timeval now;
-        do_gettimeofday(&now);
-        sprintf(buf, "%lu.%lu", now.tv_sec, now.tv_usec);
+        struct timespec64 now;
+
+        ktime_get_real_ts64(&now);
+        sprintf(buf, "%llu.%.08lu", (long long)now.tv_sec,
+                                now.tv_nsec / NSEC_PER_USEC);
         return buf;
 }
 
diff --git a/drivers/misc/lis3lv02d/lis3lv02d_i2c.c b/drivers/misc/lis3lv02d/lis3lv02d_i2c.c
index 0c3bb7e3ee80..14b7d539fed6 100644
--- a/drivers/misc/lis3lv02d/lis3lv02d_i2c.c
+++ b/drivers/misc/lis3lv02d/lis3lv02d_i2c.c
@@ -209,7 +209,7 @@ static int lis3lv02d_i2c_remove(struct i2c_client *client)
 #ifdef CONFIG_PM_SLEEP
 static int lis3lv02d_i2c_suspend(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct lis3lv02d *lis3 = i2c_get_clientdata(client);
 
         if (!lis3->pdata || !lis3->pdata->wakeup_flags)
@@ -219,7 +219,7 @@ static int lis3lv02d_i2c_suspend(struct device *dev)
 
 static int lis3lv02d_i2c_resume(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct lis3lv02d *lis3 = i2c_get_clientdata(client);
 
         /*
@@ -238,7 +238,7 @@ static int lis3lv02d_i2c_resume(struct device *dev)
 #ifdef CONFIG_PM
 static int lis3_i2c_runtime_suspend(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct lis3lv02d *lis3 = i2c_get_clientdata(client);
 
         lis3lv02d_poweroff(lis3);
@@ -247,7 +247,7 @@ static int lis3_i2c_runtime_suspend(struct device *dev)
 
 static int lis3_i2c_runtime_resume(struct device *dev)
 {
-        struct i2c_client *client = container_of(dev, struct i2c_client, dev);
+        struct i2c_client *client = to_i2c_client(dev);
         struct lis3lv02d *lis3 = i2c_get_clientdata(client);
 
         lis3lv02d_poweron(lis3);
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 11fdadc68e53..5c1351b19029 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -335,7 +335,7 @@ static noinline void corrupt_stack(void)
         memset((void *)data, 0, 64);
 }
 
-static void execute_location(void *dst)
+static void noinline execute_location(void *dst)
 {
         void (*func)(void) = dst;
 
diff --git a/drivers/misc/mei/Kconfig b/drivers/misc/mei/Kconfig
index d23384dde73b..c49e1d2269af 100644
--- a/drivers/misc/mei/Kconfig
+++ b/drivers/misc/mei/Kconfig
@@ -1,6 +1,6 @@
 config INTEL_MEI
         tristate "Intel Management Engine Interface"
-        depends on X86 && PCI && WATCHDOG_CORE
+        depends on X86 && PCI
         help
           The Intel Management Engine (Intel ME) provides Manageability,
           Security and Media services for system containing Intel chipsets.
@@ -12,7 +12,7 @@ config INTEL_MEI
 config INTEL_MEI_ME
         tristate "ME Enabled Intel Chipsets"
         select INTEL_MEI
-        depends on X86 && PCI && WATCHDOG_CORE
+        depends on X86 && PCI
         help
           MEI support for ME Enabled Intel chipsets.
 
@@ -37,7 +37,7 @@ config INTEL_MEI_ME
 config INTEL_MEI_TXE
         tristate "Intel Trusted Execution Environment with ME Interface"
         select INTEL_MEI
-        depends on X86 && PCI && WATCHDOG_CORE
+        depends on X86 && PCI
         help
           MEI Support for Trusted Execution Environment device on Intel SoCs
 
diff --git a/drivers/misc/mei/Makefile b/drivers/misc/mei/Makefile
index 01447ca21c26..59e6b0aede34 100644
--- a/drivers/misc/mei/Makefile
+++ b/drivers/misc/mei/Makefile
@@ -9,7 +9,6 @@ mei-objs += interrupt.o
 mei-objs += client.o
 mei-objs += main.o
 mei-objs += amthif.o
-mei-objs += wd.o
 mei-objs += bus.o
 mei-objs += bus-fixup.o
 mei-$(CONFIG_DEBUG_FS) += debugfs.o
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index cd0403f09267..194360a5f782 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -50,7 +50,6 @@ void mei_amthif_reset_params(struct mei_device *dev)
         dev->iamthif_current_cb = NULL;
         dev->iamthif_canceled = false;
         dev->iamthif_state = MEI_IAMTHIF_IDLE;
-        dev->iamthif_timer = 0;
         dev->iamthif_stall_timer = 0;
         dev->iamthif_open_count = 0;
 }
@@ -68,11 +67,14 @@ int mei_amthif_host_init(struct mei_device *dev, struct mei_me_client *me_cl)
         struct mei_cl *cl = &dev->iamthif_cl;
         int ret;
 
+        if (mei_cl_is_connected(cl))
+                return 0;
+
         dev->iamthif_state = MEI_IAMTHIF_IDLE;
 
         mei_cl_init(cl, dev);
 
-        ret = mei_cl_link(cl, MEI_IAMTHIF_HOST_CLIENT_ID);
+        ret = mei_cl_link(cl);
         if (ret < 0) {
                 dev_err(dev->dev, "amthif: failed cl_link %d\n", ret);
                 return ret;
@@ -80,32 +82,10 @@ int mei_amthif_host_init(struct mei_device *dev, struct mei_me_client *me_cl)
 
         ret = mei_cl_connect(cl, me_cl, NULL);
 
-        dev->iamthif_state = MEI_IAMTHIF_IDLE;
-
         return ret;
 }
 
 /**
- * mei_amthif_find_read_list_entry - finds a amthilist entry for current file
- *
- * @dev: the device structure
- * @file: pointer to file object
- *
- * Return:   returned a list entry on success, NULL on failure.
- */
-struct mei_cl_cb *mei_amthif_find_read_list_entry(struct mei_device *dev,
-                                                struct file *file)
-{
-        struct mei_cl_cb *cb;
-
-        list_for_each_entry(cb, &dev->amthif_rd_complete_list.list, list)
-                if (cb->file_object == file)
-                        return cb;
-        return NULL;
-}
-
-
-/**
  * mei_amthif_read - read data from AMTHIF client
  *
  * @dev: the device structure
@@ -126,18 +106,11 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
 {
         struct mei_cl *cl = file->private_data;
         struct mei_cl_cb *cb;
-        unsigned long timeout;
         int rets;
         int wait_ret;
 
-        /* Only possible if we are in timeout */
-        if (!cl) {
-                dev_err(dev->dev, "bad file ext.\n");
-                return -ETIME;
-        }
-
         dev_dbg(dev->dev, "checking amthif data\n");
-        cb = mei_amthif_find_read_list_entry(dev, file);
+        cb = mei_cl_read_cb(cl, file);
 
         /* Check for if we can block or not*/
         if (cb == NULL && file->f_flags & O_NONBLOCK)
@@ -149,8 +122,9 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
                 /* unlock the Mutex */
                 mutex_unlock(&dev->device_lock);
 
-                wait_ret = wait_event_interruptible(dev->iamthif_cl.wait,
-                        (cb = mei_amthif_find_read_list_entry(dev, file)));
+                wait_ret = wait_event_interruptible(cl->rx_wait,
+                                        !list_empty(&cl->rd_completed) ||
+                                        !mei_cl_is_connected(cl));
 
                 /* Locking again the Mutex */
                 mutex_lock(&dev->device_lock);
@@ -158,7 +132,12 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
                 if (wait_ret)
                         return -ERESTARTSYS;
 
-                dev_dbg(dev->dev, "woke up from sleep\n");
+                if (!mei_cl_is_connected(cl)) {
+                        rets = -EBUSY;
+                        goto out;
+                }
+
+                cb = mei_cl_read_cb(cl, file);
         }
 
         if (cb->status) {
@@ -168,24 +147,10 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
         }
 
         dev_dbg(dev->dev, "Got amthif data\n");
-        dev->iamthif_timer = 0;
-
-        timeout = cb->read_time +
-                mei_secs_to_jiffies(MEI_IAMTHIF_READ_TIMER);
-        dev_dbg(dev->dev, "amthif timeout = %lud\n",
-                        timeout);
-
-        if  (time_after(jiffies, timeout)) {
-                dev_dbg(dev->dev, "amthif Time out\n");
-                /* 15 sec for the message has expired */
-                list_del_init(&cb->list);
-                rets = -ETIME;
-                goto free;
-        }
         /* if the whole message will fit remove it from the list */
         if (cb->buf_idx >= *offset && length >= (cb->buf_idx - *offset))
                 list_del_init(&cb->list);
-        else if (cb->buf_idx > 0 && cb->buf_idx <= *offset) {
+        else if (cb->buf_idx <= *offset) {
                 /* end of the message has been reached */
                 list_del_init(&cb->list);
                 rets = 0;
@@ -195,9 +160,8 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
                  * remove message from deletion list
                  */
 
-        dev_dbg(dev->dev, "amthif cb->buf size - %d\n",
-            cb->buf.size);
-        dev_dbg(dev->dev, "amthif cb->buf_idx - %lu\n", cb->buf_idx);
+        dev_dbg(dev->dev, "amthif cb->buf.size - %zu cb->buf_idx - %zu\n",
+                cb->buf.size, cb->buf_idx);
 
         /* length is being truncated to PAGE_SIZE, however,
          * the buf_idx may point beyond */
@@ -229,7 +193,7 @@ out:
  *
  * Return: 0 on success, <0 on failure.
  */
-static int mei_amthif_read_start(struct mei_cl *cl, struct file *file)
+static int mei_amthif_read_start(struct mei_cl *cl, const struct file *file)
 {
         struct mei_device *dev = cl->dev;
         struct mei_cl_cb *cb;
@@ -248,7 +212,7 @@ static int mei_amthif_read_start(struct mei_cl *cl, struct file *file)
         list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
 
         dev->iamthif_state = MEI_IAMTHIF_READING;
-        dev->iamthif_file_object = cb->file_object;
+        dev->iamthif_fp = cb->fp;
         dev->iamthif_current_cb = cb;
 
         return 0;
@@ -277,7 +241,7 @@ static int mei_amthif_send_cmd(struct mei_cl *cl, struct mei_cl_cb *cb)
 
         dev->iamthif_state = MEI_IAMTHIF_WRITING;
         dev->iamthif_current_cb = cb;
-        dev->iamthif_file_object = cb->file_object;
+        dev->iamthif_fp = cb->fp;
         dev->iamthif_canceled = false;
 
         ret = mei_cl_write(cl, cb, false);
@@ -285,7 +249,7 @@ static int mei_amthif_send_cmd(struct mei_cl *cl, struct mei_cl_cb *cb)
                 return ret;
 
         if (cb->completed)
-                cb->status = mei_amthif_read_start(cl, cb->file_object);
+                cb->status = mei_amthif_read_start(cl, cb->fp);
 
         return 0;
 }
@@ -304,8 +268,7 @@ int mei_amthif_run_next_cmd(struct mei_device *dev)
 
         dev->iamthif_canceled = false;
         dev->iamthif_state = MEI_IAMTHIF_IDLE;
-        dev->iamthif_timer = 0;
-        dev->iamthif_file_object = NULL;
+        dev->iamthif_fp = NULL;
 
         dev_dbg(dev->dev, "complete amthif cmd_list cb.\n");
 
@@ -329,17 +292,17 @@ int mei_amthif_run_next_cmd(struct mei_device *dev)
 int mei_amthif_write(struct mei_cl *cl, struct mei_cl_cb *cb)
 {
 
-        struct mei_device *dev;
-
-        if (WARN_ON(!cl || !cl->dev))
-                return -ENODEV;
+        struct mei_device *dev = cl->dev;
 
-        if (WARN_ON(!cb))
-                return -EINVAL;
+        list_add_tail(&cb->list, &dev->amthif_cmd_list.list);
 
-        dev = cl->dev;
+        /*
+         * The previous request is still in processing, queue this one.
+         */
+        if (dev->iamthif_state > MEI_IAMTHIF_IDLE &&
+            dev->iamthif_state < MEI_IAMTHIF_READ_COMPLETE)
+                return 0;
 
-        list_add_tail(&cb->list, &dev->amthif_cmd_list.list);
         return mei_amthif_run_next_cmd(dev);
 }
 
@@ -360,10 +323,10 @@ unsigned int mei_amthif_poll(struct mei_device *dev,
 {
         unsigned int mask = 0;
 
-        poll_wait(file, &dev->iamthif_cl.wait, wait);
+        poll_wait(file, &dev->iamthif_cl.rx_wait, wait);
 
         if (dev->iamthif_state == MEI_IAMTHIF_READ_COMPLETE &&
-            dev->iamthif_file_object == file) {
+            dev->iamthif_fp == file) {
 
                 mask |= POLLIN | POLLRDNORM;
                 mei_amthif_run_next_cmd(dev);
@@ -393,7 +356,7 @@ int mei_amthif_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
                 return ret;
 
         if (cb->completed)
-                cb->status = mei_amthif_read_start(cl, cb->file_object);
+                cb->status = mei_amthif_read_start(cl, cb->fp);
 
         return 0;
 }
@@ -437,11 +400,12 @@ int mei_amthif_irq_read_msg(struct mei_cl *cl,
 /**
  * mei_amthif_complete - complete amthif callback.
  *
- * @dev: the device structure.
+ * @cl: host client
  * @cb: callback block.
  */
-void mei_amthif_complete(struct mei_device *dev, struct mei_cl_cb *cb)
+void mei_amthif_complete(struct mei_cl *cl, struct mei_cl_cb *cb)
 {
+        struct mei_device *dev = cl->dev;
 
         if (cb->fop_type == MEI_FOP_WRITE) {
                 if (!cb->status) {
@@ -453,25 +417,22 @@ void mei_amthif_complete(struct mei_device *dev, struct mei_cl_cb *cb)
                  * in case of error enqueue the write cb to complete read list
                  * so it can be propagated to the reader
                  */
-                list_add_tail(&cb->list, &dev->amthif_rd_complete_list.list);
-                wake_up_interruptible(&dev->iamthif_cl.wait);
+                list_add_tail(&cb->list, &cl->rd_completed);
+                wake_up_interruptible(&cl->rx_wait);
                 return;
         }
 
         if (!dev->iamthif_canceled) {
                 dev->iamthif_state = MEI_IAMTHIF_READ_COMPLETE;
                 dev->iamthif_stall_timer = 0;
-                list_add_tail(&cb->list, &dev->amthif_rd_complete_list.list);
+                list_add_tail(&cb->list, &cl->rd_completed);
                 dev_dbg(dev->dev, "amthif read completed\n");
-                dev->iamthif_timer = jiffies;
-                dev_dbg(dev->dev, "dev->iamthif_timer = %ld\n",
-                        dev->iamthif_timer);
         } else {
                 mei_amthif_run_next_cmd(dev);
         }
 
         dev_dbg(dev->dev, "completing amthif call back.\n");
-        wake_up_interruptible(&dev->iamthif_cl.wait);
+        wake_up_interruptible(&cl->rx_wait);
 }
 
 /**
@@ -497,7 +458,7 @@ static bool mei_clear_list(struct mei_device *dev,
         /* list all list member */
         list_for_each_entry_safe(cb, next, mei_cb_list, list) {
                 /* check if list member associated with a file */
-                if (file == cb->file_object) {
+                if (file == cb->fp) {
                         /* check if cb equal to current iamthif cb */
                         if (dev->iamthif_current_cb == cb) {
                                 dev->iamthif_current_cb = NULL;
@@ -523,13 +484,14 @@ static bool mei_clear_list(struct mei_device *dev,
  *
  * Return: true if callback removed from the list, false otherwise
  */
-static bool mei_clear_lists(struct mei_device *dev, struct file *file)
+static bool mei_clear_lists(struct mei_device *dev, const struct file *file)
 {
         bool removed = false;
+        struct mei_cl *cl = &dev->iamthif_cl;
 
         /* remove callbacks associated with a file */
         mei_clear_list(dev, file, &dev->amthif_cmd_list.list);
-        if (mei_clear_list(dev, file, &dev->amthif_rd_complete_list.list))
+        if (mei_clear_list(dev, file, &cl->rd_completed))
                 removed = true;
 
         mei_clear_list(dev, file, &dev->ctrl_rd_list.list);
@@ -546,7 +508,7 @@ static bool mei_clear_lists(struct mei_device *dev, struct file *file)
         /* check if iamthif_current_cb not NULL */
         if (dev->iamthif_current_cb && !removed) {
                 /* check file and iamthif current cb association */
-                if (dev->iamthif_current_cb->file_object == file) {
+                if (dev->iamthif_current_cb->fp == file) {
                         /* remove cb */
                         mei_io_cb_free(dev->iamthif_current_cb);
                         dev->iamthif_current_cb = NULL;
@@ -569,7 +531,7 @@ int mei_amthif_release(struct mei_device *dev, struct file *file)
         if (dev->iamthif_open_count > 0)
                 dev->iamthif_open_count--;
 
-        if (dev->iamthif_file_object == file &&
+        if (dev->iamthif_fp == file &&
             dev->iamthif_state != MEI_IAMTHIF_IDLE) {
 
                 dev_dbg(dev->dev, "amthif canceled iamthif state %d\n",
diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
index 020de5919c21..e9e6ea3ab73c 100644
--- a/drivers/misc/mei/bus-fixup.c
+++ b/drivers/misc/mei/bus-fixup.c
@@ -35,6 +35,9 @@ static const uuid_le mei_nfc_info_guid = MEI_UUID_NFC_INFO;
 #define MEI_UUID_NFC_HCI UUID_LE(0x0bb17a78, 0x2a8e, 0x4c50, \
                         0x94, 0xd4, 0x50, 0x26, 0x67, 0x23, 0x77, 0x5c)
 
+#define MEI_UUID_WD UUID_LE(0x05B79A6F, 0x4628, 0x4D7F, \
+                            0x89, 0x9D, 0xA9, 0x15, 0x14, 0xCB, 0x32, 0xAB)
+
 #define MEI_UUID_ANY NULL_UUID_LE
 
 /**
@@ -48,8 +51,7 @@ static const uuid_le mei_nfc_info_guid = MEI_UUID_NFC_INFO;
  */
 static void number_of_connections(struct mei_cl_device *cldev)
 {
-        dev_dbg(&cldev->dev, "running hook %s on %pUl\n",
-                        __func__, mei_me_cl_uuid(cldev->me_cl));
+        dev_dbg(&cldev->dev, "running hook %s\n", __func__);
 
         if (cldev->me_cl->props.max_number_of_connections > 1)
                 cldev->do_match = 0;
@@ -62,11 +64,36 @@ static void number_of_connections(struct mei_cl_device *cldev)
  */
 static void blacklist(struct mei_cl_device *cldev)
 {
-        dev_dbg(&cldev->dev, "running hook %s on %pUl\n",
-                        __func__, mei_me_cl_uuid(cldev->me_cl));
+        dev_dbg(&cldev->dev, "running hook %s\n", __func__);
+
         cldev->do_match = 0;
 }
 
+/**
+ * mei_wd - wd client on the bus, change protocol version
+ *   as the API has changed.
+ *
+ * @cldev: me clients device
+ */
+#if IS_ENABLED(CONFIG_INTEL_MEI_ME)
+#include <linux/pci.h>
+#include "hw-me-regs.h"
+static void mei_wd(struct mei_cl_device *cldev)
+{
+        struct pci_dev *pdev = to_pci_dev(cldev->dev.parent);
+
+        dev_dbg(&cldev->dev, "running hook %s\n", __func__);
+        if (pdev->device == MEI_DEV_ID_WPT_LP ||
+            pdev->device == MEI_DEV_ID_SPT ||
+            pdev->device == MEI_DEV_ID_SPT_H)
+                cldev->me_cl->props.protocol_version = 0x2;
+
+        cldev->do_match = 1;
+}
+#else
+static inline void mei_wd(struct mei_cl_device *cldev) {}
+#endif /* CONFIG_INTEL_MEI_ME */
+
 struct mei_nfc_cmd {
         u8 command;
         u8 status;
@@ -208,12 +235,11 @@ static void mei_nfc(struct mei_cl_device *cldev)
 
         bus = cldev->bus;
 
-        dev_dbg(bus->dev, "running hook %s: %pUl match=%d\n",
-                __func__, mei_me_cl_uuid(cldev->me_cl), cldev->do_match);
+        dev_dbg(&cldev->dev, "running hook %s\n", __func__);
 
         mutex_lock(&bus->device_lock);
         /* we need to connect to INFO GUID */
-        cl = mei_cl_alloc_linked(bus, MEI_HOST_CLIENT_ID_ANY);
+        cl = mei_cl_alloc_linked(bus);
         if (IS_ERR(cl)) {
                 ret = PTR_ERR(cl);
                 cl = NULL;
@@ -282,6 +308,7 @@ static struct mei_fixup {
         MEI_FIXUP(MEI_UUID_ANY, number_of_connections),
         MEI_FIXUP(MEI_UUID_NFC_INFO, blacklist),
         MEI_FIXUP(MEI_UUID_NFC_HCI, mei_nfc),
+        MEI_FIXUP(MEI_UUID_WD, mei_wd),
 };
 
 /**
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index 0b05aa938799..5d5996e39a67 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -44,7 +44,7 @@ ssize_t __mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
                         bool blocking)
 {
         struct mei_device *bus;
-        struct mei_cl_cb *cb = NULL;
+        struct mei_cl_cb *cb;
         ssize_t rets;
 
         if (WARN_ON(!cl || !cl->dev))
@@ -53,6 +53,11 @@ ssize_t __mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
         bus = cl->dev;
 
         mutex_lock(&bus->device_lock);
+        if (bus->dev_state != MEI_DEV_ENABLED) {
+                rets = -ENODEV;
+                goto out;
+        }
+
         if (!mei_cl_is_connected(cl)) {
                 rets = -ENODEV;
                 goto out;
@@ -81,8 +86,6 @@ ssize_t __mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
 
 out:
         mutex_unlock(&bus->device_lock);
-        if (rets < 0)
-                mei_io_cb_free(cb);
 
         return rets;
 }
@@ -109,6 +112,10 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
         bus = cl->dev;
 
         mutex_lock(&bus->device_lock);
+        if (bus->dev_state != MEI_DEV_ENABLED) {
+                rets = -ENODEV;
+                goto out;
+        }
 
         cb = mei_cl_read_cb(cl, NULL);
         if (cb)
@@ -230,45 +237,55 @@ static void mei_cl_bus_event_work(struct work_struct *work)
  * mei_cl_bus_notify_event - schedule notify cb on bus client
  *
  * @cl: host client
+ *
+ * Return: true if event was scheduled
+ *         false if the client is not waiting for event
  */
-void mei_cl_bus_notify_event(struct mei_cl *cl)
+bool mei_cl_bus_notify_event(struct mei_cl *cl)
 {
         struct mei_cl_device *cldev = cl->cldev;
 
         if (!cldev || !cldev->event_cb)
-                return;
+                return false;
 
         if (!(cldev->events_mask & BIT(MEI_CL_EVENT_NOTIF)))
-                return;
+                return false;
 
         if (!cl->notify_ev)
-                return;
+                return false;
 
         set_bit(MEI_CL_EVENT_NOTIF, &cldev->events);
 
         schedule_work(&cldev->event_work);
 
         cl->notify_ev = false;
+
+        return true;
 }
 
 /**
- * mei_cl_bus_rx_event  - schedule rx evenet
+ * mei_cl_bus_rx_event  - schedule rx event
  *
  * @cl: host client
+ *
+ * Return: true if event was scheduled
+ *         false if the client is not waiting for event
  */
-void mei_cl_bus_rx_event(struct mei_cl *cl)
+bool mei_cl_bus_rx_event(struct mei_cl *cl)
 {
         struct mei_cl_device *cldev = cl->cldev;
 
         if (!cldev || !cldev->event_cb)
-                return;
+                return false;
 
         if (!(cldev->events_mask & BIT(MEI_CL_EVENT_RX)))
-                return;
+                return false;
 
         set_bit(MEI_CL_EVENT_RX, &cldev->events);
 
         schedule_work(&cldev->event_work);
+
+        return true;
 }
 
 /**
@@ -398,7 +415,7 @@ int mei_cldev_enable(struct mei_cl_device *cldev)
 
         if (!cl) {
                 mutex_lock(&bus->device_lock);
-                cl = mei_cl_alloc_linked(bus, MEI_HOST_CLIENT_ID_ANY);
+                cl = mei_cl_alloc_linked(bus);
                 mutex_unlock(&bus->device_lock);
                 if (IS_ERR(cl))
                         return PTR_ERR(cl);
@@ -958,6 +975,22 @@ void mei_cl_bus_rescan(struct mei_device *bus)
         dev_dbg(bus->dev, "rescan end");
 }
 
+void mei_cl_bus_rescan_work(struct work_struct *work)
+{
+        struct mei_device *bus =
+                container_of(work, struct mei_device, bus_rescan_work);
+        struct mei_me_client *me_cl;
+
+        mutex_lock(&bus->device_lock);
+        me_cl = mei_me_cl_by_uuid(bus, &mei_amthif_guid);
+        if (me_cl)
+                mei_amthif_host_init(bus, me_cl);
+        mei_me_cl_put(me_cl);
+        mutex_unlock(&bus->device_lock);
+
+        mei_cl_bus_rescan(bus);
+}
+
 int __mei_cldev_driver_register(struct mei_cl_driver *cldrv,
                                 struct module *owner)
 {
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index a6c87c713193..bab17e4197b6 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -359,7 +359,7 @@ void mei_io_cb_free(struct mei_cl_cb *cb)
  * Return: mei_cl_cb pointer or NULL;
  */
 struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, enum mei_cb_file_ops type,
-                                 struct file *fp)
+                                 const struct file *fp)
 {
         struct mei_cl_cb *cb;
 
@@ -368,7 +368,7 @@ struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, enum mei_cb_file_ops type,
                 return NULL;
 
         INIT_LIST_HEAD(&cb->list);
-        cb->file_object = fp;
+        cb->fp = fp;
         cb->cl = cl;
         cb->buf_idx = 0;
         cb->fop_type = type;
@@ -455,7 +455,8 @@ int mei_io_cb_alloc_buf(struct mei_cl_cb *cb, size_t length)
  * Return: cb on success and NULL on failure
  */
 struct mei_cl_cb *mei_cl_alloc_cb(struct mei_cl *cl, size_t length,
-                                  enum mei_cb_file_ops type, struct file *fp)
+                                  enum mei_cb_file_ops type,
+                                  const struct file *fp)
 {
         struct mei_cl_cb *cb;
 
@@ -485,7 +486,7 @@ struct mei_cl_cb *mei_cl_read_cb(const struct mei_cl *cl, const struct file *fp)
         struct mei_cl_cb *cb;
 
         list_for_each_entry(cb, &cl->rd_completed, list)
-                if (!fp || fp == cb->file_object)
+                if (!fp || fp == cb->fp)
                         return cb;
 
         return NULL;
@@ -503,12 +504,12 @@ void mei_cl_read_cb_flush(const struct mei_cl *cl, const struct file *fp)
         struct mei_cl_cb *cb, *next;
 
         list_for_each_entry_safe(cb, next, &cl->rd_completed, list)
-                if (!fp || fp == cb->file_object)
+                if (!fp || fp == cb->fp)
                         mei_io_cb_free(cb);
 
 
         list_for_each_entry_safe(cb, next, &cl->rd_pending, list)
-                if (!fp || fp == cb->file_object)
+                if (!fp || fp == cb->fp)
                         mei_io_cb_free(cb);
 }
 
@@ -535,7 +536,6 @@ int mei_cl_flush_queues(struct mei_cl *cl, const struct file *fp)
         mei_io_list_flush(&cl->dev->ctrl_wr_list, cl);
         mei_io_list_flush(&cl->dev->ctrl_rd_list, cl);
         mei_io_list_flush(&cl->dev->amthif_cmd_list, cl);
-        mei_io_list_flush(&cl->dev->amthif_rd_complete_list, cl);
 
         mei_cl_read_cb_flush(cl, fp);
 
@@ -587,27 +587,23 @@ struct mei_cl *mei_cl_allocate(struct mei_device *dev)
  * mei_cl_link - allocate host id in the host map
  *
  * @cl: host client
- * @id: fixed host id or MEI_HOST_CLIENT_ID_ANY (-1) for generic one
  *
  * Return: 0 on success
  *      -EINVAL on incorrect values
  *      -EMFILE if open count exceeded.
  */
-int mei_cl_link(struct mei_cl *cl, int id)
+int mei_cl_link(struct mei_cl *cl)
 {
         struct mei_device *dev;
         long open_handle_count;
+        int id;
 
         if (WARN_ON(!cl || !cl->dev))
                 return -EINVAL;
 
         dev = cl->dev;
 
-        /* If Id is not assigned get one*/
-        if (id == MEI_HOST_CLIENT_ID_ANY)
-                id = find_first_zero_bit(dev->host_clients_map,
-                                        MEI_CLIENTS_MAX);
-
+        id = find_first_zero_bit(dev->host_clients_map, MEI_CLIENTS_MAX);
         if (id >= MEI_CLIENTS_MAX) {
                 dev_err(dev->dev, "id exceeded %d", MEI_CLIENTS_MAX);
                 return -EMFILE;
@@ -648,7 +644,7 @@ int mei_cl_unlink(struct mei_cl *cl)
         if (!cl)
                 return 0;
 
-        /* wd and amthif might not be initialized */
+        /* amthif might not be initialized */
         if (!cl->dev)
                 return 0;
 
@@ -670,31 +666,12 @@ int mei_cl_unlink(struct mei_cl *cl)
         return 0;
 }
 
-
-void mei_host_client_init(struct work_struct *work)
+void mei_host_client_init(struct mei_device *dev)
 {
-        struct mei_device *dev =
-                container_of(work, struct mei_device, init_work);
-        struct mei_me_client *me_cl;
-
-        mutex_lock(&dev->device_lock);
-
-
-        me_cl = mei_me_cl_by_uuid(dev, &mei_amthif_guid);
-        if (me_cl)
-                mei_amthif_host_init(dev, me_cl);
-        mei_me_cl_put(me_cl);
-
-        me_cl = mei_me_cl_by_uuid(dev, &mei_wd_guid);
-        if (me_cl)
-                mei_wd_host_init(dev, me_cl);
-        mei_me_cl_put(me_cl);
-
         dev->dev_state = MEI_DEV_ENABLED;
         dev->reset_count = 0;
-        mutex_unlock(&dev->device_lock);
 
-        mei_cl_bus_rescan(dev);
+        schedule_work(&dev->bus_rescan_work);
 
         pm_runtime_mark_last_busy(dev->dev);
         dev_dbg(dev->dev, "rpm: autosuspend\n");
@@ -726,6 +703,33 @@ bool mei_hbuf_acquire(struct mei_device *dev)
 }
 
 /**
+ * mei_cl_wake_all - wake up readers, writers and event waiters so
+ *                 they can be interrupted
+ *
+ * @cl: host client
+ */
+static void mei_cl_wake_all(struct mei_cl *cl)
+{
+        struct mei_device *dev = cl->dev;
+
+        /* synchronized under device mutex */
+        if (waitqueue_active(&cl->rx_wait)) {
+                cl_dbg(dev, cl, "Waking up reading client!\n");
+                wake_up_interruptible(&cl->rx_wait);
+        }
+        /* synchronized under device mutex */
+        if (waitqueue_active(&cl->tx_wait)) {
+                cl_dbg(dev, cl, "Waking up writing client!\n");
+                wake_up_interruptible(&cl->tx_wait);
+        }
+        /* synchronized under device mutex */
+        if (waitqueue_active(&cl->ev_wait)) {
+                cl_dbg(dev, cl, "Waking up waiting for event clients!\n");
+                wake_up_interruptible(&cl->ev_wait);
+        }
+}
+
+/**
  * mei_cl_set_disconnected - set disconnected state and clear
  *   associated states and resources
  *
@@ -740,8 +744,11 @@ void mei_cl_set_disconnected(struct mei_cl *cl)
                 return;
 
         cl->state = MEI_FILE_DISCONNECTED;
+        mei_io_list_free(&dev->write_list, cl);
+        mei_io_list_free(&dev->write_waiting_list, cl);
         mei_io_list_flush(&dev->ctrl_rd_list, cl);
         mei_io_list_flush(&dev->ctrl_wr_list, cl);
+        mei_cl_wake_all(cl);
         cl->mei_flow_ctrl_creds = 0;
         cl->timer_count = 0;
 
@@ -1034,7 +1041,7 @@ int mei_cl_irq_connect(struct mei_cl *cl, struct mei_cl_cb *cb,
  * Return: 0 on success, <0 on failure.
  */
 int mei_cl_connect(struct mei_cl *cl, struct mei_me_client *me_cl,
-                   struct file *file)
+                  const struct file *file)
 {
         struct mei_device *dev;
         struct mei_cl_cb *cb;
@@ -1119,11 +1126,10 @@ nortpm:
  * mei_cl_alloc_linked - allocate and link host client
  *
  * @dev: the device structure
- * @id: fixed host id or MEI_HOST_CLIENT_ID_ANY (-1) for generic one
  *
  * Return: cl on success ERR_PTR on failure
  */
-struct mei_cl *mei_cl_alloc_linked(struct mei_device *dev, int id)
+struct mei_cl *mei_cl_alloc_linked(struct mei_device *dev)
 {
         struct mei_cl *cl;
         int ret;
@@ -1134,7 +1140,7 @@ struct mei_cl *mei_cl_alloc_linked(struct mei_device *dev, int id)
                 goto err;
         }
 
-        ret = mei_cl_link(cl, id);
+        ret = mei_cl_link(cl);
         if (ret)
                 goto err;
 
@@ -1149,11 +1155,12 @@ err:
 /**
  * mei_cl_flow_ctrl_creds - checks flow_control credits for cl.
  *
- * @cl: private data of the file object
+ * @cl: host client
+ * @fp: the file pointer associated with the pointer
  *
  * Return: 1 if mei_flow_ctrl_creds >0, 0 - otherwise.
  */
-int mei_cl_flow_ctrl_creds(struct mei_cl *cl)
+static int mei_cl_flow_ctrl_creds(struct mei_cl *cl, const struct file *fp)
 {
         int rets;
 
@@ -1164,7 +1171,7 @@ int mei_cl_flow_ctrl_creds(struct mei_cl *cl)
                 return 1;
 
         if (mei_cl_is_fixed_address(cl)) {
-                rets = mei_cl_read_start(cl, mei_cl_mtu(cl), NULL);
+                rets = mei_cl_read_start(cl, mei_cl_mtu(cl), fp);
                 if (rets && rets != -EBUSY)
                         return rets;
                 return 1;
@@ -1186,7 +1193,7 @@ int mei_cl_flow_ctrl_creds(struct mei_cl *cl)
  *      0 on success
  *      -EINVAL when ctrl credits are <= 0
  */
-int mei_cl_flow_ctrl_reduce(struct mei_cl *cl)
+static int mei_cl_flow_ctrl_reduce(struct mei_cl *cl)
 {
         if (WARN_ON(!cl || !cl->me_cl))
                 return -EINVAL;
@@ -1283,7 +1290,8 @@ int mei_cl_irq_notify(struct mei_cl *cl, struct mei_cl_cb *cb,
  *
  * Return: 0 on such and error otherwise.
  */
-int mei_cl_notify_request(struct mei_cl *cl, struct file *file, u8 request)
+int mei_cl_notify_request(struct mei_cl *cl,
+                          const struct file *file, u8 request)
 {
         struct mei_device *dev;
         struct mei_cl_cb *cb;
@@ -1368,12 +1376,12 @@ void mei_cl_notify(struct mei_cl *cl)
 
         cl_dbg(dev, cl, "notify event");
         cl->notify_ev = true;
-        wake_up_interruptible_all(&cl->ev_wait);
+        if (!mei_cl_bus_notify_event(cl))
+                wake_up_interruptible(&cl->ev_wait);
 
         if (cl->ev_async)
                 kill_fasync(&cl->ev_async, SIGIO, POLL_PRI);
 
-        mei_cl_bus_notify_event(cl);
 }
 
 /**
@@ -1422,6 +1430,25 @@ out:
 }
 
 /**
+ * mei_cl_is_read_fc_cb - check if read cb is waiting for flow control
+ *                        for given host client
+ *
+ * @cl: host client
+ *
+ * Return: true, if found at least one cb.
+ */
+static bool mei_cl_is_read_fc_cb(struct mei_cl *cl)
+{
+        struct mei_device *dev = cl->dev;
+        struct mei_cl_cb *cb;
+
+        list_for_each_entry(cb, &dev->ctrl_wr_list.list, list)
+                if (cb->fop_type == MEI_FOP_READ && cb->cl == cl)
+                        return true;
+        return false;
+}
+
+/**
  * mei_cl_read_start - the start read client message function.
  *
  * @cl: host client
@@ -1430,7 +1457,7 @@ out:
  *
  * Return: 0 on success, <0 on failure.
  */
-int mei_cl_read_start(struct mei_cl *cl, size_t length, struct file *fp)
+int mei_cl_read_start(struct mei_cl *cl, size_t length, const struct file *fp)
 {
         struct mei_device *dev;
         struct mei_cl_cb *cb;
@@ -1445,7 +1472,7 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length, struct file *fp)
                 return -ENODEV;
 
         /* HW currently supports only one pending read */
-        if (!list_empty(&cl->rd_pending))
+        if (!list_empty(&cl->rd_pending) || mei_cl_is_read_fc_cb(cl))
                 return -EBUSY;
 
         if (!mei_me_cl_is_active(cl->me_cl)) {
@@ -1524,7 +1551,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
 
         first_chunk = cb->buf_idx == 0;
 
-        rets = first_chunk ? mei_cl_flow_ctrl_creds(cl) : 1;
+        rets = first_chunk ? mei_cl_flow_ctrl_creds(cl, cb->fp) : 1;
         if (rets < 0)
                 return rets;
 
@@ -1556,7 +1583,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
                 return 0;
         }
 
-        cl_dbg(dev, cl, "buf: size = %d idx = %lu\n",
+        cl_dbg(dev, cl, "buf: size = %zu idx = %zu\n",
                         cb->buf.size, cb->buf_idx);
 
         rets = mei_write_message(dev, &mei_hdr, buf->data + cb->buf_idx);
@@ -1618,7 +1645,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
         if (rets < 0 && rets != -EINPROGRESS) {
                 pm_runtime_put_noidle(dev->dev);
                 cl_err(dev, cl, "rpm: get failed %d\n", rets);
-                return rets;
+                goto free;
         }
 
         cb->buf_idx = 0;
@@ -1630,7 +1657,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
         mei_hdr.msg_complete = 0;
         mei_hdr.internal = cb->internal;
 
-        rets = mei_cl_flow_ctrl_creds(cl);
+        rets = mei_cl_flow_ctrl_creds(cl, cb->fp);
         if (rets < 0)
                 goto err;
 
@@ -1677,7 +1704,8 @@ out:
 
                 mutex_unlock(&dev->device_lock);
                 rets = wait_event_interruptible(cl->tx_wait,
-                                cl->writing_state == MEI_WRITE_COMPLETE);
+                                cl->writing_state == MEI_WRITE_COMPLETE ||
+                                (!mei_cl_is_connected(cl)));
                 mutex_lock(&dev->device_lock);
                 /* wait_event_interruptible returns -ERESTARTSYS */
                 if (rets) {
@@ -1685,6 +1713,10 @@ out:
                                 rets = -EINTR;
                         goto err;
                 }
+                if (cl->writing_state != MEI_WRITE_COMPLETE) {
+                        rets = -EFAULT;
+                        goto err;
+                }
         }
 
         rets = size;
@@ -1692,6 +1724,8 @@ err:
         cl_dbg(dev, cl, "rpm: autosuspend\n");
         pm_runtime_mark_last_busy(dev->dev);
         pm_runtime_put_autosuspend(dev->dev);
+free:
+        mei_io_cb_free(cb);
 
         return rets;
 }
@@ -1721,10 +1755,8 @@ void mei_cl_complete(struct mei_cl *cl, struct mei_cl_cb *cb)
 
         case MEI_FOP_READ:
                 list_add_tail(&cb->list, &cl->rd_completed);
-                if (waitqueue_active(&cl->rx_wait))
-                        wake_up_interruptible_all(&cl->rx_wait);
-                else
-                        mei_cl_bus_rx_event(cl);
+                if (!mei_cl_bus_rx_event(cl))
+                        wake_up_interruptible(&cl->rx_wait);
                 break;
 
         case MEI_FOP_CONNECT:
@@ -1753,44 +1785,3 @@ void mei_cl_all_disconnect(struct mei_device *dev)
         list_for_each_entry(cl, &dev->file_list, link)
                 mei_cl_set_disconnected(cl);
 }
-
-
-/**
- * mei_cl_all_wakeup  - wake up all readers and writers they can be interrupted
- *
- * @dev: mei device
- */
-void mei_cl_all_wakeup(struct mei_device *dev)
-{
-        struct mei_cl *cl;
-
-        list_for_each_entry(cl, &dev->file_list, link) {
-                if (waitqueue_active(&cl->rx_wait)) {
-                        cl_dbg(dev, cl, "Waking up reading client!\n");
-                        wake_up_interruptible(&cl->rx_wait);
-                }
-                if (waitqueue_active(&cl->tx_wait)) {
-                        cl_dbg(dev, cl, "Waking up writing client!\n");
-                        wake_up_interruptible(&cl->tx_wait);
-                }
-
-                /* synchronized under device mutex */
-                if (waitqueue_active(&cl->ev_wait)) {
-                        cl_dbg(dev, cl, "Waking up waiting for event clients!\n");
-                        wake_up_interruptible(&cl->ev_wait);
-                }
-        }
-}
-
-/**
- * mei_cl_all_write_clear - clear all pending writes
- *
- * @dev: mei device
- */
-void mei_cl_all_write_clear(struct mei_device *dev)
-{
-        mei_io_list_free(&dev->write_list, NULL);
-        mei_io_list_free(&dev->write_waiting_list, NULL);
-}
-
-
diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index 04e1aa39243f..0d7a3a1fef78 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -18,7 +18,6 @@
 #define _MEI_CLIENT_H_
 
 #include <linux/types.h>
-#include <linux/watchdog.h>
 #include <linux/poll.h>
 #include <linux/mei.h>
 
@@ -84,7 +83,7 @@ static inline u8 mei_me_cl_ver(const struct mei_me_client *me_cl)
  * MEI IO Functions
  */
 struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, enum mei_cb_file_ops type,
-                                 struct file *fp);
+                                 const struct file *fp);
 void mei_io_cb_free(struct mei_cl_cb *priv_cb);
 int mei_io_cb_alloc_buf(struct mei_cl_cb *cb, size_t length);
 
@@ -108,21 +107,19 @@ struct mei_cl *mei_cl_allocate(struct mei_device *dev);
 void mei_cl_init(struct mei_cl *cl, struct mei_device *dev);
 
 
-int mei_cl_link(struct mei_cl *cl, int id);
+int mei_cl_link(struct mei_cl *cl);
 int mei_cl_unlink(struct mei_cl *cl);
 
-struct mei_cl *mei_cl_alloc_linked(struct mei_device *dev, int id);
+struct mei_cl *mei_cl_alloc_linked(struct mei_device *dev);
 
 struct mei_cl_cb *mei_cl_read_cb(const struct mei_cl *cl,
                                  const struct file *fp);
 void mei_cl_read_cb_flush(const struct mei_cl *cl, const struct file *fp);
 struct mei_cl_cb *mei_cl_alloc_cb(struct mei_cl *cl, size_t length,
-                                  enum mei_cb_file_ops type, struct file *fp);
+                                  enum mei_cb_file_ops type,
+                                  const struct file *fp);
 int mei_cl_flush_queues(struct mei_cl *cl, const struct file *fp);
 
-int mei_cl_flow_ctrl_creds(struct mei_cl *cl);
-
-int mei_cl_flow_ctrl_reduce(struct mei_cl *cl);
 /*
  *  MEI input output function prototype
  */
@@ -217,10 +214,10 @@ void mei_cl_set_disconnected(struct mei_cl *cl);
 int mei_cl_irq_disconnect(struct mei_cl *cl, struct mei_cl_cb *cb,
                           struct mei_cl_cb *cmpl_list);
 int mei_cl_connect(struct mei_cl *cl, struct mei_me_client *me_cl,
-                   struct file *file);
+                   const struct file *file);
 int mei_cl_irq_connect(struct mei_cl *cl, struct mei_cl_cb *cb,
                               struct mei_cl_cb *cmpl_list);
-int mei_cl_read_start(struct mei_cl *cl, size_t length, struct file *fp);
+int mei_cl_read_start(struct mei_cl *cl, size_t length, const struct file *fp);
 int mei_cl_irq_read_msg(struct mei_cl *cl, struct mei_msg_hdr *hdr,
                         struct mei_cl_cb *cmpl_list);
 int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking);
@@ -229,19 +226,18 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
 
 void mei_cl_complete(struct mei_cl *cl, struct mei_cl_cb *cb);
 
-void mei_host_client_init(struct work_struct *work);
+void mei_host_client_init(struct mei_device *dev);
 
 u8 mei_cl_notify_fop2req(enum mei_cb_file_ops fop);
 enum mei_cb_file_ops mei_cl_notify_req2fop(u8 request);
-int mei_cl_notify_request(struct mei_cl *cl, struct file *file, u8 request);
+int mei_cl_notify_request(struct mei_cl *cl,
+                          const struct file *file, u8 request);
 int mei_cl_irq_notify(struct mei_cl *cl, struct mei_cl_cb *cb,
                       struct mei_cl_cb *cmpl_list);
 int mei_cl_notify_get(struct mei_cl *cl, bool block, bool *notify_ev);
 void mei_cl_notify(struct mei_cl *cl);
 
 void mei_cl_all_disconnect(struct mei_device *dev);
-void mei_cl_all_wakeup(struct mei_device *dev);
-void mei_cl_all_write_clear(struct mei_device *dev);
 
 #define MEI_CL_FMT "cl:host=%02d me=%02d "
 #define MEI_CL_PRM(cl) (cl)->host_client_id, mei_cl_me_id(cl)
@@ -249,6 +245,9 @@ void mei_cl_all_write_clear(struct mei_device *dev);
 #define cl_dbg(dev, cl, format, arg...) \
         dev_dbg((dev)->dev, MEI_CL_FMT format, MEI_CL_PRM(cl), ##arg)
 
+#define cl_warn(dev, cl, format, arg...) \
+        dev_warn((dev)->dev, MEI_CL_FMT format, MEI_CL_PRM(cl), ##arg)
+
 #define cl_err(dev, cl, format, arg...) \
         dev_err((dev)->dev, MEI_CL_FMT format, MEI_CL_PRM(cl), ##arg)
 
diff --git a/drivers/misc/mei/debugfs.c b/drivers/misc/mei/debugfs.c
index a138d8a27ab5..c6c051b52f55 100644
--- a/drivers/misc/mei/debugfs.c
+++ b/drivers/misc/mei/debugfs.c
@@ -50,6 +50,7 @@ static ssize_t mei_dbgfs_read_meclients(struct file *fp, char __user *ubuf,
         }
 
         pos += scnprintf(buf + pos, bufsz - pos, HDR);
+#undef HDR
 
         /*  if the driver is not enabled the list won't be consistent */
         if (dev->dev_state != MEI_DEV_ENABLED)
@@ -90,23 +91,37 @@ static ssize_t mei_dbgfs_read_active(struct file *fp, char __user *ubuf,
 {
         struct mei_device *dev = fp->private_data;
         struct mei_cl *cl;
-        const size_t bufsz = 1024;
+        size_t bufsz = 1;
         char *buf;
         int i = 0;
         int pos = 0;
         int ret;
 
+#define HDR "   |me|host|state|rd|wr|\n"
+
         if (!dev)
                 return -ENODEV;
 
+        mutex_lock(&dev->device_lock);
+
+        /*
+         * if the driver is not enabled the list won't be consistent,
+         * we output empty table
+         */
+        if (dev->dev_state == MEI_DEV_ENABLED)
+                list_for_each_entry(cl, &dev->file_list, link)
+                        bufsz++;
+
+        bufsz *= sizeof(HDR) + 1;
+
         buf = kzalloc(bufsz, GFP_KERNEL);
-        if  (!buf)
+        if  (!buf) {
+                mutex_unlock(&dev->device_lock);
                 return -ENOMEM;
+        }
 
-        pos += scnprintf(buf + pos, bufsz - pos,
-                        "  |me|host|state|rd|wr|\n");
-
-        mutex_lock(&dev->device_lock);
+        pos += scnprintf(buf + pos, bufsz - pos, HDR);
+#undef HDR
 
         /*  if the driver is not enabled the list won't be consistent */
         if (dev->dev_state != MEI_DEV_ENABLED)
@@ -115,7 +130,7 @@ static ssize_t mei_dbgfs_read_active(struct file *fp, char __user *ubuf,
         list_for_each_entry(cl, &dev->file_list, link) {
 
                 pos += scnprintf(buf + pos, bufsz - pos,
-                        "%2d|%2d|%4d|%5d|%2d|%2d|\n",
+                        "%3d|%2d|%4d|%5d|%2d|%2d|\n",
                         i, mei_cl_me_id(cl), cl->host_client_id, cl->state,
                         !list_empty(&cl->rd_completed), cl->writing_state);
                 i++;
@@ -150,16 +165,21 @@ static ssize_t mei_dbgfs_read_devstate(struct file *fp, char __user *ubuf,
         pos += scnprintf(buf + pos, bufsz - pos, "hbm: %s\n",
                         mei_hbm_state_str(dev->hbm_state));
 
-        if (dev->hbm_state == MEI_HBM_STARTED) {
+        if (dev->hbm_state >= MEI_HBM_ENUM_CLIENTS &&
+            dev->hbm_state <= MEI_HBM_STARTED) {
                 pos += scnprintf(buf + pos, bufsz - pos, "hbm features:\n");
                 pos += scnprintf(buf + pos, bufsz - pos, "\tPG: %01d\n",
                                  dev->hbm_f_pg_supported);
                 pos += scnprintf(buf + pos, bufsz - pos, "\tDC: %01d\n",
                                  dev->hbm_f_dc_supported);
+                pos += scnprintf(buf + pos, bufsz - pos, "\tIE: %01d\n",
+                                 dev->hbm_f_ie_supported);
                 pos += scnprintf(buf + pos, bufsz - pos, "\tDOT: %01d\n",
                                  dev->hbm_f_dot_supported);
                 pos += scnprintf(buf + pos, bufsz - pos, "\tEV: %01d\n",
                                  dev->hbm_f_ev_supported);
+                pos += scnprintf(buf + pos, bufsz - pos, "\tFA: %01d\n",
+                                 dev->hbm_f_fa_supported);
         }
 
         pos += scnprintf(buf + pos, bufsz - pos, "pg:  %s, %s\n",
@@ -175,6 +195,30 @@ static const struct file_operations mei_dbgfs_fops_devstate = {
         .llseek = generic_file_llseek,
 };
 
+static ssize_t mei_dbgfs_write_allow_fa(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct mei_device *dev;
+        int ret;
+
+        dev = container_of(file->private_data,
+                           struct mei_device, allow_fixed_address);
+
+        ret = debugfs_write_file_bool(file, user_buf, count, ppos);
+        if (ret < 0)
+                return ret;
+        dev->override_fixed_address = true;
+        return ret;
+}
+
+static const struct file_operations mei_dbgfs_fops_allow_fa = {
+        .open = simple_open,
+        .read = debugfs_read_file_bool,
+        .write = mei_dbgfs_write_allow_fa,
+        .llseek = generic_file_llseek,
+};
+
 /**
  * mei_dbgfs_deregister - Remove the debugfs files and directories
  *
@@ -224,8 +268,9 @@ int mei_dbgfs_register(struct mei_device *dev, const char *name)
                 dev_err(dev->dev, "devstate: registration failed\n");
                 goto err;
         }
-        f = debugfs_create_bool("allow_fixed_address", S_IRUSR | S_IWUSR, dir,
-                                &dev->allow_fixed_address);
+        f = debugfs_create_file("allow_fixed_address", S_IRUSR | S_IWUSR, dir,
+                                &dev->allow_fixed_address,
+                                &mei_dbgfs_fops_allow_fa);
         if (!f) {
                 dev_err(dev->dev, "allow_fixed_address: registration failed\n");
                 goto err;
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index e7b7aad0999b..5e305d2605f3 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -301,7 +301,10 @@ static int mei_hbm_enum_clients_req(struct mei_device *dev)
         enum_req = (struct hbm_host_enum_request *)dev->wr_msg.data;
         memset(enum_req, 0, len);
         enum_req->hbm_cmd = HOST_ENUM_REQ_CMD;
-        enum_req->allow_add = dev->hbm_f_dc_supported;
+        enum_req->flags |= dev->hbm_f_dc_supported ?
+                           MEI_HBM_ENUM_F_ALLOW_ADD : 0;
+        enum_req->flags |= dev->hbm_f_ie_supported ?
+                           MEI_HBM_ENUM_F_IMMEDIATE_ENUM : 0;
 
         ret = mei_write_message(dev, mei_hdr, dev->wr_msg.data);
         if (ret) {
@@ -401,6 +404,9 @@ static int mei_hbm_fw_add_cl_req(struct mei_device *dev,
         if (ret)
                 status = !MEI_HBMS_SUCCESS;
 
+        if (dev->dev_state == MEI_DEV_ENABLED)
+                schedule_work(&dev->bus_rescan_work);
+
         return mei_hbm_add_cl_resp(dev, req->me_addr, status);
 }
 
@@ -543,7 +549,7 @@ static int mei_hbm_prop_req(struct mei_device *dev)
         /* We got all client properties */
         if (next_client_index == MEI_CLIENTS_MAX) {
                 dev->hbm_state = MEI_HBM_STARTED;
-                schedule_work(&dev->init_work);
+                mei_host_client_init(dev);
 
                 return 0;
         }
@@ -789,8 +795,11 @@ static void mei_hbm_cl_connect_res(struct mei_device *dev, struct mei_cl *cl,
                 cl->state = MEI_FILE_CONNECTED;
         else {
                 cl->state = MEI_FILE_DISCONNECT_REPLY;
-                if (rs->status == MEI_CL_CONN_NOT_FOUND)
+                if (rs->status == MEI_CL_CONN_NOT_FOUND) {
                         mei_me_cl_del(dev, cl->me_cl);
+                        if (dev->dev_state == MEI_DEV_ENABLED)
+                                schedule_work(&dev->bus_rescan_work);
+                }
         }
         cl->status = mei_cl_conn_status_to_errno(rs->status);
 }
@@ -866,7 +875,7 @@ static int mei_hbm_fw_disconnect_req(struct mei_device *dev,
 
         cl = mei_hbm_cl_find_by_cmd(dev, disconnect_req);
         if (cl) {
-                cl_dbg(dev, cl, "fw disconnect request received\n");
+                cl_warn(dev, cl, "fw disconnect request received\n");
                 cl->state = MEI_FILE_DISCONNECTING;
                 cl->timer_count = 0;
 
@@ -972,6 +981,9 @@ static void mei_hbm_config_features(struct mei_device *dev)
         if (dev->version.major_version >= HBM_MAJOR_VERSION_DC)
                 dev->hbm_f_dc_supported = 1;
 
+        if (dev->version.major_version >= HBM_MAJOR_VERSION_IE)
+                dev->hbm_f_ie_supported = 1;
+
         /* disconnect on connect timeout instead of link reset */
         if (dev->version.major_version >= HBM_MAJOR_VERSION_DOT)
                 dev->hbm_f_dot_supported = 1;
@@ -979,6 +991,10 @@ static void mei_hbm_config_features(struct mei_device *dev)
         /* Notification Event Support */
         if (dev->version.major_version >= HBM_MAJOR_VERSION_EV)
                 dev->hbm_f_ev_supported = 1;
+
+        /* Fixed Address Client Support */
+        if (dev->version.major_version >= HBM_MAJOR_VERSION_FA)
+                dev->hbm_f_fa_supported = 1;
 }
 
 /**
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index 25b1997a62cb..e2fb44cc5c37 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -189,8 +189,11 @@ static int mei_me_fw_status(struct mei_device *dev,
 
         fw_status->count = fw_src->count;
         for (i = 0; i < fw_src->count && i < MEI_FW_STATUS_MAX; i++) {
-                ret = pci_read_config_dword(pdev,
-                        fw_src->status[i], &fw_status->status[i]);
+                ret = pci_read_config_dword(pdev, fw_src->status[i],
+                                            &fw_status->status[i]);
+                trace_mei_pci_cfg_read(dev->dev, "PCI_CFG_HSF_X",
+                                       fw_src->status[i],
+                                       fw_status->status[i]);
                 if (ret)
                         return ret;
         }
@@ -215,6 +218,7 @@ static void mei_me_hw_config(struct mei_device *dev)
 
         reg = 0;
         pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
+        trace_mei_pci_cfg_read(dev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg);
         hw->d0i3_supported =
                 ((reg & PCI_CFG_HFS_1_D0I3_MSK) == PCI_CFG_HFS_1_D0I3_MSK);
 
@@ -1248,6 +1252,7 @@ static bool mei_me_fw_type_nm(struct pci_dev *pdev)
         u32 reg;
 
         pci_read_config_dword(pdev, PCI_CFG_HFS_2, &reg);
+        trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_2", PCI_CFG_HFS_2, reg);
         /* make sure that bit 9 (NM) is up and bit 10 (DM) is down */
         return (reg & 0x600) == 0x200;
 }
@@ -1260,6 +1265,7 @@ static bool mei_me_fw_type_sps(struct pci_dev *pdev)
         u32 reg;
         /* Read ME FW Status check for SPS Firmware */
         pci_read_config_dword(pdev, PCI_CFG_HFS_1, &reg);
+        trace_mei_pci_cfg_read(&pdev->dev, "PCI_CFG_HFS_1", PCI_CFG_HFS_1, reg);
         /* if bits [19:16] = 15, running SPS Firmware */
         return (reg & 0xf0000) == 0xf0000;
 }
diff --git a/drivers/misc/mei/hw-txe.c b/drivers/misc/mei/hw-txe.c
index bae680c648ff..4a6c1b85f11e 100644
--- a/drivers/misc/mei/hw-txe.c
+++ b/drivers/misc/mei/hw-txe.c
@@ -28,6 +28,9 @@
 #include "client.h"
 #include "hbm.h"
 
+#include "mei-trace.h"
+
+
 /**
  * mei_txe_reg_read - Reads 32bit data from the txe device
  *
@@ -640,8 +643,11 @@ static int mei_txe_fw_status(struct mei_device *dev,
 
         fw_status->count = fw_src->count;
         for (i = 0; i < fw_src->count && i < MEI_FW_STATUS_MAX; i++) {
-                ret = pci_read_config_dword(pdev,
-                        fw_src->status[i], &fw_status->status[i]);
+                ret = pci_read_config_dword(pdev, fw_src->status[i],
+                                            &fw_status->status[i]);
+                trace_mei_pci_cfg_read(dev->dev, "PCI_CFG_HSF_X",
+                                       fw_src->status[i],
+                                       fw_status->status[i]);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/misc/mei/hw.h b/drivers/misc/mei/hw.h
index 4cebde85924f..9daf3f9aed25 100644
--- a/drivers/misc/mei/hw.h
+++ b/drivers/misc/mei/hw.h
@@ -29,7 +29,6 @@
 #define MEI_CLIENTS_INIT_TIMEOUT   15  /* HPS: Clients Enumeration Timeout */
 
 #define MEI_IAMTHIF_STALL_TIMER    12  /* HPS */
-#define MEI_IAMTHIF_READ_TIMER     10  /* HPS */
 
 #define MEI_PGI_TIMEOUT             1  /* PG Isolation time response 1 sec */
 #define MEI_D0I3_TIMEOUT            5  /* D0i3 set/unset max response time */
@@ -54,6 +53,12 @@
 #define HBM_MAJOR_VERSION_DC               2
 
 /*
+ * MEI version with immediate reply to enum request support
+ */
+#define HBM_MINOR_VERSION_IE               0
+#define HBM_MAJOR_VERSION_IE               2
+
+/*
  * MEI version with disconnect on connection timeout support
  */
 #define HBM_MINOR_VERSION_DOT              0
@@ -65,6 +70,12 @@
 #define HBM_MINOR_VERSION_EV               0
 #define HBM_MAJOR_VERSION_EV               2
 
+/*
+ * MEI version with fixed address client support
+ */
+#define HBM_MINOR_VERSION_FA               0
+#define HBM_MAJOR_VERSION_FA               2
+
 /* Host bus message command opcode */
 #define MEI_HBM_CMD_OP_MSK                  0x7f
 /* Host bus message command RESPONSE */
@@ -241,15 +252,26 @@ struct hbm_me_stop_request {
 } __packed;
 
 /**
- * struct hbm_host_enum_request -  enumeration request from host to fw
+ * enum hbm_host_enum_flags - enumeration request flags (HBM version >= 2.0)
  *
- * @hbm_cmd: bus message command header
- * @allow_add: allow dynamic clients add HBM version >= 2.0
+ * @MEI_HBM_ENUM_F_ALLOW_ADD: allow dynamic clients add
+ * @MEI_HBM_ENUM_F_IMMEDIATE_ENUM: allow FW to send answer immediately
+ */
+enum hbm_host_enum_flags {
+        MEI_HBM_ENUM_F_ALLOW_ADD = BIT(0),
+        MEI_HBM_ENUM_F_IMMEDIATE_ENUM = BIT(1),
+};
+
+/**
+ * struct hbm_host_enum_request - enumeration request from host to fw
+ *
+ * @hbm_cmd : bus message command header
+ * @flags   : request flags
  * @reserved: reserved
  */
 struct hbm_host_enum_request {
         u8 hbm_cmd;
-        u8 allow_add;
+        u8 flags;
         u8 reserved[2];
 } __packed;
 
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 3edafc8d3ad4..f7c8dfdb6a12 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -91,8 +91,8 @@ EXPORT_SYMBOL_GPL(mei_fw_status2str);
  */
 void mei_cancel_work(struct mei_device *dev)
 {
-        cancel_work_sync(&dev->init_work);
         cancel_work_sync(&dev->reset_work);
+        cancel_work_sync(&dev->bus_rescan_work);
 
         cancel_delayed_work(&dev->timer_work);
 }
@@ -148,16 +148,10 @@ int mei_reset(struct mei_device *dev)
             state != MEI_DEV_POWER_UP) {
 
                 /* remove all waiting requests */
-                mei_cl_all_write_clear(dev);
-
                 mei_cl_all_disconnect(dev);
 
-                /* wake up all readers and writers so they can be interrupted */
-                mei_cl_all_wakeup(dev);
-
                 /* remove entry if already in list */
-                dev_dbg(dev->dev, "remove iamthif and wd from the file list.\n");
-                mei_cl_unlink(&dev->wd_cl);
+                dev_dbg(dev->dev, "remove iamthif from the file list.\n");
                 mei_cl_unlink(&dev->iamthif_cl);
                 mei_amthif_reset_params(dev);
         }
@@ -165,7 +159,6 @@ int mei_reset(struct mei_device *dev)
         mei_hbm_reset(dev);
 
         dev->rd_msg_hdr = 0;
-        dev->wd_pending = false;
 
         if (ret) {
                 dev_err(dev->dev, "hw_reset failed ret = %d\n", ret);
@@ -335,16 +328,12 @@ void mei_stop(struct mei_device *dev)
 
         mutex_lock(&dev->device_lock);
 
-        mei_wd_stop(dev);
-
         dev->dev_state = MEI_DEV_POWER_DOWN;
         mei_reset(dev);
         /* move device to disabled state unconditionally */
         dev->dev_state = MEI_DEV_DISABLED;
 
         mutex_unlock(&dev->device_lock);
-
-        mei_watchdog_unregister(dev);
 }
 EXPORT_SYMBOL_GPL(mei_stop);
 
@@ -394,7 +383,6 @@ void mei_device_init(struct mei_device *dev,
         init_waitqueue_head(&dev->wait_hw_ready);
         init_waitqueue_head(&dev->wait_pg);
         init_waitqueue_head(&dev->wait_hbm_start);
-        init_waitqueue_head(&dev->wait_stop_wd);
         dev->dev_state = MEI_DEV_INITIALIZING;
         dev->reset_count = 0;
 
@@ -404,13 +392,11 @@ void mei_device_init(struct mei_device *dev,
         mei_io_list_init(&dev->ctrl_rd_list);
 
         INIT_DELAYED_WORK(&dev->timer_work, mei_timer);
-        INIT_WORK(&dev->init_work, mei_host_client_init);
         INIT_WORK(&dev->reset_work, mei_reset_work);
+        INIT_WORK(&dev->bus_rescan_work, mei_cl_bus_rescan_work);
 
-        INIT_LIST_HEAD(&dev->wd_cl.link);
         INIT_LIST_HEAD(&dev->iamthif_cl.link);
         mei_io_list_init(&dev->amthif_cmd_list);
-        mei_io_list_init(&dev->amthif_rd_complete_list);
 
         bitmap_zero(dev->host_clients_map, MEI_CLIENTS_MAX);
         dev->open_handle_count = 0;
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 64b568a0268d..1e5cb1f704f8 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -48,7 +48,7 @@ void mei_irq_compl_handler(struct mei_device *dev, struct mei_cl_cb *compl_list)
 
                 dev_dbg(dev->dev, "completing call back.\n");
                 if (cl == &dev->iamthif_cl)
-                        mei_amthif_complete(dev, cb);
+                        mei_amthif_complete(cl, cb);
                 else
                         mei_cl_complete(cl, cb);
         }
@@ -104,6 +104,7 @@ int mei_cl_irq_read_msg(struct mei_cl *cl,
         struct mei_device *dev = cl->dev;
         struct mei_cl_cb *cb;
         unsigned char *buffer = NULL;
+        size_t buf_sz;
 
         cb = list_first_entry_or_null(&cl->rd_pending, struct mei_cl_cb, list);
         if (!cb) {
@@ -124,11 +125,21 @@ int mei_cl_irq_read_msg(struct mei_cl *cl,
                 goto out;
         }
 
-        if (cb->buf.size < mei_hdr->length + cb->buf_idx) {
-                cl_dbg(dev, cl, "message overflow. size %d len %d idx %ld\n",
+        buf_sz = mei_hdr->length + cb->buf_idx;
+        /* catch for integer overflow */
+        if (buf_sz < cb->buf_idx) {
+                cl_err(dev, cl, "message is too big len %d idx %zu\n",
+                       mei_hdr->length, cb->buf_idx);
+
+                list_move_tail(&cb->list, &complete_list->list);
+                cb->status = -EMSGSIZE;
+                goto out;
+        }
+
+        if (cb->buf.size < buf_sz) {
+                cl_dbg(dev, cl, "message overflow. size %zu len %d idx %zu\n",
                         cb->buf.size, mei_hdr->length, cb->buf_idx);
-                buffer = krealloc(cb->buf.data, mei_hdr->length + cb->buf_idx,
-                                  GFP_KERNEL);
+                buffer = krealloc(cb->buf.data, buf_sz, GFP_KERNEL);
 
                 if (!buffer) {
                         cb->status = -ENOMEM;
@@ -136,7 +147,7 @@ int mei_cl_irq_read_msg(struct mei_cl *cl,
                         goto out;
                 }
                 cb->buf.data = buffer;
-                cb->buf.size = mei_hdr->length + cb->buf_idx;
+                cb->buf.size = buf_sz;
         }
 
         buffer = cb->buf.data + cb->buf_idx;
@@ -145,8 +156,7 @@ int mei_cl_irq_read_msg(struct mei_cl *cl,
         cb->buf_idx += mei_hdr->length;
 
         if (mei_hdr->msg_complete) {
-                cb->read_time = jiffies;
-                cl_dbg(dev, cl, "completed read length = %lu\n", cb->buf_idx);
+                cl_dbg(dev, cl, "completed read length = %zu\n", cb->buf_idx);
                 list_move_tail(&cb->list, &complete_list->list);
         } else {
                 pm_runtime_mark_last_busy(dev->dev);
@@ -229,6 +239,16 @@ static int mei_cl_irq_read(struct mei_cl *cl, struct mei_cl_cb *cb,
         return 0;
 }
 
+static inline bool hdr_is_hbm(struct mei_msg_hdr *mei_hdr)
+{
+        return mei_hdr->host_addr == 0 && mei_hdr->me_addr == 0;
+}
+
+static inline bool hdr_is_fixed(struct mei_msg_hdr *mei_hdr)
+{
+        return mei_hdr->host_addr == 0 && mei_hdr->me_addr != 0;
+}
+
 /**
  * mei_irq_read_handler - bottom half read routine after ISR to
  * handle the read processing.
@@ -270,7 +290,7 @@ int mei_irq_read_handler(struct mei_device *dev,
         }
 
         /*  HBM message */
-        if (mei_hdr->host_addr == 0 && mei_hdr->me_addr == 0) {
+        if (hdr_is_hbm(mei_hdr)) {
                 ret = mei_hbm_dispatch(dev, mei_hdr);
                 if (ret) {
                         dev_dbg(dev->dev, "mei_hbm_dispatch failed ret = %d\n",
@@ -290,6 +310,14 @@ int mei_irq_read_handler(struct mei_device *dev,
 
         /* if no recipient cl was found we assume corrupted header */
         if (&cl->link == &dev->file_list) {
+                /* A message for not connected fixed address clients
+                 * should be silently discarded
+                 */
+                if (hdr_is_fixed(mei_hdr)) {
+                        mei_irq_discard_msg(dev, mei_hdr);
+                        ret = 0;
+                        goto reset_slots;
+                }
                 dev_err(dev->dev, "no destination client found 0x%08X\n",
                                 dev->rd_msg_hdr);
                 ret = -EBADMSG;
@@ -360,21 +388,6 @@ int mei_irq_write_handler(struct mei_device *dev, struct mei_cl_cb *cmpl_list)
                 list_move_tail(&cb->list, &cmpl_list->list);
         }
 
-        if (dev->wd_state == MEI_WD_STOPPING) {
-                dev->wd_state = MEI_WD_IDLE;
-                wake_up(&dev->wait_stop_wd);
-        }
-
-        if (mei_cl_is_connected(&dev->wd_cl)) {
-                if (dev->wd_pending &&
-                    mei_cl_flow_ctrl_creds(&dev->wd_cl) > 0) {
-                        ret = mei_wd_send(dev);
-                        if (ret)
-                                return ret;
-                        dev->wd_pending = false;
-                }
-        }
-
         /* complete control write list CB */
         dev_dbg(dev->dev, "complete control write list cb.\n");
         list_for_each_entry_safe(cb, next, &dev->ctrl_wr_list.list, list) {
@@ -462,7 +475,6 @@ static void mei_connect_timeout(struct mei_cl *cl)
  */
 void mei_timer(struct work_struct *work)
 {
-        unsigned long timeout;
         struct mei_cl *cl;
 
         struct mei_device *dev = container_of(work,
@@ -508,45 +520,15 @@ void mei_timer(struct work_struct *work)
                         mei_reset(dev);
                         dev->iamthif_canceled = false;
                         dev->iamthif_state = MEI_IAMTHIF_IDLE;
-                        dev->iamthif_timer = 0;
 
                         mei_io_cb_free(dev->iamthif_current_cb);
                         dev->iamthif_current_cb = NULL;
 
-                        dev->iamthif_file_object = NULL;
+                        dev->iamthif_fp = NULL;
                         mei_amthif_run_next_cmd(dev);
                 }
         }
 
-        if (dev->iamthif_timer) {
-
-                timeout = dev->iamthif_timer +
-                        mei_secs_to_jiffies(MEI_IAMTHIF_READ_TIMER);
-
-                dev_dbg(dev->dev, "dev->iamthif_timer = %ld\n",
-                                dev->iamthif_timer);
-                dev_dbg(dev->dev, "timeout = %ld\n", timeout);
-                dev_dbg(dev->dev, "jiffies = %ld\n", jiffies);
-                if (time_after(jiffies, timeout)) {
-                        /*
-                         * User didn't read the AMTHI data on time (15sec)
-                         * freeing AMTHI for other requests
-                         */
-
-                        dev_dbg(dev->dev, "freeing AMTHI for other requests\n");
-
-                        mei_io_list_flush(&dev->amthif_rd_complete_list,
-                                &dev->iamthif_cl);
-                        mei_io_cb_free(dev->iamthif_current_cb);
-                        dev->iamthif_current_cb = NULL;
-
-                        dev->iamthif_file_object->private_data = NULL;
-                        dev->iamthif_file_object = NULL;
-                        dev->iamthif_timer = 0;
-                        mei_amthif_run_next_cmd(dev);
-
-                }
-        }
 out:
         if (dev->dev_state != MEI_DEV_DISABLED)
                 schedule_delayed_work(&dev->timer_work, 2 * HZ);
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 677d0362f334..52635b063873 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -65,7 +65,7 @@ static int mei_open(struct inode *inode, struct file *file)
                 goto err_unlock;
         }
 
-        cl = mei_cl_alloc_linked(dev, MEI_HOST_CLIENT_ID_ANY);
+        cl = mei_cl_alloc_linked(dev);
         if (IS_ERR(cl)) {
                 err = PTR_ERR(cl);
                 goto err_unlock;
@@ -159,27 +159,22 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                 goto out;
         }
 
+        if (ubuf == NULL) {
+                rets = -EMSGSIZE;
+                goto out;
+        }
+
         if (cl == &dev->iamthif_cl) {
                 rets = mei_amthif_read(dev, file, ubuf, length, offset);
                 goto out;
         }
 
         cb = mei_cl_read_cb(cl, file);
-        if (cb) {
-                /* read what left */
-                if (cb->buf_idx > *offset)
-                        goto copy_buffer;
-                /* offset is beyond buf_idx we have no more data return 0 */
-                if (cb->buf_idx > 0 && cb->buf_idx <= *offset) {
-                        rets = 0;
-                        goto free;
-                }
-                /* Offset needs to be cleaned for contiguous reads*/
-                if (cb->buf_idx == 0 && *offset > 0)
-                        *offset = 0;
-        } else if (*offset > 0) {
+        if (cb)
+                goto copy_buffer;
+
+        if (*offset > 0)
                 *offset = 0;
-        }
 
         err = mei_cl_read_start(cl, length, file);
         if (err && err != -EBUSY) {
@@ -214,11 +209,6 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
 
         cb = mei_cl_read_cb(cl, file);
         if (!cb) {
-                if (mei_cl_is_fixed_address(cl) && dev->allow_fixed_address) {
-                        cb = mei_cl_read_cb(cl, NULL);
-                        if (cb)
-                                goto copy_buffer;
-                }
                 rets = 0;
                 goto out;
         }
@@ -231,10 +221,10 @@ copy_buffer:
                 goto free;
         }
 
-        cl_dbg(dev, cl, "buf.size = %d buf.idx = %ld\n",
-            cb->buf.size, cb->buf_idx);
-        if (length == 0 || ubuf == NULL || *offset > cb->buf_idx) {
-                rets = -EMSGSIZE;
+        cl_dbg(dev, cl, "buf.size = %zu buf.idx = %zu offset = %lld\n",
+               cb->buf.size, cb->buf_idx, *offset);
+        if (*offset >= cb->buf_idx) {
+                rets = 0;
                 goto free;
         }
 
@@ -250,11 +240,13 @@ copy_buffer:
 
         rets = length;
         *offset += length;
-        if ((unsigned long)*offset < cb->buf_idx)
+        /* not all data was read, keep the cb */
+        if (*offset < cb->buf_idx)
                 goto out;
 
 free:
         mei_io_cb_free(cb);
+        *offset = 0;
 
 out:
         cl_dbg(dev, cl, "end mei read rets = %d\n", rets);
@@ -275,9 +267,8 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
                          size_t length, loff_t *offset)
 {
         struct mei_cl *cl = file->private_data;
-        struct mei_cl_cb *write_cb = NULL;
+        struct mei_cl_cb *cb;
         struct mei_device *dev;
-        unsigned long timeout = 0;
         int rets;
 
         if (WARN_ON(!cl || !cl->dev))
@@ -313,52 +304,31 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
                 goto out;
         }
 
-        if (cl == &dev->iamthif_cl) {
-                write_cb = mei_amthif_find_read_list_entry(dev, file);
-
-                if (write_cb) {
-                        timeout = write_cb->read_time +
-                                mei_secs_to_jiffies(MEI_IAMTHIF_READ_TIMER);
-
-                        if (time_after(jiffies, timeout)) {
-                                *offset = 0;
-                                mei_io_cb_free(write_cb);
-                                write_cb = NULL;
-                        }
-                }
-        }
-
         *offset = 0;
-        write_cb = mei_cl_alloc_cb(cl, length, MEI_FOP_WRITE, file);
-        if (!write_cb) {
+        cb = mei_cl_alloc_cb(cl, length, MEI_FOP_WRITE, file);
+        if (!cb) {
                 rets = -ENOMEM;
                 goto out;
         }
 
-        rets = copy_from_user(write_cb->buf.data, ubuf, length);
+        rets = copy_from_user(cb->buf.data, ubuf, length);
         if (rets) {
                 dev_dbg(dev->dev, "failed to copy data from userland\n");
                 rets = -EFAULT;
+                mei_io_cb_free(cb);
                 goto out;
         }
 
         if (cl == &dev->iamthif_cl) {
-                rets = mei_amthif_write(cl, write_cb);
-
-                if (rets) {
-                        dev_err(dev->dev,
-                                "amthif write failed with status = %d\n", rets);
-                        goto out;
-                }
-                mutex_unlock(&dev->device_lock);
-                return length;
+                rets = mei_amthif_write(cl, cb);
+                if (!rets)
+                        rets = length;
+                goto out;
         }
 
-        rets = mei_cl_write(cl, write_cb, false);
+        rets = mei_cl_write(cl, cb, false);
 out:
         mutex_unlock(&dev->device_lock);
-        if (rets < 0)
-                mei_io_cb_free(write_cb);
         return rets;
 }
 
@@ -393,12 +363,22 @@ static int mei_ioctl_connect_client(struct file *file,
 
         /* find ME client we're trying to connect to */
         me_cl = mei_me_cl_by_uuid(dev, &data->in_client_uuid);
-        if (!me_cl ||
-            (me_cl->props.fixed_address && !dev->allow_fixed_address)) {
+        if (!me_cl) {
                 dev_dbg(dev->dev, "Cannot connect to FW Client UUID = %pUl\n",
                         &data->in_client_uuid);
-                mei_me_cl_put(me_cl);
-                return  -ENOTTY;
+                rets = -ENOTTY;
+                goto end;
+        }
+
+        if (me_cl->props.fixed_address) {
+                bool forbidden = dev->override_fixed_address ?
+                         !dev->allow_fixed_address : !dev->hbm_f_fa_supported;
+                if (forbidden) {
+                        dev_dbg(dev->dev, "Connection forbidden to FW Client UUID = %pUl\n",
+                                &data->in_client_uuid);
+                        rets = -ENOTTY;
+                        goto end;
+                }
         }
 
         dev_dbg(dev->dev, "Connect to FW Client ID = %d\n",
@@ -454,11 +434,15 @@ end:
  *
  * Return: 0 on success , <0 on error
  */
-static int mei_ioctl_client_notify_request(struct file *file, u32 request)
+static int mei_ioctl_client_notify_request(const struct file *file, u32 request)
 {
         struct mei_cl *cl = file->private_data;
 
-        return mei_cl_notify_request(cl, file, request);
+        if (request != MEI_HBM_NOTIFICATION_START &&
+            request != MEI_HBM_NOTIFICATION_STOP)
+                return -EINVAL;
+
+        return mei_cl_notify_request(cl, file, (u8)request);
 }
 
 /**
@@ -469,7 +453,7 @@ static int mei_ioctl_client_notify_request(struct file *file, u32 request)
  *
  * Return: 0 on success , <0 on error
  */
-static int mei_ioctl_client_notify_get(struct file *file, u32 *notify_get)
+static int mei_ioctl_client_notify_get(const struct file *file, u32 *notify_get)
 {
         struct mei_cl *cl = file->private_data;
         bool notify_ev;
diff --git a/drivers/misc/mei/mei-trace.c b/drivers/misc/mei/mei-trace.c
index 388efb519138..e19e6acb191b 100644
--- a/drivers/misc/mei/mei-trace.c
+++ b/drivers/misc/mei/mei-trace.c
@@ -22,4 +22,6 @@
 
 EXPORT_TRACEPOINT_SYMBOL(mei_reg_read);
 EXPORT_TRACEPOINT_SYMBOL(mei_reg_write);
+EXPORT_TRACEPOINT_SYMBOL(mei_pci_cfg_read);
+EXPORT_TRACEPOINT_SYMBOL(mei_pci_cfg_write);
 #endif /* __CHECKER__ */
diff --git a/drivers/misc/mei/mei-trace.h b/drivers/misc/mei/mei-trace.h
index 47e1bc6551d4..7d2d5d4a1624 100644
--- a/drivers/misc/mei/mei-trace.h
+++ b/drivers/misc/mei/mei-trace.h
@@ -60,7 +60,45 @@ TRACE_EVENT(mei_reg_write,
                 __entry->offs = offs;
                 __entry->val = val;
         ),
-        TP_printk("[%s] write %s[%#x] = %#x)",
+        TP_printk("[%s] write %s[%#x] = %#x",
+                  __get_str(dev), __entry->reg,  __entry->offs, __entry->val)
+);
+
+TRACE_EVENT(mei_pci_cfg_read,
+        TP_PROTO(const struct device *dev, const char *reg, u32 offs, u32 val),
+        TP_ARGS(dev, reg, offs, val),
+        TP_STRUCT__entry(
+                __string(dev, dev_name(dev))
+                __field(const char *, reg)
+                __field(u32, offs)
+                __field(u32, val)
+        ),
+        TP_fast_assign(
+                __assign_str(dev, dev_name(dev))
+                __entry->reg  = reg;
+                __entry->offs = offs;
+                __entry->val = val;
+        ),
+        TP_printk("[%s] pci cfg read %s:[%#x] = %#x",
+                  __get_str(dev), __entry->reg, __entry->offs, __entry->val)
+);
+
+TRACE_EVENT(mei_pci_cfg_write,
+        TP_PROTO(const struct device *dev, const char *reg, u32 offs, u32 val),
+        TP_ARGS(dev, reg, offs, val),
+        TP_STRUCT__entry(
+                __string(dev, dev_name(dev))
+                __field(const char *, reg)
+                __field(u32, offs)
+                __field(u32, val)
+        ),
+        TP_fast_assign(
+                __assign_str(dev, dev_name(dev))
+                __entry->reg = reg;
+                __entry->offs = offs;
+                __entry->val = val;
+        ),
+        TP_printk("[%s] pci cfg write %s[%#x] = %#x",
                   __get_str(dev), __entry->reg,  __entry->offs, __entry->val)
 );
 
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 4250555d5e72..db78e6d99456 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -18,7 +18,7 @@
 #define _MEI_DEV_H_
 
 #include <linux/types.h>
-#include <linux/watchdog.h>
+#include <linux/cdev.h>
 #include <linux/poll.h>
 #include <linux/mei.h>
 #include <linux/mei_cl_bus.h>
@@ -26,33 +26,13 @@
 #include "hw.h"
 #include "hbm.h"
 
-/*
- * watch dog definition
- */
-#define MEI_WD_HDR_SIZE       4
-#define MEI_WD_STOP_MSG_SIZE  MEI_WD_HDR_SIZE
-#define MEI_WD_START_MSG_SIZE (MEI_WD_HDR_SIZE + 16)
-
-#define MEI_WD_DEFAULT_TIMEOUT   120  /* seconds */
-#define MEI_WD_MIN_TIMEOUT       120  /* seconds */
-#define MEI_WD_MAX_TIMEOUT     65535  /* seconds */
-
-#define MEI_WD_STOP_TIMEOUT      10 /* msecs */
-
-#define MEI_WD_STATE_INDEPENDENCE_MSG_SENT       (1 << 0)
-
-#define MEI_RD_MSG_BUF_SIZE           (128 * sizeof(u32))
-
 
 /*
  * AMTHI Client UUID
  */
 extern const uuid_le mei_amthif_guid;
 
-/*
- * Watchdog Client UUID
- */
-extern const uuid_le mei_wd_guid;
+#define MEI_RD_MSG_BUF_SIZE           (128 * sizeof(u32))
 
 /*
  * Number of Maximum MEI Clients
@@ -73,15 +53,6 @@ extern const uuid_le mei_wd_guid;
  */
 #define  MEI_MAX_OPEN_HANDLE_COUNT (MEI_CLIENTS_MAX - 1)
 
-/*
- * Internal Clients Number
- */
-#define MEI_HOST_CLIENT_ID_ANY        (-1)
-#define MEI_HBM_HOST_CLIENT_ID         0 /* not used, just for documentation */
-#define MEI_WD_HOST_CLIENT_ID          1
-#define MEI_IAMTHIF_HOST_CLIENT_ID     2
-
-
 /* File state */
 enum file_state {
         MEI_FILE_INITIALIZING = 0,
@@ -123,12 +94,6 @@ enum mei_file_transaction_states {
         MEI_READ_COMPLETE
 };
 
-enum mei_wd_states {
-        MEI_WD_IDLE,
-        MEI_WD_RUNNING,
-        MEI_WD_STOPPING,
-};
-
 /**
  * enum mei_cb_file_ops  - file operation associated with the callback
  * @MEI_FOP_READ:       read
@@ -153,7 +118,7 @@ enum mei_cb_file_ops {
  * Intel MEI message data struct
  */
 struct mei_msg_data {
-        u32 size;
+        size_t size;
         unsigned char *data;
 };
 
@@ -206,8 +171,7 @@ struct mei_cl;
  * @fop_type: file operation type
  * @buf: buffer for data associated with the callback
  * @buf_idx: last read index
- * @read_time: last read operation time stamp (iamthif)
- * @file_object: pointer to file structure
+ * @fp: pointer to file structure
  * @status: io status of the cb
  * @internal: communication between driver and FW flag
  * @completed: the transfer or reception has completed
@@ -217,9 +181,8 @@ struct mei_cl_cb {
         struct mei_cl *cl;
         enum mei_cb_file_ops fop_type;
         struct mei_msg_data buf;
-        unsigned long buf_idx;
-        unsigned long read_time;
-        struct file *file_object;
+        size_t buf_idx;
+        const struct file *fp;
         int status;
         u32 internal:1;
         u32 completed:1;
@@ -341,12 +304,13 @@ struct mei_hw_ops {
 
 /* MEI bus API*/
 void mei_cl_bus_rescan(struct mei_device *bus);
+void mei_cl_bus_rescan_work(struct work_struct *work);
 void mei_cl_bus_dev_fixup(struct mei_cl_device *dev);
 ssize_t __mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
                         bool blocking);
 ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length);
-void mei_cl_bus_rx_event(struct mei_cl *cl);
-void mei_cl_bus_notify_event(struct mei_cl *cl);
+bool mei_cl_bus_rx_event(struct mei_cl *cl);
+bool mei_cl_bus_notify_event(struct mei_cl *cl);
 void mei_cl_bus_remove_devices(struct mei_device *bus);
 int mei_cl_bus_init(void);
 void mei_cl_bus_exit(void);
@@ -404,7 +368,6 @@ const char *mei_pg_state_str(enum mei_pg_state state);
  * @wait_hw_ready : wait queue for receive HW ready message form FW
  * @wait_pg     : wait queue for receive PG message from FW
  * @wait_hbm_start : wait queue for receive HBM start message from FW
- * @wait_stop_wd : wait queue for receive WD stop message from FW
  *
  * @reset_count : number of consecutive resets
  * @dev_state   : device state
@@ -426,6 +389,8 @@ const char *mei_pg_state_str(enum mei_pg_state state);
  * @hbm_f_dc_supported  : hbm feature dynamic clients
  * @hbm_f_dot_supported : hbm feature disconnect on timeout
  * @hbm_f_ev_supported  : hbm feature event notification
+ * @hbm_f_fa_supported  : hbm feature fixed address client
+ * @hbm_f_ie_supported  : hbm feature immediate reply to enum request
  *
  * @me_clients_rwsem: rw lock over me_clients list
  * @me_clients  : list of FW clients
@@ -434,26 +399,19 @@ const char *mei_pg_state_str(enum mei_pg_state state);
  * @me_client_index : last FW client index in enumeration
  *
  * @allow_fixed_address: allow user space to connect a fixed client
- *
- * @wd_cl       : watchdog client
- * @wd_state    : watchdog client state
- * @wd_pending  : watchdog command is pending
- * @wd_timeout  : watchdog expiration timeout
- * @wd_data     : watchdog message buffer
+ * @override_fixed_address: force allow fixed address behavior
  *
  * @amthif_cmd_list : amthif list for cmd waiting
- * @amthif_rd_complete_list : amthif list for reading completed cmd data
- * @iamthif_file_object : file for current amthif operation
+ * @iamthif_fp : file for current amthif operation
  * @iamthif_cl  : amthif host client
  * @iamthif_current_cb : amthif current operation callback
  * @iamthif_open_count : number of opened amthif connections
- * @iamthif_timer : time stamp of current amthif command completion
  * @iamthif_stall_timer : timer to detect amthif hang
  * @iamthif_state : amthif processor state
  * @iamthif_canceled : current amthif command is canceled
  *
- * @init_work   : work item for the device init
  * @reset_work  : work item for the device reset
+ * @bus_rescan_work : work item for the bus rescan
  *
  * @device_list : mei client bus list
  * @cl_bus_lock : client bus list lock
@@ -486,7 +444,6 @@ struct mei_device {
         wait_queue_head_t wait_hw_ready;
         wait_queue_head_t wait_pg;
         wait_queue_head_t wait_hbm_start;
-        wait_queue_head_t wait_stop_wd;
 
         /*
          * mei device  states
@@ -522,6 +479,8 @@ struct mei_device {
         unsigned int hbm_f_dc_supported:1;
         unsigned int hbm_f_dot_supported:1;
         unsigned int hbm_f_ev_supported:1;
+        unsigned int hbm_f_fa_supported:1;
+        unsigned int hbm_f_ie_supported:1;
 
         struct rw_semaphore me_clients_rwsem;
         struct list_head me_clients;
@@ -530,29 +489,21 @@ struct mei_device {
         unsigned long me_client_index;
 
         bool allow_fixed_address;
-
-        struct mei_cl wd_cl;
-        enum mei_wd_states wd_state;
-        bool wd_pending;
-        u16 wd_timeout;
-        unsigned char wd_data[MEI_WD_START_MSG_SIZE];
-
+        bool override_fixed_address;
 
         /* amthif list for cmd waiting */
         struct mei_cl_cb amthif_cmd_list;
         /* driver managed amthif list for reading completed amthif cmd data */
-        struct mei_cl_cb amthif_rd_complete_list;
-        struct file *iamthif_file_object;
+        const struct file *iamthif_fp;
         struct mei_cl iamthif_cl;
         struct mei_cl_cb *iamthif_current_cb;
         long iamthif_open_count;
-        unsigned long iamthif_timer;
         u32 iamthif_stall_timer;
         enum iamthif_states iamthif_state;
         bool iamthif_canceled;
 
-        struct work_struct init_work;
         struct work_struct reset_work;
+        struct work_struct bus_rescan_work;
 
         /* List of bus devices */
         struct list_head device_list;
@@ -635,47 +586,18 @@ unsigned int mei_amthif_poll(struct mei_device *dev,
 
 int mei_amthif_release(struct mei_device *dev, struct file *file);
 
-struct mei_cl_cb *mei_amthif_find_read_list_entry(struct mei_device *dev,
-                                                struct file *file);
-
 int mei_amthif_write(struct mei_cl *cl, struct mei_cl_cb *cb);
 int mei_amthif_run_next_cmd(struct mei_device *dev);
 int mei_amthif_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
                         struct mei_cl_cb *cmpl_list);
 
-void mei_amthif_complete(struct mei_device *dev, struct mei_cl_cb *cb);
+void mei_amthif_complete(struct mei_cl *cl, struct mei_cl_cb *cb);
 int mei_amthif_irq_read_msg(struct mei_cl *cl,
                             struct mei_msg_hdr *mei_hdr,
                             struct mei_cl_cb *complete_list);
 int mei_amthif_irq_read(struct mei_device *dev, s32 *slots);
 
 /*
- * NFC functions
- */
-int mei_nfc_host_init(struct mei_device *dev, struct mei_me_client *me_cl);
-void mei_nfc_host_exit(struct mei_device *dev);
-
-/*
- * NFC Client UUID
- */
-extern const uuid_le mei_nfc_guid;
-
-int mei_wd_send(struct mei_device *dev);
-int mei_wd_stop(struct mei_device *dev);
-int mei_wd_host_init(struct mei_device *dev, struct mei_me_client *me_cl);
-/*
- * mei_watchdog_register  - Registering watchdog interface
- *   once we got connection to the WD Client
- * @dev: mei device
- */
-int mei_watchdog_register(struct mei_device *dev);
-/*
- * mei_watchdog_unregister  - Unregistering watchdog interface
- * @dev: mei device
- */
-void mei_watchdog_unregister(struct mei_device *dev);
-
-/*
  * Register Access Function
  */
 
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 75fc9c688df8..996344f6c32d 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -210,7 +210,7 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         err = mei_register(dev, &pdev->dev);
         if (err)
-                goto release_irq;
+                goto stop;
 
         pci_set_drvdata(pdev, dev);
 
@@ -231,6 +231,8 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         return 0;
 
+stop:
+        mei_stop(dev);
 release_irq:
         mei_cancel_work(dev);
         mei_disable_interrupts(dev);
diff --git a/drivers/misc/mei/pci-txe.c b/drivers/misc/mei/pci-txe.c
index 71f8a7475717..30cc30683c07 100644
--- a/drivers/misc/mei/pci-txe.c
+++ b/drivers/misc/mei/pci-txe.c
@@ -154,7 +154,7 @@ static int mei_txe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         err = mei_register(dev, &pdev->dev);
         if (err)
-                goto release_irq;
+                goto stop;
 
         pci_set_drvdata(pdev, dev);
 
@@ -170,6 +170,8 @@ static int mei_txe_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         return 0;
 
+stop:
+        mei_stop(dev);
 release_irq:
 
         mei_cancel_work(dev);
diff --git a/drivers/misc/mei/wd.c b/drivers/misc/mei/wd.c
deleted file mode 100644
index b346638833b0..000000000000
--- a/drivers/misc/mei/wd.c
+++ /dev/null
@@ -1,391 +0,0 @@
-/*
- *
- * Intel Management Engine Interface (Intel MEI) Linux driver
- * Copyright (c) 2003-2012, Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
- *
- */
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/device.h>
-#include <linux/sched.h>
-#include <linux/watchdog.h>
-
-#include <linux/mei.h>
-
-#include "mei_dev.h"
-#include "hbm.h"
-#include "client.h"
-
-static const u8 mei_start_wd_params[] = { 0x02, 0x12, 0x13, 0x10 };
-static const u8 mei_stop_wd_params[] = { 0x02, 0x02, 0x14, 0x10 };
-
-/*
- * AMT Watchdog Device
- */
-#define INTEL_AMT_WATCHDOG_ID "INTCAMT"
-
-/* UUIDs for AMT F/W clients */
-const uuid_le mei_wd_guid = UUID_LE(0x05B79A6F, 0x4628, 0x4D7F, 0x89,
-                                                0x9D, 0xA9, 0x15, 0x14, 0xCB,
-                                                0x32, 0xAB);
-
-static void mei_wd_set_start_timeout(struct mei_device *dev, u16 timeout)
-{
-        dev_dbg(dev->dev, "wd: set timeout=%d.\n", timeout);
-        memcpy(dev->wd_data, mei_start_wd_params, MEI_WD_HDR_SIZE);
-        memcpy(dev->wd_data + MEI_WD_HDR_SIZE, &timeout, sizeof(u16));
-}
-
-/**
- * mei_wd_host_init - connect to the watchdog client
- *
- * @dev: the device structure
- * @me_cl: me client
- *
- * Return: -ENOTTY if wd client cannot be found
- *         -EIO if write has failed
- *         0 on success
- */
-int mei_wd_host_init(struct mei_device *dev, struct mei_me_client *me_cl)
-{
-        struct mei_cl *cl = &dev->wd_cl;
-        int ret;
-
-        mei_cl_init(cl, dev);
-
-        dev->wd_timeout = MEI_WD_DEFAULT_TIMEOUT;
-        dev->wd_state = MEI_WD_IDLE;
-
-        ret = mei_cl_link(cl, MEI_WD_HOST_CLIENT_ID);
-        if (ret < 0) {
-                dev_info(dev->dev, "wd: failed link client\n");
-                return ret;
-        }
-
-        ret = mei_cl_connect(cl, me_cl, NULL);
-        if (ret) {
-                dev_err(dev->dev, "wd: failed to connect = %d\n", ret);
-                mei_cl_unlink(cl);
-                return ret;
-        }
-
-        ret = mei_watchdog_register(dev);
-        if (ret) {
-                mei_cl_disconnect(cl);
-                mei_cl_unlink(cl);
-        }
-        return ret;
-}
-
-/**
- * mei_wd_send - sends watch dog message to fw.
- *
- * @dev: the device structure
- *
- * Return: 0 if success,
- *      -EIO when message send fails
- *      -EINVAL when invalid message is to be sent
- *      -ENODEV on flow control failure
- */
-int mei_wd_send(struct mei_device *dev)
-{
-        struct mei_cl *cl = &dev->wd_cl;
-        struct mei_msg_hdr hdr;
-        int ret;
-
-        hdr.host_addr = cl->host_client_id;
-        hdr.me_addr = mei_cl_me_id(cl);
-        hdr.msg_complete = 1;
-        hdr.reserved = 0;
-        hdr.internal = 0;
-
-        if (!memcmp(dev->wd_data, mei_start_wd_params, MEI_WD_HDR_SIZE))
-                hdr.length = MEI_WD_START_MSG_SIZE;
-        else if (!memcmp(dev->wd_data, mei_stop_wd_params, MEI_WD_HDR_SIZE))
-                hdr.length = MEI_WD_STOP_MSG_SIZE;
-        else {
-                dev_err(dev->dev, "wd: invalid message is to be sent, aborting\n");
-                return -EINVAL;
-        }
-
-        ret = mei_write_message(dev, &hdr, dev->wd_data);
-        if (ret) {
-                dev_err(dev->dev, "wd: write message failed\n");
-                return ret;
-        }
-
-        ret = mei_cl_flow_ctrl_reduce(cl);
-        if (ret) {
-                dev_err(dev->dev, "wd: flow_ctrl_reduce failed.\n");
-                return ret;
-        }
-
-        return 0;
-}
-
-/**
- * mei_wd_stop - sends watchdog stop message to fw.
- *
- * @dev: the device structure
- *
- * Return: 0 if success
- * on error:
- *      -EIO    when message send fails
- *      -EINVAL when invalid message is to be sent
- *      -ETIME  on message timeout
- */
-int mei_wd_stop(struct mei_device *dev)
-{
-        struct mei_cl *cl = &dev->wd_cl;
-        int ret;
-
-        if (!mei_cl_is_connected(cl) ||
-            dev->wd_state != MEI_WD_RUNNING)
-                return 0;
-
-        memcpy(dev->wd_data, mei_stop_wd_params, MEI_WD_STOP_MSG_SIZE);
-
-        dev->wd_state = MEI_WD_STOPPING;
-
-        ret = mei_cl_flow_ctrl_creds(cl);
-        if (ret < 0)
-                goto err;
-
-        if (ret && mei_hbuf_acquire(dev)) {
-                ret = mei_wd_send(dev);
-                if (ret)
-                        goto err;
-                dev->wd_pending = false;
-        } else {
-                dev->wd_pending = true;
-        }
-
-        mutex_unlock(&dev->device_lock);
-
-        ret = wait_event_timeout(dev->wait_stop_wd,
-                                dev->wd_state == MEI_WD_IDLE,
-                                msecs_to_jiffies(MEI_WD_STOP_TIMEOUT));
-        mutex_lock(&dev->device_lock);
-        if (dev->wd_state != MEI_WD_IDLE) {
-                /* timeout */
-                ret = -ETIME;
-                dev_warn(dev->dev, "wd: stop failed to complete ret=%d\n", ret);
-                goto err;
-        }
-        dev_dbg(dev->dev, "wd: stop completed after %u msec\n",
-                        MEI_WD_STOP_TIMEOUT - jiffies_to_msecs(ret));
-        return 0;
-err:
-        return ret;
-}
-
-/**
- * mei_wd_ops_start - wd start command from the watchdog core.
- *
- * @wd_dev: watchdog device struct
- *
- * Return: 0 if success, negative errno code for failure
- */
-static int mei_wd_ops_start(struct watchdog_device *wd_dev)
-{
-        struct mei_device *dev;
-        struct mei_cl *cl;
-        int err = -ENODEV;
-
-        dev = watchdog_get_drvdata(wd_dev);
-        if (!dev)
-                return -ENODEV;
-
-        cl = &dev->wd_cl;
-
-        mutex_lock(&dev->device_lock);
-
-        if (dev->dev_state != MEI_DEV_ENABLED) {
-                dev_dbg(dev->dev, "wd: dev_state != MEI_DEV_ENABLED  dev_state = %s\n",
-                        mei_dev_state_str(dev->dev_state));
-                goto end_unlock;
-        }
-
-        if (!mei_cl_is_connected(cl)) {
-                cl_dbg(dev, cl, "MEI Driver is not connected to Watchdog Client\n");
-                goto end_unlock;
-        }
-
-        mei_wd_set_start_timeout(dev, dev->wd_timeout);
-
-        err = 0;
-end_unlock:
-        mutex_unlock(&dev->device_lock);
-        return err;
-}
-
-/**
- * mei_wd_ops_stop -  wd stop command from the watchdog core.
- *
- * @wd_dev: watchdog device struct
- *
- * Return: 0 if success, negative errno code for failure
- */
-static int mei_wd_ops_stop(struct watchdog_device *wd_dev)
-{
-        struct mei_device *dev;
-
-        dev = watchdog_get_drvdata(wd_dev);
-        if (!dev)
-                return -ENODEV;
-
-        mutex_lock(&dev->device_lock);
-        mei_wd_stop(dev);
-        mutex_unlock(&dev->device_lock);
-
-        return 0;
-}
-
-/**
- * mei_wd_ops_ping - wd ping command from the watchdog core.
- *
- * @wd_dev: watchdog device struct
- *
- * Return: 0 if success, negative errno code for failure
- */
-static int mei_wd_ops_ping(struct watchdog_device *wd_dev)
-{
-        struct mei_device *dev;
-        struct mei_cl *cl;
-        int ret;
-
-        dev = watchdog_get_drvdata(wd_dev);
-        if (!dev)
-                return -ENODEV;
-
-        cl = &dev->wd_cl;
-
-        mutex_lock(&dev->device_lock);
-
-        if (!mei_cl_is_connected(cl)) {
-                cl_err(dev, cl, "wd: not connected.\n");
-                ret = -ENODEV;
-                goto end;
-        }
-
-        dev->wd_state = MEI_WD_RUNNING;
-
-        ret = mei_cl_flow_ctrl_creds(cl);
-        if (ret < 0)
-                goto end;
-
-        /* Check if we can send the ping to HW*/
-        if (ret && mei_hbuf_acquire(dev)) {
-                dev_dbg(dev->dev, "wd: sending ping\n");
-
-                ret = mei_wd_send(dev);
-                if (ret)
-                        goto end;
-                dev->wd_pending = false;
-        } else {
-                dev->wd_pending = true;
-        }
-
-end:
-        mutex_unlock(&dev->device_lock);
-        return ret;
-}
-
-/**
- * mei_wd_ops_set_timeout - wd set timeout command from the watchdog core.
- *
- * @wd_dev: watchdog device struct
- * @timeout: timeout value to set
- *
- * Return: 0 if success, negative errno code for failure
- */
-static int mei_wd_ops_set_timeout(struct watchdog_device *wd_dev,
-                unsigned int timeout)
-{
-        struct mei_device *dev;
-
-        dev = watchdog_get_drvdata(wd_dev);
-        if (!dev)
-                return -ENODEV;
-
-        /* Check Timeout value */
-        if (timeout < MEI_WD_MIN_TIMEOUT || timeout > MEI_WD_MAX_TIMEOUT)
-                return -EINVAL;
-
-        mutex_lock(&dev->device_lock);
-
-        dev->wd_timeout = timeout;
-        wd_dev->timeout = timeout;
-        mei_wd_set_start_timeout(dev, dev->wd_timeout);
-
-        mutex_unlock(&dev->device_lock);
-
-        return 0;
-}
-
-/*
- * Watchdog Device structs
- */
-static const struct watchdog_ops wd_ops = {
-                .owner = THIS_MODULE,
-                .start = mei_wd_ops_start,
-                .stop = mei_wd_ops_stop,
-                .ping = mei_wd_ops_ping,
-                .set_timeout = mei_wd_ops_set_timeout,
-};
-static const struct watchdog_info wd_info = {
-                .identity = INTEL_AMT_WATCHDOG_ID,
-                .options = WDIOF_KEEPALIVEPING |
-                           WDIOF_SETTIMEOUT |
-                           WDIOF_ALARMONLY,
-};
-
-static struct watchdog_device amt_wd_dev = {
-                .info = &wd_info,
-                .ops = &wd_ops,
-                .timeout = MEI_WD_DEFAULT_TIMEOUT,
-                .min_timeout = MEI_WD_MIN_TIMEOUT,
-                .max_timeout = MEI_WD_MAX_TIMEOUT,
-};
-
-
-int mei_watchdog_register(struct mei_device *dev)
-{
-
-        int ret;
-
-        amt_wd_dev.parent = dev->dev;
-        /* unlock to perserve correct locking order */
-        mutex_unlock(&dev->device_lock);
-        ret = watchdog_register_device(&amt_wd_dev);
-        mutex_lock(&dev->device_lock);
-        if (ret) {
-                dev_err(dev->dev, "wd: unable to register watchdog device = %d.\n",
-                        ret);
-                return ret;
-        }
-
-        dev_dbg(dev->dev, "wd: successfully register watchdog interface.\n");
-        watchdog_set_drvdata(&amt_wd_dev, dev);
-        return 0;
-}
-
-void mei_watchdog_unregister(struct mei_device *dev)
-{
-        if (watchdog_get_drvdata(&amt_wd_dev) == NULL)
-                return;
-
-        watchdog_set_drvdata(&amt_wd_dev, NULL);
-        watchdog_unregister_device(&amt_wd_dev);
-}
-
diff --git a/drivers/misc/mic/Kconfig b/drivers/misc/mic/Kconfig
index 40677df7f996..2e4f3ba75c8e 100644
--- a/drivers/misc/mic/Kconfig
+++ b/drivers/misc/mic/Kconfig
@@ -32,12 +32,29 @@ config SCIF_BUS
           OS and tools for MIC to use with this driver are available from
           <http://software.intel.com/en-us/mic-developer>.
 
+comment "VOP Bus Driver"
+
+config VOP_BUS
+        tristate "VOP Bus Driver"
+        depends on 64BIT && PCI && X86 && X86_DEV_DMA_OPS
+        help
+          This option is selected by any driver which registers a
+          device or driver on the VOP Bus, such as CONFIG_INTEL_MIC_HOST
+          and CONFIG_INTEL_MIC_CARD.
+
+          If you are building a host/card kernel with an Intel MIC device
+          then say M (recommended) or Y, else say N. If unsure say N.
+
+          More information about the Intel MIC family as well as the Linux
+          OS and tools for MIC to use with this driver are available from
+          <http://software.intel.com/en-us/mic-developer>.
+
 comment "Intel MIC Host Driver"
 
 config INTEL_MIC_HOST
         tristate "Intel MIC Host Driver"
-        depends on 64BIT && PCI && X86 && INTEL_MIC_BUS && SCIF_BUS && MIC_COSM
-        select VHOST_RING
+        depends on 64BIT && PCI && X86
+        depends on INTEL_MIC_BUS && SCIF_BUS && MIC_COSM && VOP_BUS
         help
           This enables Host Driver support for the Intel Many Integrated
           Core (MIC) family of PCIe form factor coprocessor devices that
@@ -56,7 +73,8 @@ comment "Intel MIC Card Driver"
 
 config INTEL_MIC_CARD
         tristate "Intel MIC Card Driver"
-        depends on 64BIT && X86 && INTEL_MIC_BUS && SCIF_BUS && MIC_COSM
+        depends on 64BIT && X86
+        depends on INTEL_MIC_BUS && SCIF_BUS && MIC_COSM && VOP_BUS
         select VIRTIO
         help
           This enables card driver support for the Intel Many Integrated
@@ -107,3 +125,23 @@ config MIC_COSM
           More information about the Intel MIC family as well as the Linux
           OS and tools for MIC to use with this driver are available from
           <http://software.intel.com/en-us/mic-developer>.
+
+comment "VOP Driver"
+
+config VOP
+        tristate "VOP Driver"
+        depends on 64BIT && PCI && X86 && VOP_BUS
+        select VHOST_RING
+        help
+          This enables VOP (Virtio over PCIe) Driver support for the Intel
+          Many Integrated Core (MIC) family of PCIe form factor coprocessor
+          devices. The VOP driver allows virtio drivers, e.g. net, console
+          and block drivers, on the card connect to user space virtio
+          devices on the host.
+
+          If you are building a host kernel with an Intel MIC device then
+          say M (recommended) or Y, else say N. If unsure say N.
+
+          More information about the Intel MIC family as well as the Linux
+          OS and tools for MIC to use with this driver are available from
+          <http://software.intel.com/en-us/mic-developer>.
diff --git a/drivers/misc/mic/Makefile b/drivers/misc/mic/Makefile
index e288a1106738..f2b1323ff96c 100644
--- a/drivers/misc/mic/Makefile
+++ b/drivers/misc/mic/Makefile
@@ -8,3 +8,4 @@ obj-y += bus/
 obj-$(CONFIG_SCIF) += scif/
 obj-$(CONFIG_MIC_COSM) += cosm/
 obj-$(CONFIG_MIC_COSM) += cosm_client/
+obj-$(CONFIG_VOP) += vop/
diff --git a/drivers/misc/mic/bus/Makefile b/drivers/misc/mic/bus/Makefile
index 761842b0d0bb..8758a7daa52c 100644
--- a/drivers/misc/mic/bus/Makefile
+++ b/drivers/misc/mic/bus/Makefile
@@ -5,3 +5,4 @@
 obj-$(CONFIG_INTEL_MIC_BUS) += mic_bus.o
 obj-$(CONFIG_SCIF_BUS) += scif_bus.o
 obj-$(CONFIG_MIC_COSM) += cosm_bus.o
+obj-$(CONFIG_VOP_BUS) += vop_bus.o
diff --git a/drivers/misc/mic/bus/cosm_bus.h b/drivers/misc/mic/bus/cosm_bus.h
index f7c57f266916..8b6341855dc3 100644
--- a/drivers/misc/mic/bus/cosm_bus.h
+++ b/drivers/misc/mic/bus/cosm_bus.h
@@ -30,6 +30,7 @@
  * @attr_group: Pointer to list of sysfs attribute groups.
  * @sdev: Device for sysfs entries.
  * @state: MIC state.
+ * @prev_state: MIC state previous to MIC_RESETTING
  * @shutdown_status: MIC status reported by card for shutdown/crashes.
  * @shutdown_status_int: Internal shutdown status maintained by the driver
  * @cosm_mutex: Mutex for synchronizing access to data structures.
@@ -55,6 +56,7 @@ struct cosm_device {
         const struct attribute_group **attr_group;
         struct device *sdev;
         u8 state;
+        u8 prev_state;
         u8 shutdown_status;
         u8 shutdown_status_int;
         struct mutex cosm_mutex;
diff --git a/drivers/misc/mic/bus/vop_bus.c b/drivers/misc/mic/bus/vop_bus.c
new file mode 100644
index 000000000000..303da222f5b6
--- /dev/null
+++ b/drivers/misc/mic/bus/vop_bus.c
@@ -0,0 +1,203 @@
+/*
+ * Intel MIC Platform Software Stack (MPSS)
+ *
+ * Copyright(c) 2016 Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * The full GNU General Public License is included in this distribution in
+ * the file called "COPYING".
+ *
+ * Intel Virtio Over PCIe (VOP) Bus driver.
+ */
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/idr.h>
+#include <linux/dma-mapping.h>
+
+#include "vop_bus.h"
+
+static ssize_t device_show(struct device *d,
+                           struct device_attribute *attr, char *buf)
+{
+        struct vop_device *dev = dev_to_vop(d);
+
+        return sprintf(buf, "0x%04x\n", dev->id.device);
+}
+static DEVICE_ATTR_RO(device);
+
+static ssize_t vendor_show(struct device *d,
+                           struct device_attribute *attr, char *buf)
+{
+        struct vop_device *dev = dev_to_vop(d);
+
+        return sprintf(buf, "0x%04x\n", dev->id.vendor);
+}
+static DEVICE_ATTR_RO(vendor);
+
+static ssize_t modalias_show(struct device *d,
+                             struct device_attribute *attr, char *buf)
+{
+        struct vop_device *dev = dev_to_vop(d);
+
+        return sprintf(buf, "vop:d%08Xv%08X\n",
+                       dev->id.device, dev->id.vendor);
+}
+static DEVICE_ATTR_RO(modalias);
+
+static struct attribute *vop_dev_attrs[] = {
+        &dev_attr_device.attr,
+        &dev_attr_vendor.attr,
+        &dev_attr_modalias.attr,
+        NULL,
+};
+ATTRIBUTE_GROUPS(vop_dev);
+
+static inline int vop_id_match(const struct vop_device *dev,
+                               const struct vop_device_id *id)
+{
+        if (id->device != dev->id.device && id->device != VOP_DEV_ANY_ID)
+                return 0;
+
+        return id->vendor == VOP_DEV_ANY_ID || id->vendor == dev->id.vendor;
+}
+
+/*
+ * This looks through all the IDs a driver claims to support.  If any of them
+ * match, we return 1 and the kernel will call vop_dev_probe().
+ */
+static int vop_dev_match(struct device *dv, struct device_driver *dr)
+{
+        unsigned int i;
+        struct vop_device *dev = dev_to_vop(dv);
+        const struct vop_device_id *ids;
+
+        ids = drv_to_vop(dr)->id_table;
+        for (i = 0; ids[i].device; i++)
+                if (vop_id_match(dev, &ids[i]))
+                        return 1;
+        return 0;
+}
+
+static int vop_uevent(struct device *dv, struct kobj_uevent_env *env)
+{
+        struct vop_device *dev = dev_to_vop(dv);
+
+        return add_uevent_var(env, "MODALIAS=vop:d%08Xv%08X",
+                              dev->id.device, dev->id.vendor);
+}
+
+static int vop_dev_probe(struct device *d)
+{
+        struct vop_device *dev = dev_to_vop(d);
+        struct vop_driver *drv = drv_to_vop(dev->dev.driver);
+
+        return drv->probe(dev);
+}
+
+static int vop_dev_remove(struct device *d)
+{
+        struct vop_device *dev = dev_to_vop(d);
+        struct vop_driver *drv = drv_to_vop(dev->dev.driver);
+
+        drv->remove(dev);
+        return 0;
+}
+
+static struct bus_type vop_bus = {
+        .name  = "vop_bus",
+        .match = vop_dev_match,
+        .dev_groups = vop_dev_groups,
+        .uevent = vop_uevent,
+        .probe = vop_dev_probe,
+        .remove = vop_dev_remove,
+};
+
+int vop_register_driver(struct vop_driver *driver)
+{
+        driver->driver.bus = &vop_bus;
+        return driver_register(&driver->driver);
+}
+EXPORT_SYMBOL_GPL(vop_register_driver);
+
+void vop_unregister_driver(struct vop_driver *driver)
+{
+        driver_unregister(&driver->driver);
+}
+EXPORT_SYMBOL_GPL(vop_unregister_driver);
+
+static void vop_release_dev(struct device *d)
+{
+        put_device(d);
+}
+
+struct vop_device *
+vop_register_device(struct device *pdev, int id,
+                    const struct dma_map_ops *dma_ops,
+                    struct vop_hw_ops *hw_ops, u8 dnode, struct mic_mw *aper,
+                    struct dma_chan *chan)
+{
+        int ret;
+        struct vop_device *vdev;
+
+        vdev = kzalloc(sizeof(*vdev), GFP_KERNEL);
+        if (!vdev)
+                return ERR_PTR(-ENOMEM);
+
+        vdev->dev.parent = pdev;
+        vdev->id.device = id;
+        vdev->id.vendor = VOP_DEV_ANY_ID;
+        vdev->dev.archdata.dma_ops = (struct dma_map_ops *)dma_ops;
+        vdev->dev.dma_mask = &vdev->dev.coherent_dma_mask;
+        dma_set_mask(&vdev->dev, DMA_BIT_MASK(64));
+        vdev->dev.release = vop_release_dev;
+        vdev->hw_ops = hw_ops;
+        vdev->dev.bus = &vop_bus;
+        vdev->dnode = dnode;
+        vdev->aper = aper;
+        vdev->dma_ch = chan;
+        vdev->index = dnode - 1;
+        dev_set_name(&vdev->dev, "vop-dev%u", vdev->index);
+        /*
+         * device_register() causes the bus infrastructure to look for a
+         * matching driver.
+         */
+        ret = device_register(&vdev->dev);
+        if (ret)
+                goto free_vdev;
+        return vdev;
+free_vdev:
+        kfree(vdev);
+        return ERR_PTR(ret);
+}
+EXPORT_SYMBOL_GPL(vop_register_device);
+
+void vop_unregister_device(struct vop_device *dev)
+{
+        device_unregister(&dev->dev);
+}
+EXPORT_SYMBOL_GPL(vop_unregister_device);
+
+static int __init vop_init(void)
+{
+        return bus_register(&vop_bus);
+}
+
+static void __exit vop_exit(void)
+{
+        bus_unregister(&vop_bus);
+}
+
+core_initcall(vop_init);
+module_exit(vop_exit);
+
+MODULE_AUTHOR("Intel Corporation");
+MODULE_DESCRIPTION("Intel(R) VOP Bus driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/mic/bus/vop_bus.h b/drivers/misc/mic/bus/vop_bus.h
new file mode 100644
index 000000000000..fff7a865d721
--- /dev/null
+++ b/drivers/misc/mic/bus/vop_bus.h
@@ -0,0 +1,140 @@
+/*
+ * Intel MIC Platform Software Stack (MPSS)
+ *
+ * Copyright(c) 2016 Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * The full GNU General Public License is included in this distribution in
+ * the file called "COPYING".
+ *
+ * Intel Virtio over PCIe Bus driver.
+ */
+#ifndef _VOP_BUS_H_
+#define _VOP_BUS_H_
+/*
+ * Everything a vop driver needs to work with any particular vop
+ * implementation.
+ */
+#include <linux/dmaengine.h>
+#include <linux/interrupt.h>
+
+#include "../common/mic_dev.h"
+
+struct vop_device_id {
+        u32 device;
+        u32 vendor;
+};
+
+#define VOP_DEV_TRNSP 1
+#define VOP_DEV_ANY_ID 0xffffffff
+/*
+ * Size of the internal buffer used during DMA's as an intermediate buffer
+ * for copy to/from user. Must be an integral number of pages.
+ */
+#define VOP_INT_DMA_BUF_SIZE PAGE_ALIGN(64 * 1024ULL)
+
+/**
+ * vop_device - representation of a device using vop
+ * @hw_ops: the hardware ops supported by this device.
+ * @id: the device type identification (used to match it with a driver).
+ * @dev: underlying device.
+ * @dnode - The destination node which this device will communicate with.
+ * @aper: Aperture memory window
+ * @dma_ch - DMA channel
+ * @index: unique position on the vop bus
+ */
+struct vop_device {
+        struct vop_hw_ops *hw_ops;
+        struct vop_device_id id;
+        struct device dev;
+        u8 dnode;
+        struct mic_mw *aper;
+        struct dma_chan *dma_ch;
+        int index;
+};
+
+/**
+ * vop_driver - operations for a vop I/O driver
+ * @driver: underlying device driver (populate name and owner).
+ * @id_table: the ids serviced by this driver.
+ * @probe: the function to call when a device is found.  Returns 0 or -errno.
+ * @remove: the function to call when a device is removed.
+ */
+struct vop_driver {
+        struct device_driver driver;
+        const struct vop_device_id *id_table;
+        int (*probe)(struct vop_device *dev);
+        void (*remove)(struct vop_device *dev);
+};
+
+/**
+ * vop_hw_ops - Hardware operations for accessing a VOP device on the VOP bus.
+ *
+ * @next_db: Obtain the next available doorbell.
+ * @request_irq: Request an interrupt on a particular doorbell.
+ * @free_irq: Free an interrupt requested previously.
+ * @ack_interrupt: acknowledge an interrupt in the ISR.
+ * @get_remote_dp: Get access to the virtio device page used by the remote
+ *                 node to add/remove/configure virtio devices.
+ * @get_dp: Get access to the virtio device page used by the self
+ *          node to add/remove/configure virtio devices.
+ * @send_intr: Send an interrupt to the peer node on a specified doorbell.
+ * @ioremap: Map a buffer with the specified DMA address and length.
+ * @iounmap: Unmap a buffer previously mapped.
+ * @dma_filter: The DMA filter function to use for obtaining access to
+ *              a DMA channel on the peer node.
+ */
+struct vop_hw_ops {
+        int (*next_db)(struct vop_device *vpdev);
+        struct mic_irq *(*request_irq)(struct vop_device *vpdev,
+                                       irqreturn_t (*func)(int irq, void *data),
+                                       const char *name, void *data,
+                                       int intr_src);
+        void (*free_irq)(struct vop_device *vpdev,
+                         struct mic_irq *cookie, void *data);
+        void (*ack_interrupt)(struct vop_device *vpdev, int num);
+        void __iomem * (*get_remote_dp)(struct vop_device *vpdev);
+        void * (*get_dp)(struct vop_device *vpdev);
+        void (*send_intr)(struct vop_device *vpdev, int db);
+        void __iomem * (*ioremap)(struct vop_device *vpdev,
+                                  dma_addr_t pa, size_t len);
+        void (*iounmap)(struct vop_device *vpdev, void __iomem *va);
+};
+
+struct vop_device *
+vop_register_device(struct device *pdev, int id,
+                    const struct dma_map_ops *dma_ops,
+                    struct vop_hw_ops *hw_ops, u8 dnode, struct mic_mw *aper,
+                    struct dma_chan *chan);
+void vop_unregister_device(struct vop_device *dev);
+int vop_register_driver(struct vop_driver *drv);
+void vop_unregister_driver(struct vop_driver *drv);
+
+/*
+ * module_vop_driver() - Helper macro for drivers that don't do
+ * anything special in module init/exit.  This eliminates a lot of
+ * boilerplate.  Each module may only use this macro once, and
+ * calling it replaces module_init() and module_exit()
+ */
+#define module_vop_driver(__vop_driver) \
+        module_driver(__vop_driver, vop_register_driver, \
+                        vop_unregister_driver)
+
+static inline struct vop_device *dev_to_vop(struct device *dev)
+{
+        return container_of(dev, struct vop_device, dev);
+}
+
+static inline struct vop_driver *drv_to_vop(struct device_driver *drv)
+{
+        return container_of(drv, struct vop_driver, driver);
+}
+#endif /* _VOP_BUS_H */
diff --git a/drivers/misc/mic/card/Makefile b/drivers/misc/mic/card/Makefile
index 69d58bef92ce..6e9675e12a09 100644
--- a/drivers/misc/mic/card/Makefile
+++ b/drivers/misc/mic/card/Makefile
@@ -8,4 +8,3 @@ obj-$(CONFIG_INTEL_MIC_CARD) += mic_card.o
 mic_card-y += mic_x100.o
 mic_card-y += mic_device.o
 mic_card-y += mic_debugfs.o
-mic_card-y += mic_virtio.o
diff --git a/drivers/misc/mic/card/mic_device.c b/drivers/misc/mic/card/mic_device.c
index d0edaf7e0cd5..e749af48f736 100644
--- a/drivers/misc/mic/card/mic_device.c
+++ b/drivers/misc/mic/card/mic_device.c
@@ -34,7 +34,6 @@
 #include <linux/mic_common.h>
 #include "../common/mic_dev.h"
 #include "mic_device.h"
-#include "mic_virtio.h"
 
 static struct mic_driver *g_drv;
 
@@ -250,12 +249,82 @@ static struct scif_hw_ops scif_hw_ops = {
         .iounmap = ___mic_iounmap,
 };
 
+static inline struct mic_driver *vpdev_to_mdrv(struct vop_device *vpdev)
+{
+        return dev_get_drvdata(vpdev->dev.parent);
+}
+
+static struct mic_irq *
+__mic_request_irq(struct vop_device *vpdev,
+                  irqreturn_t (*func)(int irq, void *data),
+                   const char *name, void *data, int intr_src)
+{
+        return mic_request_card_irq(func, NULL, name, data, intr_src);
+}
+
+static void __mic_free_irq(struct vop_device *vpdev,
+                           struct mic_irq *cookie, void *data)
+{
+        return mic_free_card_irq(cookie, data);
+}
+
+static void __mic_ack_interrupt(struct vop_device *vpdev, int num)
+{
+        struct mic_driver *mdrv = vpdev_to_mdrv(vpdev);
+
+        mic_ack_interrupt(&mdrv->mdev);
+}
+
+static int __mic_next_db(struct vop_device *vpdev)
+{
+        return mic_next_card_db();
+}
+
+static void __iomem *__mic_get_remote_dp(struct vop_device *vpdev)
+{
+        struct mic_driver *mdrv = vpdev_to_mdrv(vpdev);
+
+        return mdrv->dp;
+}
+
+static void __mic_send_intr(struct vop_device *vpdev, int db)
+{
+        struct mic_driver *mdrv = vpdev_to_mdrv(vpdev);
+
+        mic_send_intr(&mdrv->mdev, db);
+}
+
+static void __iomem *__mic_ioremap(struct vop_device *vpdev,
+                                   dma_addr_t pa, size_t len)
+{
+        struct mic_driver *mdrv = vpdev_to_mdrv(vpdev);
+
+        return mic_card_map(&mdrv->mdev, pa, len);
+}
+
+static void __mic_iounmap(struct vop_device *vpdev, void __iomem *va)
+{
+        struct mic_driver *mdrv = vpdev_to_mdrv(vpdev);
+
+        mic_card_unmap(&mdrv->mdev, va);
+}
+
+static struct vop_hw_ops vop_hw_ops = {
+        .request_irq = __mic_request_irq,
+        .free_irq = __mic_free_irq,
+        .ack_interrupt = __mic_ack_interrupt,
+        .next_db = __mic_next_db,
+        .get_remote_dp = __mic_get_remote_dp,
+        .send_intr = __mic_send_intr,
+        .ioremap = __mic_ioremap,
+        .iounmap = __mic_iounmap,
+};
+
 static int mic_request_dma_chans(struct mic_driver *mdrv)
 {
         dma_cap_mask_t mask;
         struct dma_chan *chan;
 
-        request_module("mic_x100_dma");
         dma_cap_zero(mask);
         dma_cap_set(DMA_MEMCPY, mask);
 
@@ -309,9 +378,13 @@ int __init mic_driver_init(struct mic_driver *mdrv)
                 rc = -ENODEV;
                 goto irq_uninit;
         }
-        rc = mic_devices_init(mdrv);
-        if (rc)
+        mdrv->vpdev = vop_register_device(mdrv->dev, VOP_DEV_TRNSP,
+                                          NULL, &vop_hw_ops, 0,
+                                          NULL, mdrv->dma_ch[0]);
+        if (IS_ERR(mdrv->vpdev)) {
+                rc = PTR_ERR(mdrv->vpdev);
                 goto dma_free;
+        }
         bootparam = mdrv->dp;
         node_id = ioread8(&bootparam->node_id);
         mdrv->scdev = scif_register_device(mdrv->dev, MIC_SCIF_DEV,
@@ -321,13 +394,13 @@ int __init mic_driver_init(struct mic_driver *mdrv)
                                            mdrv->num_dma_ch, true);
         if (IS_ERR(mdrv->scdev)) {
                 rc = PTR_ERR(mdrv->scdev);
-                goto device_uninit;
+                goto vop_remove;
         }
         mic_create_card_debug_dir(mdrv);
 done:
         return rc;
-device_uninit:
-        mic_devices_uninit(mdrv);
+vop_remove:
+        vop_unregister_device(mdrv->vpdev);
 dma_free:
         mic_free_dma_chans(mdrv);
 irq_uninit:
@@ -348,7 +421,7 @@ void mic_driver_uninit(struct mic_driver *mdrv)
 {
         mic_delete_card_debug_dir(mdrv);
         scif_unregister_device(mdrv->scdev);
-        mic_devices_uninit(mdrv);
+        vop_unregister_device(mdrv->vpdev);
         mic_free_dma_chans(mdrv);
         mic_uninit_irq();
         mic_dp_uninit();
diff --git a/drivers/misc/mic/card/mic_device.h b/drivers/misc/mic/card/mic_device.h
index 1dbf83c41289..333dbed972f6 100644
--- a/drivers/misc/mic/card/mic_device.h
+++ b/drivers/misc/mic/card/mic_device.h
@@ -32,6 +32,7 @@
 #include <linux/interrupt.h>
 #include <linux/mic_bus.h>
 #include "../bus/scif_bus.h"
+#include "../bus/vop_bus.h"
 
 /**
  * struct mic_intr_info - Contains h/w specific interrupt sources info
@@ -76,6 +77,7 @@ struct mic_device {
  * @dma_ch - Array of DMA channels
  * @num_dma_ch - Number of DMA channels available
  * @scdev: SCIF device on the SCIF virtual bus.
+ * @vpdev: Virtio over PCIe device on the VOP virtual bus.
  */
 struct mic_driver {
         char name[20];
@@ -90,6 +92,7 @@ struct mic_driver {
         struct dma_chan *dma_ch[MIC_MAX_DMA_CHAN];
         int num_dma_ch;
         struct scif_hw_dev *scdev;
+        struct vop_device *vpdev;
 };
 
 /**
diff --git a/drivers/misc/mic/card/mic_virtio.c b/drivers/misc/mic/card/mic_virtio.c
deleted file mode 100644
index f6ed57d3125c..000000000000
--- a/drivers/misc/mic/card/mic_virtio.c
+++ /dev/null
@@ -1,634 +0,0 @@
-/*
- * Intel MIC Platform Software Stack (MPSS)
- *
- * Copyright(c) 2013 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License, version 2, as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Disclaimer: The codes contained in these modules may be specific to
- * the Intel Software Development Platform codenamed: Knights Ferry, and
- * the Intel product codenamed: Knights Corner, and are not backward
- * compatible with other Intel products. Additionally, Intel will NOT
- * support the codes or instruction set in future products.
- *
- * Adapted from:
- *
- * virtio for kvm on s390
- *
- * Copyright IBM Corp. 2008
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License (version 2 only)
- * as published by the Free Software Foundation.
- *
- *    Author(s): Christian Borntraeger <borntraeger@de.ibm.com>
- *
- * Intel MIC Card driver.
- *
- */
-#include <linux/delay.h>
-#include <linux/slab.h>
-#include <linux/virtio_config.h>
-
-#include "../common/mic_dev.h"
-#include "mic_virtio.h"
-
-#define VIRTIO_SUBCODE_64 0x0D00
-
-#define MIC_MAX_VRINGS                4
-struct mic_vdev {
-        struct virtio_device vdev;
-        struct mic_device_desc __iomem *desc;
-        struct mic_device_ctrl __iomem *dc;
-        struct mic_device *mdev;
-        void __iomem *vr[MIC_MAX_VRINGS];
-        int used_size[MIC_MAX_VRINGS];
-        struct completion reset_done;
-        struct mic_irq *virtio_cookie;
-        int c2h_vdev_db;
-};
-
-static struct mic_irq *virtio_config_cookie;
-#define to_micvdev(vd) container_of(vd, struct mic_vdev, vdev)
-
-/* Helper API to obtain the parent of the virtio device */
-static inline struct device *mic_dev(struct mic_vdev *mvdev)
-{
-        return mvdev->vdev.dev.parent;
-}
-
-/* This gets the device's feature bits. */
-static u64 mic_get_features(struct virtio_device *vdev)
-{
-        unsigned int i, bits;
-        u32 features = 0;
-        struct mic_device_desc __iomem *desc = to_micvdev(vdev)->desc;
-        u8 __iomem *in_features = mic_vq_features(desc);
-        int feature_len = ioread8(&desc->feature_len);
-
-        bits = min_t(unsigned, feature_len, sizeof(features)) * 8;
-        for (i = 0; i < bits; i++)
-                if (ioread8(&in_features[i / 8]) & (BIT(i % 8)))
-                        features |= BIT(i);
-
-        return features;
-}
-
-static int mic_finalize_features(struct virtio_device *vdev)
-{
-        unsigned int i, bits;
-        struct mic_device_desc __iomem *desc = to_micvdev(vdev)->desc;
-        u8 feature_len = ioread8(&desc->feature_len);
-        /* Second half of bitmap is features we accept. */
-        u8 __iomem *out_features =
-                mic_vq_features(desc) + feature_len;
-
-        /* Give virtio_ring a chance to accept features. */
-        vring_transport_features(vdev);
-
-        /* Make sure we don't have any features > 32 bits! */
-        BUG_ON((u32)vdev->features != vdev->features);
-
-        memset_io(out_features, 0, feature_len);
-        bits = min_t(unsigned, feature_len,
-                sizeof(vdev->features)) * 8;
-        for (i = 0; i < bits; i++) {
-                if (__virtio_test_bit(vdev, i))
-                        iowrite8(ioread8(&out_features[i / 8]) | (1 << (i % 8)),
-                                 &out_features[i / 8]);
-        }
-
-        return 0;
-}
-
-/*
- * Reading and writing elements in config space
- */
-static void mic_get(struct virtio_device *vdev, unsigned int offset,
-                   void *buf, unsigned len)
-{
-        struct mic_device_desc __iomem *desc = to_micvdev(vdev)->desc;
-
-        if (offset + len > ioread8(&desc->config_len))
-                return;
-        memcpy_fromio(buf, mic_vq_configspace(desc) + offset, len);
-}
-
-static void mic_set(struct virtio_device *vdev, unsigned int offset,
-                   const void *buf, unsigned len)
-{
-        struct mic_device_desc __iomem *desc = to_micvdev(vdev)->desc;
-
-        if (offset + len > ioread8(&desc->config_len))
-                return;
-        memcpy_toio(mic_vq_configspace(desc) + offset, buf, len);
-}
-
-/*
- * The operations to get and set the status word just access the status
- * field of the device descriptor. set_status also interrupts the host
- * to tell about status changes.
- */
-static u8 mic_get_status(struct virtio_device *vdev)
-{
-        return ioread8(&to_micvdev(vdev)->desc->status);
-}
-
-static void mic_set_status(struct virtio_device *vdev, u8 status)
-{
-        struct mic_vdev *mvdev = to_micvdev(vdev);
-        if (!status)
-                return;
-        iowrite8(status, &mvdev->desc->status);
-        mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
-}
-
-/* Inform host on a virtio device reset and wait for ack from host */
-static void mic_reset_inform_host(struct virtio_device *vdev)
-{
-        struct mic_vdev *mvdev = to_micvdev(vdev);
-        struct mic_device_ctrl __iomem *dc = mvdev->dc;
-        int retry;
-
-        iowrite8(0, &dc->host_ack);
-        iowrite8(1, &dc->vdev_reset);
-        mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
-
-        /* Wait till host completes all card accesses and acks the reset */
-        for (retry = 100; retry--;) {
-                if (ioread8(&dc->host_ack))
-                        break;
-                msleep(100);
-        };
-
-        dev_dbg(mic_dev(mvdev), "%s: retry: %d\n", __func__, retry);
-
-        /* Reset status to 0 in case we timed out */
-        iowrite8(0, &mvdev->desc->status);
-}
-
-static void mic_reset(struct virtio_device *vdev)
-{
-        struct mic_vdev *mvdev = to_micvdev(vdev);
-
-        dev_dbg(mic_dev(mvdev), "%s: virtio id %d\n",
-                __func__, vdev->id.device);
-
-        mic_reset_inform_host(vdev);
-        complete_all(&mvdev->reset_done);
-}
-
-/*
- * The virtio_ring code calls this API when it wants to notify the Host.
- */
-static bool mic_notify(struct virtqueue *vq)
-{
-        struct mic_vdev *mvdev = vq->priv;
-
-        mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
-        return true;
-}
-
-static void mic_del_vq(struct virtqueue *vq, int n)
-{
-        struct mic_vdev *mvdev = to_micvdev(vq->vdev);
-        struct vring *vr = (struct vring *)(vq + 1);
-
-        free_pages((unsigned long) vr->used, get_order(mvdev->used_size[n]));
-        vring_del_virtqueue(vq);
-        mic_card_unmap(mvdev->mdev, mvdev->vr[n]);
-        mvdev->vr[n] = NULL;
-}
-
-static void mic_del_vqs(struct virtio_device *vdev)
-{
-        struct mic_vdev *mvdev = to_micvdev(vdev);
-        struct virtqueue *vq, *n;
-        int idx = 0;
-
-        dev_dbg(mic_dev(mvdev), "%s\n", __func__);
-
-        list_for_each_entry_safe(vq, n, &vdev->vqs, list)
-                mic_del_vq(vq, idx++);
-}
-
-/*
- * This routine will assign vring's allocated in host/io memory. Code in
- * virtio_ring.c however continues to access this io memory as if it were local
- * memory without io accessors.
- */
-static struct virtqueue *mic_find_vq(struct virtio_device *vdev,
-                                     unsigned index,
-                                     void (*callback)(struct virtqueue *vq),
-                                     const char *name)
-{
-        struct mic_vdev *mvdev = to_micvdev(vdev);
-        struct mic_vqconfig __iomem *vqconfig;
-        struct mic_vqconfig config;
-        struct virtqueue *vq;
-        void __iomem *va;
-        struct _mic_vring_info __iomem *info;
-        void *used;
-        int vr_size, _vr_size, err, magic;
-        struct vring *vr;
-        u8 type = ioread8(&mvdev->desc->type);
-
-        if (index >= ioread8(&mvdev->desc->num_vq))
-                return ERR_PTR(-ENOENT);
-
-        if (!name)
-                return ERR_PTR(-ENOENT);
-
-        /* First assign the vring's allocated in host memory */
-        vqconfig = mic_vq_config(mvdev->desc) + index;
-        memcpy_fromio(&config, vqconfig, sizeof(config));
-        _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN);
-        vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info));
-        va = mic_card_map(mvdev->mdev, le64_to_cpu(config.address), vr_size);
-        if (!va)
-                return ERR_PTR(-ENOMEM);
-        mvdev->vr[index] = va;
-        memset_io(va, 0x0, _vr_size);
-        vq = vring_new_virtqueue(index, le16_to_cpu(config.num),
-                                 MIC_VIRTIO_RING_ALIGN, vdev, false,
-                                 (void __force *)va, mic_notify, callback,
-                                 name);
-        if (!vq) {
-                err = -ENOMEM;
-                goto unmap;
-        }
-        info = va + _vr_size;
-        magic = ioread32(&info->magic);
-
-        if (WARN(magic != MIC_MAGIC + type + index, "magic mismatch")) {
-                err = -EIO;
-                goto unmap;
-        }
-
-        /* Allocate and reassign used ring now */
-        mvdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
-                                             sizeof(struct vring_used_elem) *
-                                             le16_to_cpu(config.num));
-        used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
-                                        get_order(mvdev->used_size[index]));
-        if (!used) {
-                err = -ENOMEM;
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, err);
-                goto del_vq;
-        }
-        iowrite64(virt_to_phys(used), &vqconfig->used_address);
-
-        /*
-         * To reassign the used ring here we are directly accessing
-         * struct vring_virtqueue which is a private data structure
-         * in virtio_ring.c. At the minimum, a BUILD_BUG_ON() in
-         * vring_new_virtqueue() would ensure that
-         *  (&vq->vring == (struct vring *) (&vq->vq + 1));
-         */
-        vr = (struct vring *)(vq + 1);
-        vr->used = used;
-
-        vq->priv = mvdev;
-        return vq;
-del_vq:
-        vring_del_virtqueue(vq);
-unmap:
-        mic_card_unmap(mvdev->mdev, mvdev->vr[index]);
-        return ERR_PTR(err);
-}
-
-static int mic_find_vqs(struct virtio_device *vdev, unsigned nvqs,
-                        struct virtqueue *vqs[],
-                        vq_callback_t *callbacks[],
-                        const char * const names[])
-{
-        struct mic_vdev *mvdev = to_micvdev(vdev);
-        struct mic_device_ctrl __iomem *dc = mvdev->dc;
-        int i, err, retry;
-
-        /* We must have this many virtqueues. */
-        if (nvqs > ioread8(&mvdev->desc->num_vq))
-                return -ENOENT;
-
-        for (i = 0; i < nvqs; ++i) {
-                dev_dbg(mic_dev(mvdev), "%s: %d: %s\n",
-                        __func__, i, names[i]);
-                vqs[i] = mic_find_vq(vdev, i, callbacks[i], names[i]);
-                if (IS_ERR(vqs[i])) {
-                        err = PTR_ERR(vqs[i]);
-                        goto error;
-                }
-        }
-
-        iowrite8(1, &dc->used_address_updated);
-        /*
-         * Send an interrupt to the host to inform it that used
-         * rings have been re-assigned.
-         */
-        mic_send_intr(mvdev->mdev, mvdev->c2h_vdev_db);
-        for (retry = 100; retry--;) {
-                if (!ioread8(&dc->used_address_updated))
-                        break;
-                msleep(100);
-        };
-
-        dev_dbg(mic_dev(mvdev), "%s: retry: %d\n", __func__, retry);
-        if (!retry) {
-                err = -ENODEV;
-                goto error;
-        }
-
-        return 0;
-error:
-        mic_del_vqs(vdev);
-        return err;
-}
-
-/*
- * The config ops structure as defined by virtio config
- */
-static struct virtio_config_ops mic_vq_config_ops = {
-        .get_features = mic_get_features,
-        .finalize_features = mic_finalize_features,
-        .get = mic_get,
-        .set = mic_set,
-        .get_status = mic_get_status,
-        .set_status = mic_set_status,
-        .reset = mic_reset,
-        .find_vqs = mic_find_vqs,
-        .del_vqs = mic_del_vqs,
-};
-
-static irqreturn_t
-mic_virtio_intr_handler(int irq, void *data)
-{
-        struct mic_vdev *mvdev = data;
-        struct virtqueue *vq;
-
-        mic_ack_interrupt(mvdev->mdev);
-        list_for_each_entry(vq, &mvdev->vdev.vqs, list)
-                vring_interrupt(0, vq);
-
-        return IRQ_HANDLED;
-}
-
-static void mic_virtio_release_dev(struct device *_d)
-{
-        /*
-         * No need for a release method similar to virtio PCI.
-         * Provide an empty one to avoid getting a warning from core.
-         */
-}
-
-/*
- * adds a new device and register it with virtio
- * appropriate drivers are loaded by the device model
- */
-static int mic_add_device(struct mic_device_desc __iomem *d,
-        unsigned int offset, struct mic_driver *mdrv)
-{
-        struct mic_vdev *mvdev;
-        int ret;
-        int virtio_db;
-        u8 type = ioread8(&d->type);
-
-        mvdev = kzalloc(sizeof(*mvdev), GFP_KERNEL);
-        if (!mvdev) {
-                dev_err(mdrv->dev, "Cannot allocate mic dev %u type %u\n",
-                        offset, type);
-                return -ENOMEM;
-        }
-
-        mvdev->mdev = &mdrv->mdev;
-        mvdev->vdev.dev.parent = mdrv->dev;
-        mvdev->vdev.dev.release = mic_virtio_release_dev;
-        mvdev->vdev.id.device = type;
-        mvdev->vdev.config = &mic_vq_config_ops;
-        mvdev->desc = d;
-        mvdev->dc = (void __iomem *)d + mic_aligned_desc_size(d);
-        init_completion(&mvdev->reset_done);
-
-        virtio_db = mic_next_card_db();
-        mvdev->virtio_cookie = mic_request_card_irq(mic_virtio_intr_handler,
-                        NULL, "virtio intr", mvdev, virtio_db);
-        if (IS_ERR(mvdev->virtio_cookie)) {
-                ret = PTR_ERR(mvdev->virtio_cookie);
-                goto kfree;
-        }
-        iowrite8((u8)virtio_db, &mvdev->dc->h2c_vdev_db);
-        mvdev->c2h_vdev_db = ioread8(&mvdev->dc->c2h_vdev_db);
-
-        ret = register_virtio_device(&mvdev->vdev);
-        if (ret) {
-                dev_err(mic_dev(mvdev),
-                        "Failed to register mic device %u type %u\n",
-                        offset, type);
-                goto free_irq;
-        }
-        iowrite64((u64)mvdev, &mvdev->dc->vdev);
-        dev_dbg(mic_dev(mvdev), "%s: registered mic device %u type %u mvdev %p\n",
-                __func__, offset, type, mvdev);
-
-        return 0;
-
-free_irq:
-        mic_free_card_irq(mvdev->virtio_cookie, mvdev);
-kfree:
-        kfree(mvdev);
-        return ret;
-}
-
-/*
- * match for a mic device with a specific desc pointer
- */
-static int mic_match_desc(struct device *dev, void *data)
-{
-        struct virtio_device *vdev = dev_to_virtio(dev);
-        struct mic_vdev *mvdev = to_micvdev(vdev);
-
-        return mvdev->desc == (void __iomem *)data;
-}
-
-static void mic_handle_config_change(struct mic_device_desc __iomem *d,
-        unsigned int offset, struct mic_driver *mdrv)
-{
-        struct mic_device_ctrl __iomem *dc
-                = (void __iomem *)d + mic_aligned_desc_size(d);
-        struct mic_vdev *mvdev = (struct mic_vdev *)ioread64(&dc->vdev);
-
-        if (ioread8(&dc->config_change) != MIC_VIRTIO_PARAM_CONFIG_CHANGED)
-                return;
-
-        dev_dbg(mdrv->dev, "%s %d\n", __func__, __LINE__);
-        virtio_config_changed(&mvdev->vdev);
-        iowrite8(1, &dc->guest_ack);
-}
-
-/*
- * removes a virtio device if a hot remove event has been
- * requested by the host.
- */
-static int mic_remove_device(struct mic_device_desc __iomem *d,
-        unsigned int offset, struct mic_driver *mdrv)
-{
-        struct mic_device_ctrl __iomem *dc
-                = (void __iomem *)d + mic_aligned_desc_size(d);
-        struct mic_vdev *mvdev = (struct mic_vdev *)ioread64(&dc->vdev);
-        u8 status;
-        int ret = -1;
-
-        if (ioread8(&dc->config_change) == MIC_VIRTIO_PARAM_DEV_REMOVE) {
-                dev_dbg(mdrv->dev,
-                        "%s %d config_change %d type %d mvdev %p\n",
-                        __func__, __LINE__,
-                        ioread8(&dc->config_change), ioread8(&d->type), mvdev);
-
-                status = ioread8(&d->status);
-                reinit_completion(&mvdev->reset_done);
-                unregister_virtio_device(&mvdev->vdev);
-                mic_free_card_irq(mvdev->virtio_cookie, mvdev);
-                if (status & VIRTIO_CONFIG_S_DRIVER_OK)
-                        wait_for_completion(&mvdev->reset_done);
-                kfree(mvdev);
-                iowrite8(1, &dc->guest_ack);
-                dev_dbg(mdrv->dev, "%s %d guest_ack %d\n",
-                        __func__, __LINE__, ioread8(&dc->guest_ack));
-                ret = 0;
-        }
-
-        return ret;
-}
-
-#define REMOVE_DEVICES true
-
-static void mic_scan_devices(struct mic_driver *mdrv, bool remove)
-{
-        s8 type;
-        unsigned int i;
-        struct mic_device_desc __iomem *d;
-        struct mic_device_ctrl __iomem *dc;
-        struct device *dev;
-        int ret;
-
-        for (i = sizeof(struct mic_bootparam); i < MIC_DP_SIZE;
-                i += mic_total_desc_size(d)) {
-                d = mdrv->dp + i;
-                dc = (void __iomem *)d + mic_aligned_desc_size(d);
-                /*
-                 * This read barrier is paired with the corresponding write
-                 * barrier on the host which is inserted before adding or
-                 * removing a virtio device descriptor, by updating the type.
-                 */
-                rmb();
-                type = ioread8(&d->type);
-
-                /* end of list */
-                if (type == 0)
-                        break;
-
-                if (type == -1)
-                        continue;
-
-                /* device already exists */
-                dev = device_find_child(mdrv->dev, (void __force *)d,
-                                        mic_match_desc);
-                if (dev) {
-                        if (remove)
-                                iowrite8(MIC_VIRTIO_PARAM_DEV_REMOVE,
-                                         &dc->config_change);
-                        put_device(dev);
-                        mic_handle_config_change(d, i, mdrv);
-                        ret = mic_remove_device(d, i, mdrv);
-                        if (!ret && !remove)
-                                iowrite8(-1, &d->type);
-                        if (remove) {
-                                iowrite8(0, &dc->config_change);
-                                iowrite8(0, &dc->guest_ack);
-                        }
-                        continue;
-                }
-
-                /* new device */
-                dev_dbg(mdrv->dev, "%s %d Adding new virtio device %p\n",
-                        __func__, __LINE__, d);
-                if (!remove)
-                        mic_add_device(d, i, mdrv);
-        }
-}
-
-/*
- * mic_hotplug_device tries to find changes in the device page.
- */
-static void mic_hotplug_devices(struct work_struct *work)
-{
-        struct mic_driver *mdrv = container_of(work,
-                struct mic_driver, hotplug_work);
-
-        mic_scan_devices(mdrv, !REMOVE_DEVICES);
-}
-
-/*
- * Interrupt handler for hot plug/config changes etc.
- */
-static irqreturn_t
-mic_extint_handler(int irq, void *data)
-{
-        struct mic_driver *mdrv = (struct mic_driver *)data;
-
-        dev_dbg(mdrv->dev, "%s %d hotplug work\n",
-                __func__, __LINE__);
-        mic_ack_interrupt(&mdrv->mdev);
-        schedule_work(&mdrv->hotplug_work);
-        return IRQ_HANDLED;
-}
-
-/*
- * Init function for virtio
- */
-int mic_devices_init(struct mic_driver *mdrv)
-{
-        int rc;
-        struct mic_bootparam __iomem *bootparam;
-        int config_db;
-
-        INIT_WORK(&mdrv->hotplug_work, mic_hotplug_devices);
-        mic_scan_devices(mdrv, !REMOVE_DEVICES);
-
-        config_db = mic_next_card_db();
-        virtio_config_cookie = mic_request_card_irq(mic_extint_handler, NULL,
-                                                    "virtio_config_intr", mdrv,
-                                                    config_db);
-        if (IS_ERR(virtio_config_cookie)) {
-                rc = PTR_ERR(virtio_config_cookie);
-                goto exit;
-        }
-
-        bootparam = mdrv->dp;
-        iowrite8(config_db, &bootparam->h2c_config_db);
-        return 0;
-exit:
-        return rc;
-}
-
-/*
- * Uninit function for virtio
- */
-void mic_devices_uninit(struct mic_driver *mdrv)
-{
-        struct mic_bootparam __iomem *bootparam = mdrv->dp;
-        iowrite8(-1, &bootparam->h2c_config_db);
-        mic_free_card_irq(virtio_config_cookie, mdrv);
-        flush_work(&mdrv->hotplug_work);
-        mic_scan_devices(mdrv, REMOVE_DEVICES);
-}
diff --git a/drivers/misc/mic/card/mic_virtio.h b/drivers/misc/mic/card/mic_virtio.h
deleted file mode 100644
index d0407ba53bb7..000000000000
--- a/drivers/misc/mic/card/mic_virtio.h
+++ /dev/null
@@ -1,76 +0,0 @@
-/*
- * Intel MIC Platform Software Stack (MPSS)
- *
- * Copyright(c) 2013 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License, version 2, as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Disclaimer: The codes contained in these modules may be specific to
- * the Intel Software Development Platform codenamed: Knights Ferry, and
- * the Intel product codenamed: Knights Corner, and are not backward
- * compatible with other Intel products. Additionally, Intel will NOT
- * support the codes or instruction set in future products.
- *
- * Intel MIC Card driver.
- *
- */
-#ifndef __MIC_CARD_VIRTIO_H
-#define __MIC_CARD_VIRTIO_H
-
-#include <linux/mic_common.h>
-#include "mic_device.h"
-
-/*
- * 64 bit I/O access
- */
-#ifndef ioread64
-#define ioread64 readq
-#endif
-#ifndef iowrite64
-#define iowrite64 writeq
-#endif
-
-static inline unsigned mic_desc_size(struct mic_device_desc __iomem *desc)
-{
-        return sizeof(*desc)
-                + ioread8(&desc->num_vq) * sizeof(struct mic_vqconfig)
-                + ioread8(&desc->feature_len) * 2
-                + ioread8(&desc->config_len);
-}
-
-static inline struct mic_vqconfig __iomem *
-mic_vq_config(struct mic_device_desc __iomem *desc)
-{
-        return (struct mic_vqconfig __iomem *)(desc + 1);
-}
-
-static inline __u8 __iomem *
-mic_vq_features(struct mic_device_desc __iomem *desc)
-{
-        return (__u8 __iomem *)(mic_vq_config(desc) + ioread8(&desc->num_vq));
-}
-
-static inline __u8 __iomem *
-mic_vq_configspace(struct mic_device_desc __iomem *desc)
-{
-        return mic_vq_features(desc) + ioread8(&desc->feature_len) * 2;
-}
-static inline unsigned mic_total_desc_size(struct mic_device_desc __iomem *desc)
-{
-        return mic_aligned_desc_size(desc) + sizeof(struct mic_device_ctrl);
-}
-
-int mic_devices_init(struct mic_driver *mdrv);
-void mic_devices_uninit(struct mic_driver *mdrv);
-
-#endif
diff --git a/drivers/misc/mic/card/mic_x100.c b/drivers/misc/mic/card/mic_x100.c
index b2958ce2368c..b9f0710ffa6b 100644
--- a/drivers/misc/mic/card/mic_x100.c
+++ b/drivers/misc/mic/card/mic_x100.c
@@ -326,6 +326,7 @@ static int __init mic_init(void)
                 goto done;
         }
 
+        request_module("mic_x100_dma");
         mic_init_card_debugfs();
         ret = platform_device_register(&mic_platform_dev);
         if (ret) {
diff --git a/drivers/misc/mic/cosm/cosm_main.c b/drivers/misc/mic/cosm/cosm_main.c
index 4b4b356c797d..7005cb1e01d2 100644
--- a/drivers/misc/mic/cosm/cosm_main.c
+++ b/drivers/misc/mic/cosm/cosm_main.c
@@ -153,8 +153,10 @@ void cosm_stop(struct cosm_device *cdev, bool force)
                  * stop(..) calls device_unregister and will crash the system if
                  * called multiple times.
                  */
-                bool call_hw_ops = cdev->state != MIC_RESET_FAILED &&
-                                        cdev->state != MIC_READY;
+                u8 state = cdev->state == MIC_RESETTING ?
+                                        cdev->prev_state : cdev->state;
+                bool call_hw_ops = state != MIC_RESET_FAILED &&
+                                        state != MIC_READY;
 
                 if (cdev->state != MIC_RESETTING)
                         cosm_set_state(cdev, MIC_RESETTING);
@@ -195,8 +197,11 @@ int cosm_reset(struct cosm_device *cdev)
 
         mutex_lock(&cdev->cosm_mutex);
         if (cdev->state != MIC_READY) {
-                cosm_set_state(cdev, MIC_RESETTING);
-                schedule_work(&cdev->reset_trigger_work);
+                if (cdev->state != MIC_RESETTING) {
+                        cdev->prev_state = cdev->state;
+                        cosm_set_state(cdev, MIC_RESETTING);
+                        schedule_work(&cdev->reset_trigger_work);
+                }
         } else {
                 dev_err(&cdev->dev, "%s %d MIC is READY\n", __func__, __LINE__);
                 rc = -EINVAL;
diff --git a/drivers/misc/mic/host/Makefile b/drivers/misc/mic/host/Makefile
index 004d3db0f990..f3b502333ded 100644
--- a/drivers/misc/mic/host/Makefile
+++ b/drivers/misc/mic/host/Makefile
@@ -9,5 +9,3 @@ mic_host-objs += mic_smpt.o
 mic_host-objs += mic_intr.o
 mic_host-objs += mic_boot.o
 mic_host-objs += mic_debugfs.o
-mic_host-objs += mic_fops.o
-mic_host-objs += mic_virtio.o
diff --git a/drivers/misc/mic/host/mic_boot.c b/drivers/misc/mic/host/mic_boot.c
index 7845564dff64..8c91c9950b54 100644
--- a/drivers/misc/mic/host/mic_boot.c
+++ b/drivers/misc/mic/host/mic_boot.c
@@ -25,10 +25,117 @@
 #include <linux/mic_common.h>
 #include <linux/mic_bus.h>
 #include "../bus/scif_bus.h"
+#include "../bus/vop_bus.h"
 #include "../common/mic_dev.h"
 #include "mic_device.h"
 #include "mic_smpt.h"
-#include "mic_virtio.h"
+
+static inline struct mic_device *vpdev_to_mdev(struct device *dev)
+{
+        return dev_get_drvdata(dev->parent);
+}
+
+static dma_addr_t
+_mic_dma_map_page(struct device *dev, struct page *page,
+                  unsigned long offset, size_t size,
+                  enum dma_data_direction dir, struct dma_attrs *attrs)
+{
+        void *va = phys_to_virt(page_to_phys(page)) + offset;
+        struct mic_device *mdev = vpdev_to_mdev(dev);
+
+        return mic_map_single(mdev, va, size);
+}
+
+static void _mic_dma_unmap_page(struct device *dev, dma_addr_t dma_addr,
+                                size_t size, enum dma_data_direction dir,
+                                struct dma_attrs *attrs)
+{
+        struct mic_device *mdev = vpdev_to_mdev(dev);
+
+        mic_unmap_single(mdev, dma_addr, size);
+}
+
+static const struct dma_map_ops _mic_dma_ops = {
+        .map_page = _mic_dma_map_page,
+        .unmap_page = _mic_dma_unmap_page,
+};
+
+static struct mic_irq *
+__mic_request_irq(struct vop_device *vpdev,
+                  irqreturn_t (*func)(int irq, void *data),
+                  const char *name, void *data, int intr_src)
+{
+        struct mic_device *mdev = vpdev_to_mdev(&vpdev->dev);
+
+        return mic_request_threaded_irq(mdev, func, NULL, name, data,
+                                        intr_src, MIC_INTR_DB);
+}
+
+static void __mic_free_irq(struct vop_device *vpdev,
+                           struct mic_irq *cookie, void *data)
+{
+        struct mic_device *mdev = vpdev_to_mdev(&vpdev->dev);
+
+        return mic_free_irq(mdev, cookie, data);
+}
+
+static void __mic_ack_interrupt(struct vop_device *vpdev, int num)
+{
+        struct mic_device *mdev = vpdev_to_mdev(&vpdev->dev);
+
+        mdev->ops->intr_workarounds(mdev);
+}
+
+static int __mic_next_db(struct vop_device *vpdev)
+{
+        struct mic_device *mdev = vpdev_to_mdev(&vpdev->dev);
+
+        return mic_next_db(mdev);
+}
+
+static void *__mic_get_dp(struct vop_device *vpdev)
+{
+        struct mic_device *mdev = vpdev_to_mdev(&vpdev->dev);
+
+        return mdev->dp;
+}
+
+static void __iomem *__mic_get_remote_dp(struct vop_device *vpdev)
+{
+        return NULL;
+}
+
+static void __mic_send_intr(struct vop_device *vpdev, int db)
+{
+        struct mic_device *mdev = vpdev_to_mdev(&vpdev->dev);
+
+        mdev->ops->send_intr(mdev, db);
+}
+
+static void __iomem *__mic_ioremap(struct vop_device *vpdev,
+                                   dma_addr_t pa, size_t len)
+{
+        struct mic_device *mdev = vpdev_to_mdev(&vpdev->dev);
+
+        return mdev->aper.va + pa;
+}
+
+static void __mic_iounmap(struct vop_device *vpdev, void __iomem *va)
+{
+        /* nothing to do */
+}
+
+static struct vop_hw_ops vop_hw_ops = {
+        .request_irq = __mic_request_irq,
+        .free_irq = __mic_free_irq,
+        .ack_interrupt = __mic_ack_interrupt,
+        .next_db = __mic_next_db,
+        .get_dp = __mic_get_dp,
+        .get_remote_dp = __mic_get_remote_dp,
+        .send_intr = __mic_send_intr,
+        .ioremap = __mic_ioremap,
+        .iounmap = __mic_iounmap,
+};
 
 static inline struct mic_device *scdev_to_mdev(struct scif_hw_dev *scdev)
 {
@@ -315,7 +422,6 @@ static int mic_request_dma_chans(struct mic_device *mdev)
         dma_cap_mask_t mask;
         struct dma_chan *chan;
 
-        request_module("mic_x100_dma");
         dma_cap_zero(mask);
         dma_cap_set(DMA_MEMCPY, mask);
 
@@ -387,9 +493,18 @@ static int _mic_start(struct cosm_device *cdev, int id)
                 goto dma_free;
         }
 
+        mdev->vpdev = vop_register_device(&mdev->pdev->dev,
+                                          VOP_DEV_TRNSP, &_mic_dma_ops,
+                                          &vop_hw_ops, id + 1, &mdev->aper,
+                                          mdev->dma_ch[0]);
+        if (IS_ERR(mdev->vpdev)) {
+                rc = PTR_ERR(mdev->vpdev);
+                goto scif_remove;
+        }
+
         rc = mdev->ops->load_mic_fw(mdev, NULL);
         if (rc)
-                goto scif_remove;
+                goto vop_remove;
         mic_smpt_restore(mdev);
         mic_intr_restore(mdev);
         mdev->intr_ops->enable_interrupts(mdev);
@@ -397,6 +512,8 @@ static int _mic_start(struct cosm_device *cdev, int id)
         mdev->ops->write_spad(mdev, MIC_DPHI_SPAD, mdev->dp_dma_addr >> 32);
         mdev->ops->send_firmware_intr(mdev);
         goto unlock_ret;
+vop_remove:
+        vop_unregister_device(mdev->vpdev);
 scif_remove:
         scif_unregister_device(mdev->scdev);
 dma_free:
@@ -423,7 +540,7 @@ static void _mic_stop(struct cosm_device *cdev, bool force)
          * will be the first to be registered and the last to be
          * unregistered.
          */
-        mic_virtio_reset_devices(mdev);
+        vop_unregister_device(mdev->vpdev);
         scif_unregister_device(mdev->scdev);
         mic_free_dma_chans(mdev);
         mbus_unregister_device(mdev->dma_mbdev);
diff --git a/drivers/misc/mic/host/mic_debugfs.c b/drivers/misc/mic/host/mic_debugfs.c
index 10581600777a..0a9daba8bb5d 100644
--- a/drivers/misc/mic/host/mic_debugfs.c
+++ b/drivers/misc/mic/host/mic_debugfs.c
@@ -26,7 +26,6 @@
 #include "../common/mic_dev.h"
 #include "mic_device.h"
 #include "mic_smpt.h"
-#include "mic_virtio.h"
 
 /* Debugfs parent dir */
 static struct dentry *mic_dbg;
@@ -100,190 +99,6 @@ static const struct file_operations post_code_ops = {
         .release = mic_post_code_debug_release
 };
 
-static int mic_dp_show(struct seq_file *s, void *pos)
-{
-        struct mic_device *mdev = s->private;
-        struct mic_device_desc *d;
-        struct mic_device_ctrl *dc;
-        struct mic_vqconfig *vqconfig;
-        __u32 *features;
-        __u8 *config;
-        struct mic_bootparam *bootparam = mdev->dp;
-        int i, j;
-
-        seq_printf(s, "Bootparam: magic 0x%x\n",
-                   bootparam->magic);
-        seq_printf(s, "Bootparam: h2c_config_db %d\n",
-                   bootparam->h2c_config_db);
-        seq_printf(s, "Bootparam: node_id %d\n",
-                   bootparam->node_id);
-        seq_printf(s, "Bootparam: c2h_scif_db %d\n",
-                   bootparam->c2h_scif_db);
-        seq_printf(s, "Bootparam: h2c_scif_db %d\n",
-                   bootparam->h2c_scif_db);
-        seq_printf(s, "Bootparam: scif_host_dma_addr 0x%llx\n",
-                   bootparam->scif_host_dma_addr);
-        seq_printf(s, "Bootparam: scif_card_dma_addr 0x%llx\n",
-                   bootparam->scif_card_dma_addr);
-
-
-        for (i = sizeof(*bootparam); i < MIC_DP_SIZE;
-             i += mic_total_desc_size(d)) {
-                d = mdev->dp + i;
-                dc = (void *)d + mic_aligned_desc_size(d);
-
-                /* end of list */
-                if (d->type == 0)
-                        break;
-
-                if (d->type == -1)
-                        continue;
-
-                seq_printf(s, "Type %d ", d->type);
-                seq_printf(s, "Num VQ %d ", d->num_vq);
-                seq_printf(s, "Feature Len %d\n", d->feature_len);
-                seq_printf(s, "Config Len %d ", d->config_len);
-                seq_printf(s, "Shutdown Status %d\n", d->status);
-
-                for (j = 0; j < d->num_vq; j++) {
-                        vqconfig = mic_vq_config(d) + j;
-                        seq_printf(s, "vqconfig[%d]: ", j);
-                        seq_printf(s, "address 0x%llx ", vqconfig->address);
-                        seq_printf(s, "num %d ", vqconfig->num);
-                        seq_printf(s, "used address 0x%llx\n",
-                                   vqconfig->used_address);
-                }
-
-                features = (__u32 *)mic_vq_features(d);
-                seq_printf(s, "Features: Host 0x%x ", features[0]);
-                seq_printf(s, "Guest 0x%x\n", features[1]);
-
-                config = mic_vq_configspace(d);
-                for (j = 0; j < d->config_len; j++)
-                        seq_printf(s, "config[%d]=%d\n", j, config[j]);
-
-                seq_puts(s, "Device control:\n");
-                seq_printf(s, "Config Change %d ", dc->config_change);
-                seq_printf(s, "Vdev reset %d\n", dc->vdev_reset);
-                seq_printf(s, "Guest Ack %d ", dc->guest_ack);
-                seq_printf(s, "Host ack %d\n", dc->host_ack);
-                seq_printf(s, "Used address updated %d ",
-                           dc->used_address_updated);
-                seq_printf(s, "Vdev 0x%llx\n", dc->vdev);
-                seq_printf(s, "c2h doorbell %d ", dc->c2h_vdev_db);
-                seq_printf(s, "h2c doorbell %d\n", dc->h2c_vdev_db);
-        }
-
-        return 0;
-}
-
-static int mic_dp_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_dp_show, inode->i_private);
-}
-
-static int mic_dp_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations dp_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_dp_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_dp_debug_release
-};
-
-static int mic_vdev_info_show(struct seq_file *s, void *unused)
-{
-        struct mic_device *mdev = s->private;
-        struct list_head *pos, *tmp;
-        struct mic_vdev *mvdev;
-        int i, j;
-
-        mutex_lock(&mdev->mic_mutex);
-        list_for_each_safe(pos, tmp, &mdev->vdev_list) {
-                mvdev = list_entry(pos, struct mic_vdev, list);
-                seq_printf(s, "VDEV type %d state %s in %ld out %ld\n",
-                           mvdev->virtio_id,
-                           mic_vdevup(mvdev) ? "UP" : "DOWN",
-                           mvdev->in_bytes,
-                           mvdev->out_bytes);
-                for (i = 0; i < MIC_MAX_VRINGS; i++) {
-                        struct vring_desc *desc;
-                        struct vring_avail *avail;
-                        struct vring_used *used;
-                        struct mic_vringh *mvr = &mvdev->mvr[i];
-                        struct vringh *vrh = &mvr->vrh;
-                        int num = vrh->vring.num;
-                        if (!num)
-                                continue;
-                        desc = vrh->vring.desc;
-                        seq_printf(s, "vring i %d avail_idx %d",
-                                   i, mvr->vring.info->avail_idx & (num - 1));
-                        seq_printf(s, " vring i %d avail_idx %d\n",
-                                   i, mvr->vring.info->avail_idx);
-                        seq_printf(s, "vrh i %d weak_barriers %d",
-                                   i, vrh->weak_barriers);
-                        seq_printf(s, " last_avail_idx %d last_used_idx %d",
-                                   vrh->last_avail_idx, vrh->last_used_idx);
-                        seq_printf(s, " completed %d\n", vrh->completed);
-                        for (j = 0; j < num; j++) {
-                                seq_printf(s, "desc[%d] addr 0x%llx len %d",
-                                           j, desc->addr, desc->len);
-                                seq_printf(s, " flags 0x%x next %d\n",
-                                           desc->flags, desc->next);
-                                desc++;
-                        }
-                        avail = vrh->vring.avail;
-                        seq_printf(s, "avail flags 0x%x idx %d\n",
-                                   vringh16_to_cpu(vrh, avail->flags),
-                                   vringh16_to_cpu(vrh, avail->idx) & (num - 1));
-                        seq_printf(s, "avail flags 0x%x idx %d\n",
-                                   vringh16_to_cpu(vrh, avail->flags),
-                                   vringh16_to_cpu(vrh, avail->idx));
-                        for (j = 0; j < num; j++)
-                                seq_printf(s, "avail ring[%d] %d\n",
-                                           j, avail->ring[j]);
-                        used = vrh->vring.used;
-                        seq_printf(s, "used flags 0x%x idx %d\n",
-                                   vringh16_to_cpu(vrh, used->flags),
-                                   vringh16_to_cpu(vrh, used->idx) & (num - 1));
-                        seq_printf(s, "used flags 0x%x idx %d\n",
-                                   vringh16_to_cpu(vrh, used->flags),
-                                   vringh16_to_cpu(vrh, used->idx));
-                        for (j = 0; j < num; j++)
-                                seq_printf(s, "used ring[%d] id %d len %d\n",
-                                           j, vringh32_to_cpu(vrh,
-                                                              used->ring[j].id),
-                                           vringh32_to_cpu(vrh,
-                                                           used->ring[j].len));
-                }
-        }
-        mutex_unlock(&mdev->mic_mutex);
-
-        return 0;
-}
-
-static int mic_vdev_info_debug_open(struct inode *inode, struct file *file)
-{
-        return single_open(file, mic_vdev_info_show, inode->i_private);
-}
-
-static int mic_vdev_info_debug_release(struct inode *inode, struct file *file)
-{
-        return single_release(inode, file);
-}
-
-static const struct file_operations vdev_info_ops = {
-        .owner   = THIS_MODULE,
-        .open    = mic_vdev_info_debug_open,
-        .read    = seq_read,
-        .llseek  = seq_lseek,
-        .release = mic_vdev_info_debug_release
-};
-
 static int mic_msi_irq_info_show(struct seq_file *s, void *pos)
 {
         struct mic_device *mdev  = s->private;
@@ -367,11 +182,6 @@ void mic_create_debug_dir(struct mic_device *mdev)
         debugfs_create_file("post_code", 0444, mdev->dbg_dir, mdev,
                             &post_code_ops);
 
-        debugfs_create_file("dp", 0444, mdev->dbg_dir, mdev, &dp_ops);
-
-        debugfs_create_file("vdev_info", 0444, mdev->dbg_dir, mdev,
-                            &vdev_info_ops);
-
         debugfs_create_file("msi_irq_info", 0444, mdev->dbg_dir, mdev,
                             &msi_irq_info_ops);
 }
diff --git a/drivers/misc/mic/host/mic_device.h b/drivers/misc/mic/host/mic_device.h
index 461184a12fbb..52b12b22f4ae 100644
--- a/drivers/misc/mic/host/mic_device.h
+++ b/drivers/misc/mic/host/mic_device.h
@@ -29,6 +29,7 @@
 #include <linux/miscdevice.h>
 #include <linux/mic_bus.h>
 #include "../bus/scif_bus.h"
+#include "../bus/vop_bus.h"
 #include "../bus/cosm_bus.h"
 #include "mic_intr.h"
 
@@ -64,13 +65,11 @@ extern struct cosm_hw_ops cosm_hw_ops;
  * @bootaddr: MIC boot address.
  * @dp: virtio device page
  * @dp_dma_addr: virtio device page DMA address.
- * @name: name for the misc char device
- * @miscdev: registered misc char device
- * @vdev_list: list of virtio devices.
  * @dma_mbdev: MIC BUS DMA device.
  * @dma_ch - Array of DMA channels
  * @num_dma_ch - Number of DMA channels available
  * @scdev: SCIF device on the SCIF virtual bus.
+ * @vpdev: Virtio over PCIe device on the VOP virtual bus.
  * @cosm_dev: COSM device
  */
 struct mic_device {
@@ -91,13 +90,11 @@ struct mic_device {
         u32 bootaddr;
         void *dp;
         dma_addr_t dp_dma_addr;
-        char name[16];
-        struct miscdevice miscdev;
-        struct list_head vdev_list;
         struct mbus_device *dma_mbdev;
         struct dma_chan *dma_ch[MIC_MAX_DMA_CHAN];
         int num_dma_ch;
         struct scif_hw_dev *scdev;
+        struct vop_device *vpdev;
         struct cosm_device *cosm_dev;
 };
 
diff --git a/drivers/misc/mic/host/mic_fops.c b/drivers/misc/mic/host/mic_fops.c
deleted file mode 100644
index 8cc1d90cd949..000000000000
--- a/drivers/misc/mic/host/mic_fops.c
+++ /dev/null
@@ -1,222 +0,0 @@
-/*
- * Intel MIC Platform Software Stack (MPSS)
- *
- * Copyright(c) 2013 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License, version 2, as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Intel MIC Host driver.
- *
- */
-#include <linux/poll.h>
-#include <linux/pci.h>
-
-#include <linux/mic_common.h>
-#include "../common/mic_dev.h"
-#include "mic_device.h"
-#include "mic_fops.h"
-#include "mic_virtio.h"
-
-int mic_open(struct inode *inode, struct file *f)
-{
-        struct mic_vdev *mvdev;
-        struct mic_device *mdev = container_of(f->private_data,
-                struct mic_device, miscdev);
-
-        mvdev = kzalloc(sizeof(*mvdev), GFP_KERNEL);
-        if (!mvdev)
-                return -ENOMEM;
-
-        init_waitqueue_head(&mvdev->waitq);
-        INIT_LIST_HEAD(&mvdev->list);
-        mvdev->mdev = mdev;
-        mvdev->virtio_id = -1;
-
-        f->private_data = mvdev;
-        return 0;
-}
-
-int mic_release(struct inode *inode, struct file *f)
-{
-        struct mic_vdev *mvdev = (struct mic_vdev *)f->private_data;
-
-        if (-1 != mvdev->virtio_id)
-                mic_virtio_del_device(mvdev);
-        f->private_data = NULL;
-        kfree(mvdev);
-        return 0;
-}
-
-long mic_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
-{
-        struct mic_vdev *mvdev = (struct mic_vdev *)f->private_data;
-        void __user *argp = (void __user *)arg;
-        int ret;
-
-        switch (cmd) {
-        case MIC_VIRTIO_ADD_DEVICE:
-        {
-                ret = mic_virtio_add_device(mvdev, argp);
-                if (ret < 0) {
-                        dev_err(mic_dev(mvdev),
-                                "%s %d errno ret %d\n",
-                                __func__, __LINE__, ret);
-                        return ret;
-                }
-                break;
-        }
-        case MIC_VIRTIO_COPY_DESC:
-        {
-                struct mic_copy_desc copy;
-
-                ret = mic_vdev_inited(mvdev);
-                if (ret)
-                        return ret;
-
-                if (copy_from_user(&copy, argp, sizeof(copy)))
-                        return -EFAULT;
-
-                dev_dbg(mic_dev(mvdev),
-                        "%s %d === iovcnt 0x%x vr_idx 0x%x update_used %d\n",
-                        __func__, __LINE__, copy.iovcnt, copy.vr_idx,
-                        copy.update_used);
-
-                ret = mic_virtio_copy_desc(mvdev, &copy);
-                if (ret < 0) {
-                        dev_err(mic_dev(mvdev),
-                                "%s %d errno ret %d\n",
-                                __func__, __LINE__, ret);
-                        return ret;
-                }
-                if (copy_to_user(
-                        &((struct mic_copy_desc __user *)argp)->out_len,
-                        &copy.out_len, sizeof(copy.out_len))) {
-                        dev_err(mic_dev(mvdev), "%s %d errno ret %d\n",
-                                __func__, __LINE__, -EFAULT);
-                        return -EFAULT;
-                }
-                break;
-        }
-        case MIC_VIRTIO_CONFIG_CHANGE:
-        {
-                ret = mic_vdev_inited(mvdev);
-                if (ret)
-                        return ret;
-
-                ret = mic_virtio_config_change(mvdev, argp);
-                if (ret < 0) {
-                        dev_err(mic_dev(mvdev),
-                                "%s %d errno ret %d\n",
-                                __func__, __LINE__, ret);
-                        return ret;
-                }
-                break;
-        }
-        default:
-                return -ENOIOCTLCMD;
-        };
-        return 0;
-}
-
-/*
- * We return POLLIN | POLLOUT from poll when new buffers are enqueued, and
- * not when previously enqueued buffers may be available. This means that
- * in the card->host (TX) path, when userspace is unblocked by poll it
- * must drain all available descriptors or it can stall.
- */
-unsigned int mic_poll(struct file *f, poll_table *wait)
-{
-        struct mic_vdev *mvdev = (struct mic_vdev *)f->private_data;
-        int mask = 0;
-
-        poll_wait(f, &mvdev->waitq, wait);
-
-        if (mic_vdev_inited(mvdev)) {
-                mask = POLLERR;
-        } else if (mvdev->poll_wake) {
-                mvdev->poll_wake = 0;
-                mask = POLLIN | POLLOUT;
-        }
-
-        return mask;
-}
-
-static inline int
-mic_query_offset(struct mic_vdev *mvdev, unsigned long offset,
-                 unsigned long *size, unsigned long *pa)
-{
-        struct mic_device *mdev = mvdev->mdev;
-        unsigned long start = MIC_DP_SIZE;
-        int i;
-
-        /*
-         * MMAP interface is as follows:
-         * offset                               region
-         * 0x0                                  virtio device_page
-         * 0x1000                               first vring
-         * 0x1000 + size of 1st vring           second vring
-         * ....
-         */
-        if (!offset) {
-                *pa = virt_to_phys(mdev->dp);
-                *size = MIC_DP_SIZE;
-                return 0;
-        }
-
-        for (i = 0; i < mvdev->dd->num_vq; i++) {
-                struct mic_vringh *mvr = &mvdev->mvr[i];
-                if (offset == start) {
-                        *pa = virt_to_phys(mvr->vring.va);
-                        *size = mvr->vring.len;
-                        return 0;
-                }
-                start += mvr->vring.len;
-        }
-        return -1;
-}
-
-/*
- * Maps the device page and virtio rings to user space for readonly access.
- */
-int
-mic_mmap(struct file *f, struct vm_area_struct *vma)
-{
-        struct mic_vdev *mvdev = (struct mic_vdev *)f->private_data;
-        unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
-        unsigned long pa, size = vma->vm_end - vma->vm_start, size_rem = size;
-        int i, err;
-
-        err = mic_vdev_inited(mvdev);
-        if (err)
-                return err;
-
-        if (vma->vm_flags & VM_WRITE)
-                return -EACCES;
-
-        while (size_rem) {
-                i = mic_query_offset(mvdev, offset, &size, &pa);
-                if (i < 0)
-                        return -EINVAL;
-                err = remap_pfn_range(vma, vma->vm_start + offset,
-                        pa >> PAGE_SHIFT, size, vma->vm_page_prot);
-                if (err)
-                        return err;
-                dev_dbg(mic_dev(mvdev),
-                        "%s %d type %d size 0x%lx off 0x%lx pa 0x%lx vma 0x%lx\n",
-                        __func__, __LINE__, mvdev->virtio_id, size, offset,
-                        pa, vma->vm_start + offset);
-                size_rem -= size;
-                offset += size;
-        }
-        return 0;
-}
diff --git a/drivers/misc/mic/host/mic_fops.h b/drivers/misc/mic/host/mic_fops.h
deleted file mode 100644
index dc3893dff667..000000000000
--- a/drivers/misc/mic/host/mic_fops.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Intel MIC Platform Software Stack (MPSS)
- *
- * Copyright(c) 2013 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License, version 2, as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Intel MIC Host driver.
- *
- */
-#ifndef _MIC_FOPS_H_
-#define _MIC_FOPS_H_
-
-int mic_open(struct inode *inode, struct file *filp);
-int mic_release(struct inode *inode, struct file *filp);
-ssize_t mic_read(struct file *filp, char __user *buf,
-                        size_t count, loff_t *pos);
-long mic_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);
-int mic_mmap(struct file *f, struct vm_area_struct *vma);
-unsigned int mic_poll(struct file *f, poll_table *wait);
-
-#endif
diff --git a/drivers/misc/mic/host/mic_main.c b/drivers/misc/mic/host/mic_main.c
index 153894e7ed5b..035be3e9ceba 100644
--- a/drivers/misc/mic/host/mic_main.c
+++ b/drivers/misc/mic/host/mic_main.c
@@ -27,8 +27,6 @@
 #include "mic_device.h"
 #include "mic_x100.h"
 #include "mic_smpt.h"
-#include "mic_fops.h"
-#include "mic_virtio.h"
 
 static const char mic_driver_name[] = "mic";
 
@@ -57,17 +55,6 @@ MODULE_DEVICE_TABLE(pci, mic_pci_tbl);
 
 /* ID allocator for MIC devices */
 static struct ida g_mic_ida;
-/* Base device node number for MIC devices */
-static dev_t g_mic_devno;
-
-static const struct file_operations mic_fops = {
-        .open = mic_open,
-        .release = mic_release,
-        .unlocked_ioctl = mic_ioctl,
-        .poll = mic_poll,
-        .mmap = mic_mmap,
-        .owner = THIS_MODULE,
-};
 
 /* Initialize the device page */
 static int mic_dp_init(struct mic_device *mdev)
@@ -169,7 +156,6 @@ mic_device_init(struct mic_device *mdev, struct pci_dev *pdev)
         mic_ops_init(mdev);
         mutex_init(&mdev->mic_mutex);
         mdev->irq_info.next_avail_src = 0;
-        INIT_LIST_HEAD(&mdev->vdev_list);
 }
 
 /**
@@ -259,30 +245,15 @@ static int mic_probe(struct pci_dev *pdev,
                 goto smpt_uninit;
         }
         mic_bootparam_init(mdev);
-
         mic_create_debug_dir(mdev);
 
-        mdev->miscdev.minor = MISC_DYNAMIC_MINOR;
-        snprintf(mdev->name, sizeof(mdev->name), "mic%d", mdev->id);
-        mdev->miscdev.name = mdev->name;
-        mdev->miscdev.fops = &mic_fops;
-        mdev->miscdev.parent = &mdev->pdev->dev;
-        rc = misc_register(&mdev->miscdev);
-        if (rc) {
-                dev_err(&pdev->dev, "misc_register err id %d rc %d\n",
-                        mdev->id, rc);
-                goto cleanup_debug_dir;
-        }
-
         mdev->cosm_dev = cosm_register_device(&mdev->pdev->dev, &cosm_hw_ops);
         if (IS_ERR(mdev->cosm_dev)) {
                 rc = PTR_ERR(mdev->cosm_dev);
                 dev_err(&pdev->dev, "cosm_add_device failed rc %d\n", rc);
-                goto misc_dereg;
+                goto cleanup_debug_dir;
         }
         return 0;
-misc_dereg:
-        misc_deregister(&mdev->miscdev);
 cleanup_debug_dir:
         mic_delete_debug_dir(mdev);
         mic_dp_uninit(mdev);
@@ -323,7 +294,6 @@ static void mic_remove(struct pci_dev *pdev)
                 return;
 
         cosm_unregister_device(mdev->cosm_dev);
-        misc_deregister(&mdev->miscdev);
         mic_delete_debug_dir(mdev);
         mic_dp_uninit(mdev);
         mic_smpt_uninit(mdev);
@@ -347,26 +317,18 @@ static int __init mic_init(void)
 {
         int ret;
 
-        ret = alloc_chrdev_region(&g_mic_devno, 0,
-                                  MIC_MAX_NUM_DEVS, mic_driver_name);
-        if (ret) {
-                pr_err("alloc_chrdev_region failed ret %d\n", ret);
-                goto error;
-        }
-
+        request_module("mic_x100_dma");
         mic_init_debugfs();
         ida_init(&g_mic_ida);
         ret = pci_register_driver(&mic_driver);
         if (ret) {
                 pr_err("pci_register_driver failed ret %d\n", ret);
-                goto cleanup_chrdev;
+                goto cleanup_debugfs;
         }
-        return ret;
-cleanup_chrdev:
+        return 0;
+cleanup_debugfs:
         ida_destroy(&g_mic_ida);
         mic_exit_debugfs();
-        unregister_chrdev_region(g_mic_devno, MIC_MAX_NUM_DEVS);
-error:
         return ret;
 }
 
@@ -375,7 +337,6 @@ static void __exit mic_exit(void)
         pci_unregister_driver(&mic_driver);
         ida_destroy(&g_mic_ida);
         mic_exit_debugfs();
-        unregister_chrdev_region(g_mic_devno, MIC_MAX_NUM_DEVS);
 }
 
 module_init(mic_init);
diff --git a/drivers/misc/mic/host/mic_virtio.c b/drivers/misc/mic/host/mic_virtio.c
deleted file mode 100644
index 58b107a24a8b..000000000000
--- a/drivers/misc/mic/host/mic_virtio.c
+++ /dev/null
@@ -1,811 +0,0 @@
-/*
- * Intel MIC Platform Software Stack (MPSS)
- *
- * Copyright(c) 2013 Intel Corporation.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License, version 2, as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * The full GNU General Public License is included in this distribution in
- * the file called "COPYING".
- *
- * Intel MIC Host driver.
- *
- */
-#include <linux/pci.h>
-#include <linux/sched.h>
-#include <linux/uaccess.h>
-#include <linux/dmaengine.h>
-#include <linux/mic_common.h>
-#include "../common/mic_dev.h"
-#include "mic_device.h"
-#include "mic_smpt.h"
-#include "mic_virtio.h"
-
-/*
- * Size of the internal buffer used during DMA's as an intermediate buffer
- * for copy to/from user.
- */
-#define MIC_INT_DMA_BUF_SIZE PAGE_ALIGN(64 * 1024ULL)
-
-static int mic_sync_dma(struct mic_device *mdev, dma_addr_t dst,
-                        dma_addr_t src, size_t len)
-{
-        int err = 0;
-        struct dma_async_tx_descriptor *tx;
-        struct dma_chan *mic_ch = mdev->dma_ch[0];
-
-        if (!mic_ch) {
-                err = -EBUSY;
-                goto error;
-        }
-
-        tx = mic_ch->device->device_prep_dma_memcpy(mic_ch, dst, src, len,
-                                                    DMA_PREP_FENCE);
-        if (!tx) {
-                err = -ENOMEM;
-                goto error;
-        } else {
-                dma_cookie_t cookie = tx->tx_submit(tx);
-
-                err = dma_submit_error(cookie);
-                if (err)
-                        goto error;
-                err = dma_sync_wait(mic_ch, cookie);
-        }
-error:
-        if (err)
-                dev_err(&mdev->pdev->dev, "%s %d err %d\n",
-                        __func__, __LINE__, err);
-        return err;
-}
-
-/*
- * Initiates the copies across the PCIe bus from card memory to a user
- * space buffer. When transfers are done using DMA, source/destination
- * addresses and transfer length must follow the alignment requirements of
- * the MIC DMA engine.
- */
-static int mic_virtio_copy_to_user(struct mic_vdev *mvdev, void __user *ubuf,
-                                   size_t len, u64 daddr, size_t dlen,
-                                   int vr_idx)
-{
-        struct mic_device *mdev = mvdev->mdev;
-        void __iomem *dbuf = mdev->aper.va + daddr;
-        struct mic_vringh *mvr = &mvdev->mvr[vr_idx];
-        size_t dma_alignment = 1 << mdev->dma_ch[0]->device->copy_align;
-        size_t dma_offset;
-        size_t partlen;
-        int err;
-
-        dma_offset = daddr - round_down(daddr, dma_alignment);
-        daddr -= dma_offset;
-        len += dma_offset;
-
-        while (len) {
-                partlen = min_t(size_t, len, MIC_INT_DMA_BUF_SIZE);
-
-                err = mic_sync_dma(mdev, mvr->buf_da, daddr,
-                                   ALIGN(partlen, dma_alignment));
-                if (err)
-                        goto err;
-
-                if (copy_to_user(ubuf, mvr->buf + dma_offset,
-                                 partlen - dma_offset)) {
-                        err = -EFAULT;
-                        goto err;
-                }
-                daddr += partlen;
-                ubuf += partlen;
-                dbuf += partlen;
-                mvdev->in_bytes_dma += partlen;
-                mvdev->in_bytes += partlen;
-                len -= partlen;
-                dma_offset = 0;
-        }
-        return 0;
-err:
-        dev_err(mic_dev(mvdev), "%s %d err %d\n", __func__, __LINE__, err);
-        return err;
-}
-
-/*
- * Initiates copies across the PCIe bus from a user space buffer to card
- * memory. When transfers are done using DMA, source/destination addresses
- * and transfer length must follow the alignment requirements of the MIC
- * DMA engine.
- */
-static int mic_virtio_copy_from_user(struct mic_vdev *mvdev, void __user *ubuf,
-                                     size_t len, u64 daddr, size_t dlen,
-                                     int vr_idx)
-{
-        struct mic_device *mdev = mvdev->mdev;
-        void __iomem *dbuf = mdev->aper.va + daddr;
-        struct mic_vringh *mvr = &mvdev->mvr[vr_idx];
-        size_t dma_alignment = 1 << mdev->dma_ch[0]->device->copy_align;
-        size_t partlen;
-        int err;
-
-        if (daddr & (dma_alignment - 1)) {
-                mvdev->tx_dst_unaligned += len;
-                goto memcpy;
-        } else if (ALIGN(len, dma_alignment) > dlen) {
-                mvdev->tx_len_unaligned += len;
-                goto memcpy;
-        }
-
-        while (len) {
-                partlen = min_t(size_t, len, MIC_INT_DMA_BUF_SIZE);
-
-                if (copy_from_user(mvr->buf, ubuf, partlen)) {
-                        err = -EFAULT;
-                        goto err;
-                }
-                err = mic_sync_dma(mdev, daddr, mvr->buf_da,
-                                   ALIGN(partlen, dma_alignment));
-                if (err)
-                        goto err;
-                daddr += partlen;
-                ubuf += partlen;
-                dbuf += partlen;
-                mvdev->out_bytes_dma += partlen;
-                mvdev->out_bytes += partlen;
-                len -= partlen;
-        }
-memcpy:
-        /*
-         * We are copying to IO below and should ideally use something
-         * like copy_from_user_toio(..) if it existed.
-         */
-        if (copy_from_user((void __force *)dbuf, ubuf, len)) {
-                err = -EFAULT;
-                goto err;
-        }
-        mvdev->out_bytes += len;
-        return 0;
-err:
-        dev_err(mic_dev(mvdev), "%s %d err %d\n", __func__, __LINE__, err);
-        return err;
-}
-
-#define MIC_VRINGH_READ true
-
-/* The function to call to notify the card about added buffers */
-static void mic_notify(struct vringh *vrh)
-{
-        struct mic_vringh *mvrh = container_of(vrh, struct mic_vringh, vrh);
-        struct mic_vdev *mvdev = mvrh->mvdev;
-        s8 db = mvdev->dc->h2c_vdev_db;
-
-        if (db != -1)
-                mvdev->mdev->ops->send_intr(mvdev->mdev, db);
-}
-
-/* Determine the total number of bytes consumed in a VRINGH KIOV */
-static inline u32 mic_vringh_iov_consumed(struct vringh_kiov *iov)
-{
-        int i;
-        u32 total = iov->consumed;
-
-        for (i = 0; i < iov->i; i++)
-                total += iov->iov[i].iov_len;
-        return total;
-}
-
-/*
- * Traverse the VRINGH KIOV and issue the APIs to trigger the copies.
- * This API is heavily based on the vringh_iov_xfer(..) implementation
- * in vringh.c. The reason we cannot reuse vringh_iov_pull_kern(..)
- * and vringh_iov_push_kern(..) directly is because there is no
- * way to override the VRINGH xfer(..) routines as of v3.10.
- */
-static int mic_vringh_copy(struct mic_vdev *mvdev, struct vringh_kiov *iov,
-                        void __user *ubuf, size_t len, bool read, int vr_idx,
-                        size_t *out_len)
-{
-        int ret = 0;
-        size_t partlen, tot_len = 0;
-
-        while (len && iov->i < iov->used) {
-                partlen = min(iov->iov[iov->i].iov_len, len);
-                if (read)
-                        ret = mic_virtio_copy_to_user(mvdev, ubuf, partlen,
-                                                (u64)iov->iov[iov->i].iov_base,
-                                                iov->iov[iov->i].iov_len,
-                                                vr_idx);
-                else
-                        ret = mic_virtio_copy_from_user(mvdev, ubuf, partlen,
-                                                (u64)iov->iov[iov->i].iov_base,
-                                                iov->iov[iov->i].iov_len,
-                                                vr_idx);
-                if (ret) {
-                        dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                                __func__, __LINE__, ret);
-                        break;
-                }
-                len -= partlen;
-                ubuf += partlen;
-                tot_len += partlen;
-                iov->consumed += partlen;
-                iov->iov[iov->i].iov_len -= partlen;
-                iov->iov[iov->i].iov_base += partlen;
-                if (!iov->iov[iov->i].iov_len) {
-                        /* Fix up old iov element then increment. */
-                        iov->iov[iov->i].iov_len = iov->consumed;
-                        iov->iov[iov->i].iov_base -= iov->consumed;
-
-                        iov->consumed = 0;
-                        iov->i++;
-                }
-        }
-        *out_len = tot_len;
-        return ret;
-}
-
-/*
- * Use the standard VRINGH infrastructure in the kernel to fetch new
- * descriptors, initiate the copies and update the used ring.
- */
-static int _mic_virtio_copy(struct mic_vdev *mvdev,
-        struct mic_copy_desc *copy)
-{
-        int ret = 0;
-        u32 iovcnt = copy->iovcnt;
-        struct iovec iov;
-        struct iovec __user *u_iov = copy->iov;
-        void __user *ubuf = NULL;
-        struct mic_vringh *mvr = &mvdev->mvr[copy->vr_idx];
-        struct vringh_kiov *riov = &mvr->riov;
-        struct vringh_kiov *wiov = &mvr->wiov;
-        struct vringh *vrh = &mvr->vrh;
-        u16 *head = &mvr->head;
-        struct mic_vring *vr = &mvr->vring;
-        size_t len = 0, out_len;
-
-        copy->out_len = 0;
-        /* Fetch a new IOVEC if all previous elements have been processed */
-        if (riov->i == riov->used && wiov->i == wiov->used) {
-                ret = vringh_getdesc_kern(vrh, riov, wiov,
-                                head, GFP_KERNEL);
-                /* Check if there are available descriptors */
-                if (ret <= 0)
-                        return ret;
-        }
-        while (iovcnt) {
-                if (!len) {
-                        /* Copy over a new iovec from user space. */
-                        ret = copy_from_user(&iov, u_iov, sizeof(*u_iov));
-                        if (ret) {
-                                ret = -EINVAL;
-                                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                                        __func__, __LINE__, ret);
-                                break;
-                        }
-                        len = iov.iov_len;
-                        ubuf = iov.iov_base;
-                }
-                /* Issue all the read descriptors first */
-                ret = mic_vringh_copy(mvdev, riov, ubuf, len, MIC_VRINGH_READ,
-                                      copy->vr_idx, &out_len);
-                if (ret) {
-                        dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                                __func__, __LINE__, ret);
-                        break;
-                }
-                len -= out_len;
-                ubuf += out_len;
-                copy->out_len += out_len;
-                /* Issue the write descriptors next */
-                ret = mic_vringh_copy(mvdev, wiov, ubuf, len, !MIC_VRINGH_READ,
-                                      copy->vr_idx, &out_len);
-                if (ret) {
-                        dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                                __func__, __LINE__, ret);
-                        break;
-                }
-                len -= out_len;
-                ubuf += out_len;
-                copy->out_len += out_len;
-                if (!len) {
-                        /* One user space iovec is now completed */
-                        iovcnt--;
-                        u_iov++;
-                }
-                /* Exit loop if all elements in KIOVs have been processed. */
-                if (riov->i == riov->used && wiov->i == wiov->used)
-                        break;
-        }
-        /*
-         * Update the used ring if a descriptor was available and some data was
-         * copied in/out and the user asked for a used ring update.
-         */
-        if (*head != USHRT_MAX && copy->out_len && copy->update_used) {
-                u32 total = 0;
-
-                /* Determine the total data consumed */
-                total += mic_vringh_iov_consumed(riov);
-                total += mic_vringh_iov_consumed(wiov);
-                vringh_complete_kern(vrh, *head, total);
-                *head = USHRT_MAX;
-                if (vringh_need_notify_kern(vrh) > 0)
-                        vringh_notify(vrh);
-                vringh_kiov_cleanup(riov);
-                vringh_kiov_cleanup(wiov);
-                /* Update avail idx for user space */
-                vr->info->avail_idx = vrh->last_avail_idx;
-        }
-        return ret;
-}
-
-static inline int mic_verify_copy_args(struct mic_vdev *mvdev,
-                struct mic_copy_desc *copy)
-{
-        if (copy->vr_idx >= mvdev->dd->num_vq) {
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, -EINVAL);
-                return -EINVAL;
-        }
-        return 0;
-}
-
-/* Copy a specified number of virtio descriptors in a chain */
-int mic_virtio_copy_desc(struct mic_vdev *mvdev,
-                struct mic_copy_desc *copy)
-{
-        int err;
-        struct mic_vringh *mvr = &mvdev->mvr[copy->vr_idx];
-
-        err = mic_verify_copy_args(mvdev, copy);
-        if (err)
-                return err;
-
-        mutex_lock(&mvr->vr_mutex);
-        if (!mic_vdevup(mvdev)) {
-                err = -ENODEV;
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, err);
-                goto err;
-        }
-        err = _mic_virtio_copy(mvdev, copy);
-        if (err) {
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, err);
-        }
-err:
-        mutex_unlock(&mvr->vr_mutex);
-        return err;
-}
-
-static void mic_virtio_init_post(struct mic_vdev *mvdev)
-{
-        struct mic_vqconfig *vqconfig = mic_vq_config(mvdev->dd);
-        int i;
-
-        for (i = 0; i < mvdev->dd->num_vq; i++) {
-                if (!le64_to_cpu(vqconfig[i].used_address)) {
-                        dev_warn(mic_dev(mvdev), "used_address zero??\n");
-                        continue;
-                }
-                mvdev->mvr[i].vrh.vring.used =
-                        (void __force *)mvdev->mdev->aper.va +
-                        le64_to_cpu(vqconfig[i].used_address);
-        }
-
-        mvdev->dc->used_address_updated = 0;
-
-        dev_dbg(mic_dev(mvdev), "%s: device type %d LINKUP\n",
-                __func__, mvdev->virtio_id);
-}
-
-static inline void mic_virtio_device_reset(struct mic_vdev *mvdev)
-{
-        int i;
-
-        dev_dbg(mic_dev(mvdev), "%s: status %d device type %d RESET\n",
-                __func__, mvdev->dd->status, mvdev->virtio_id);
-
-        for (i = 0; i < mvdev->dd->num_vq; i++)
-                /*
-                 * Avoid lockdep false positive. The + 1 is for the mic
-                 * mutex which is held in the reset devices code path.
-                 */
-                mutex_lock_nested(&mvdev->mvr[i].vr_mutex, i + 1);
-
-        /* 0 status means "reset" */
-        mvdev->dd->status = 0;
-        mvdev->dc->vdev_reset = 0;
-        mvdev->dc->host_ack = 1;
-
-        for (i = 0; i < mvdev->dd->num_vq; i++) {
-                struct vringh *vrh = &mvdev->mvr[i].vrh;
-                mvdev->mvr[i].vring.info->avail_idx = 0;
-                vrh->completed = 0;
-                vrh->last_avail_idx = 0;
-                vrh->last_used_idx = 0;
-        }
-
-        for (i = 0; i < mvdev->dd->num_vq; i++)
-                mutex_unlock(&mvdev->mvr[i].vr_mutex);
-}
-
-void mic_virtio_reset_devices(struct mic_device *mdev)
-{
-        struct list_head *pos, *tmp;
-        struct mic_vdev *mvdev;
-
-        dev_dbg(&mdev->pdev->dev, "%s\n",  __func__);
-
-        list_for_each_safe(pos, tmp, &mdev->vdev_list) {
-                mvdev = list_entry(pos, struct mic_vdev, list);
-                mic_virtio_device_reset(mvdev);
-                mvdev->poll_wake = 1;
-                wake_up(&mvdev->waitq);
-        }
-}
-
-void mic_bh_handler(struct work_struct *work)
-{
-        struct mic_vdev *mvdev = container_of(work, struct mic_vdev,
-                        virtio_bh_work);
-
-        if (mvdev->dc->used_address_updated)
-                mic_virtio_init_post(mvdev);
-
-        if (mvdev->dc->vdev_reset)
-                mic_virtio_device_reset(mvdev);
-
-        mvdev->poll_wake = 1;
-        wake_up(&mvdev->waitq);
-}
-
-static irqreturn_t mic_virtio_intr_handler(int irq, void *data)
-{
-        struct mic_vdev *mvdev = data;
-        struct mic_device *mdev = mvdev->mdev;
-
-        mdev->ops->intr_workarounds(mdev);
-        schedule_work(&mvdev->virtio_bh_work);
-        return IRQ_HANDLED;
-}
-
-int mic_virtio_config_change(struct mic_vdev *mvdev,
-                        void __user *argp)
-{
-        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
-        int ret = 0, retry, i;
-        struct mic_bootparam *bootparam = mvdev->mdev->dp;
-        s8 db = bootparam->h2c_config_db;
-
-        mutex_lock(&mvdev->mdev->mic_mutex);
-        for (i = 0; i < mvdev->dd->num_vq; i++)
-                mutex_lock_nested(&mvdev->mvr[i].vr_mutex, i + 1);
-
-        if (db == -1 || mvdev->dd->type == -1) {
-                ret = -EIO;
-                goto exit;
-        }
-
-        if (copy_from_user(mic_vq_configspace(mvdev->dd),
-                           argp, mvdev->dd->config_len)) {
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, -EFAULT);
-                ret = -EFAULT;
-                goto exit;
-        }
-        mvdev->dc->config_change = MIC_VIRTIO_PARAM_CONFIG_CHANGED;
-        mvdev->mdev->ops->send_intr(mvdev->mdev, db);
-
-        for (retry = 100; retry--;) {
-                ret = wait_event_timeout(wake,
-                        mvdev->dc->guest_ack, msecs_to_jiffies(100));
-                if (ret)
-                        break;
-        }
-
-        dev_dbg(mic_dev(mvdev),
-                "%s %d retry: %d\n", __func__, __LINE__, retry);
-        mvdev->dc->config_change = 0;
-        mvdev->dc->guest_ack = 0;
-exit:
-        for (i = 0; i < mvdev->dd->num_vq; i++)
-                mutex_unlock(&mvdev->mvr[i].vr_mutex);
-        mutex_unlock(&mvdev->mdev->mic_mutex);
-        return ret;
-}
-
-static int mic_copy_dp_entry(struct mic_vdev *mvdev,
-                                        void __user *argp,
-                                        __u8 *type,
-                                        struct mic_device_desc **devpage)
-{
-        struct mic_device *mdev = mvdev->mdev;
-        struct mic_device_desc dd, *dd_config, *devp;
-        struct mic_vqconfig *vqconfig;
-        int ret = 0, i;
-        bool slot_found = false;
-
-        if (copy_from_user(&dd, argp, sizeof(dd))) {
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, -EFAULT);
-                return -EFAULT;
-        }
-
-        if (mic_aligned_desc_size(&dd) > MIC_MAX_DESC_BLK_SIZE ||
-            dd.num_vq > MIC_MAX_VRINGS) {
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, -EINVAL);
-                return -EINVAL;
-        }
-
-        dd_config = kmalloc(mic_desc_size(&dd), GFP_KERNEL);
-        if (dd_config == NULL) {
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, -ENOMEM);
-                return -ENOMEM;
-        }
-        if (copy_from_user(dd_config, argp, mic_desc_size(&dd))) {
-                ret = -EFAULT;
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, ret);
-                goto exit;
-        }
-
-        vqconfig = mic_vq_config(dd_config);
-        for (i = 0; i < dd.num_vq; i++) {
-                if (le16_to_cpu(vqconfig[i].num) > MIC_MAX_VRING_ENTRIES) {
-                        ret =  -EINVAL;
-                        dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                                __func__, __LINE__, ret);
-                        goto exit;
-                }
-        }
-
-        /* Find the first free device page entry */
-        for (i = sizeof(struct mic_bootparam);
-                i < MIC_DP_SIZE - mic_total_desc_size(dd_config);
-                i += mic_total_desc_size(devp)) {
-                devp = mdev->dp + i;
-                if (devp->type == 0 || devp->type == -1) {
-                        slot_found = true;
-                        break;
-                }
-        }
-        if (!slot_found) {
-                ret =  -EINVAL;
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, ret);
-                goto exit;
-        }
-        /*
-         * Save off the type before doing the memcpy. Type will be set in the
-         * end after completing all initialization for the new device.
-         */
-        *type = dd_config->type;
-        dd_config->type = 0;
-        memcpy(devp, dd_config, mic_desc_size(dd_config));
-
-        *devpage = devp;
-exit:
-        kfree(dd_config);
-        return ret;
-}
-
-static void mic_init_device_ctrl(struct mic_vdev *mvdev,
-                                struct mic_device_desc *devpage)
-{
-        struct mic_device_ctrl *dc;
-
-        dc = (void *)devpage + mic_aligned_desc_size(devpage);
-
-        dc->config_change = 0;
-        dc->guest_ack = 0;
-        dc->vdev_reset = 0;
-        dc->host_ack = 0;
-        dc->used_address_updated = 0;
-        dc->c2h_vdev_db = -1;
-        dc->h2c_vdev_db = -1;
-        mvdev->dc = dc;
-}
-
-int mic_virtio_add_device(struct mic_vdev *mvdev,
-                        void __user *argp)
-{
-        struct mic_device *mdev = mvdev->mdev;
-        struct mic_device_desc *dd = NULL;
-        struct mic_vqconfig *vqconfig;
-        int vr_size, i, j, ret;
-        u8 type = 0;
-        s8 db;
-        char irqname[10];
-        struct mic_bootparam *bootparam = mdev->dp;
-        u16 num;
-        dma_addr_t vr_addr;
-
-        mutex_lock(&mdev->mic_mutex);
-
-        ret = mic_copy_dp_entry(mvdev, argp, &type, &dd);
-        if (ret) {
-                mutex_unlock(&mdev->mic_mutex);
-                return ret;
-        }
-
-        mic_init_device_ctrl(mvdev, dd);
-
-        mvdev->dd = dd;
-        mvdev->virtio_id = type;
-        vqconfig = mic_vq_config(dd);
-        INIT_WORK(&mvdev->virtio_bh_work, mic_bh_handler);
-
-        for (i = 0; i < dd->num_vq; i++) {
-                struct mic_vringh *mvr = &mvdev->mvr[i];
-                struct mic_vring *vr = &mvdev->mvr[i].vring;
-                num = le16_to_cpu(vqconfig[i].num);
-                mutex_init(&mvr->vr_mutex);
-                vr_size = PAGE_ALIGN(vring_size(num, MIC_VIRTIO_RING_ALIGN) +
-                        sizeof(struct _mic_vring_info));
-                vr->va = (void *)
-                        __get_free_pages(GFP_KERNEL | __GFP_ZERO,
-                                         get_order(vr_size));
-                if (!vr->va) {
-                        ret = -ENOMEM;
-                        dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                                __func__, __LINE__, ret);
-                        goto err;
-                }
-                vr->len = vr_size;
-                vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN);
-                vr->info->magic = cpu_to_le32(MIC_MAGIC + mvdev->virtio_id + i);
-                vr_addr = mic_map_single(mdev, vr->va, vr_size);
-                if (mic_map_error(vr_addr)) {
-                        free_pages((unsigned long)vr->va, get_order(vr_size));
-                        ret = -ENOMEM;
-                        dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                                __func__, __LINE__, ret);
-                        goto err;
-                }
-                vqconfig[i].address = cpu_to_le64(vr_addr);
-
-                vring_init(&vr->vr, num, vr->va, MIC_VIRTIO_RING_ALIGN);
-                ret = vringh_init_kern(&mvr->vrh,
-                        *(u32 *)mic_vq_features(mvdev->dd), num, false,
-                        vr->vr.desc, vr->vr.avail, vr->vr.used);
-                if (ret) {
-                        dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                                __func__, __LINE__, ret);
-                        goto err;
-                }
-                vringh_kiov_init(&mvr->riov, NULL, 0);
-                vringh_kiov_init(&mvr->wiov, NULL, 0);
-                mvr->head = USHRT_MAX;
-                mvr->mvdev = mvdev;
-                mvr->vrh.notify = mic_notify;
-                dev_dbg(&mdev->pdev->dev,
-                        "%s %d index %d va %p info %p vr_size 0x%x\n",
-                        __func__, __LINE__, i, vr->va, vr->info, vr_size);
-                mvr->buf = (void *)__get_free_pages(GFP_KERNEL,
-                                        get_order(MIC_INT_DMA_BUF_SIZE));
-                mvr->buf_da = mic_map_single(mvdev->mdev, mvr->buf,
-                                          MIC_INT_DMA_BUF_SIZE);
-        }
-
-        snprintf(irqname, sizeof(irqname), "mic%dvirtio%d", mdev->id,
-                 mvdev->virtio_id);
-        mvdev->virtio_db = mic_next_db(mdev);
-        mvdev->virtio_cookie = mic_request_threaded_irq(mdev,
-                                               mic_virtio_intr_handler,
-                                               NULL, irqname, mvdev,
-                                               mvdev->virtio_db, MIC_INTR_DB);
-        if (IS_ERR(mvdev->virtio_cookie)) {
-                ret = PTR_ERR(mvdev->virtio_cookie);
-                dev_dbg(&mdev->pdev->dev, "request irq failed\n");
-                goto err;
-        }
-
-        mvdev->dc->c2h_vdev_db = mvdev->virtio_db;
-
-        list_add_tail(&mvdev->list, &mdev->vdev_list);
-        /*
-         * Order the type update with previous stores. This write barrier
-         * is paired with the corresponding read barrier before the uncached
-         * system memory read of the type, on the card while scanning the
-         * device page.
-         */
-        smp_wmb();
-        dd->type = type;
-
-        dev_dbg(&mdev->pdev->dev, "Added virtio device id %d\n", dd->type);
-
-        db = bootparam->h2c_config_db;
-        if (db != -1)
-                mdev->ops->send_intr(mdev, db);
-        mutex_unlock(&mdev->mic_mutex);
-        return 0;
-err:
-        vqconfig = mic_vq_config(dd);
-        for (j = 0; j < i; j++) {
-                struct mic_vringh *mvr = &mvdev->mvr[j];
-                mic_unmap_single(mdev, le64_to_cpu(vqconfig[j].address),
-                                 mvr->vring.len);
-                free_pages((unsigned long)mvr->vring.va,
-                           get_order(mvr->vring.len));
-        }
-        mutex_unlock(&mdev->mic_mutex);
-        return ret;
-}
-
-void mic_virtio_del_device(struct mic_vdev *mvdev)
-{
-        struct list_head *pos, *tmp;
-        struct mic_vdev *tmp_mvdev;
-        struct mic_device *mdev = mvdev->mdev;
-        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
-        int i, ret, retry;
-        struct mic_vqconfig *vqconfig;
-        struct mic_bootparam *bootparam = mdev->dp;
-        s8 db;
-
-        mutex_lock(&mdev->mic_mutex);
-        db = bootparam->h2c_config_db;
-        if (db == -1)
-                goto skip_hot_remove;
-        dev_dbg(&mdev->pdev->dev,
-                "Requesting hot remove id %d\n", mvdev->virtio_id);
-        mvdev->dc->config_change = MIC_VIRTIO_PARAM_DEV_REMOVE;
-        mdev->ops->send_intr(mdev, db);
-        for (retry = 100; retry--;) {
-                ret = wait_event_timeout(wake,
-                        mvdev->dc->guest_ack, msecs_to_jiffies(100));
-                if (ret)
-                        break;
-        }
-        dev_dbg(&mdev->pdev->dev,
-                "Device id %d config_change %d guest_ack %d retry %d\n",
-                mvdev->virtio_id, mvdev->dc->config_change,
-                mvdev->dc->guest_ack, retry);
-        mvdev->dc->config_change = 0;
-        mvdev->dc->guest_ack = 0;
-skip_hot_remove:
-        mic_free_irq(mdev, mvdev->virtio_cookie, mvdev);
-        flush_work(&mvdev->virtio_bh_work);
-        vqconfig = mic_vq_config(mvdev->dd);
-        for (i = 0; i < mvdev->dd->num_vq; i++) {
-                struct mic_vringh *mvr = &mvdev->mvr[i];
-
-                mic_unmap_single(mvdev->mdev, mvr->buf_da,
-                                 MIC_INT_DMA_BUF_SIZE);
-                free_pages((unsigned long)mvr->buf,
-                           get_order(MIC_INT_DMA_BUF_SIZE));
-                vringh_kiov_cleanup(&mvr->riov);
-                vringh_kiov_cleanup(&mvr->wiov);
-                mic_unmap_single(mdev, le64_to_cpu(vqconfig[i].address),
-                                 mvr->vring.len);
-                free_pages((unsigned long)mvr->vring.va,
-                           get_order(mvr->vring.len));
-        }
-
-        list_for_each_safe(pos, tmp, &mdev->vdev_list) {
-                tmp_mvdev = list_entry(pos, struct mic_vdev, list);
-                if (tmp_mvdev == mvdev) {
-                        list_del(pos);
-                        dev_dbg(&mdev->pdev->dev,
-                                "Removing virtio device id %d\n",
-                                mvdev->virtio_id);
-                        break;
-                }
-        }
-        /*
-         * Order the type update with previous stores. This write barrier
-         * is paired with the corresponding read barrier before the uncached
-         * system memory read of the type, on the card while scanning the
-         * device page.
-         */
-        smp_wmb();
-        mvdev->dd->type = -1;
-        mutex_unlock(&mdev->mic_mutex);
-}
diff --git a/drivers/misc/mic/host/mic_x100.c b/drivers/misc/mic/host/mic_x100.c
index 8118ac48c764..82a973c85b5d 100644
--- a/drivers/misc/mic/host/mic_x100.c
+++ b/drivers/misc/mic/host/mic_x100.c
@@ -450,26 +450,29 @@ mic_x100_load_firmware(struct mic_device *mdev, const char *buf)
 
         rc = mic_x100_get_boot_addr(mdev);
         if (rc)
-                goto error;
+                return rc;
         /* load OS */
         rc = request_firmware(&fw, mdev->cosm_dev->firmware, &mdev->pdev->dev);
         if (rc < 0) {
                 dev_err(&mdev->pdev->dev,
                         "ramdisk request_firmware failed: %d %s\n",
                         rc, mdev->cosm_dev->firmware);
-                goto error;
+                return rc;
         }
         if (mdev->bootaddr > mdev->aper.len - fw->size) {
                 rc = -EINVAL;
                 dev_err(&mdev->pdev->dev, "%s %d rc %d bootaddr 0x%x\n",
                         __func__, __LINE__, rc, mdev->bootaddr);
-                release_firmware(fw);
                 goto error;
         }
         memcpy_toio(mdev->aper.va + mdev->bootaddr, fw->data, fw->size);
         mdev->ops->write_spad(mdev, MIC_X100_FW_SIZE, fw->size);
-        if (!strcmp(mdev->cosm_dev->bootmode, "flash"))
-                goto done;
+        if (!strcmp(mdev->cosm_dev->bootmode, "flash")) {
+                rc = -EINVAL;
+                dev_err(&mdev->pdev->dev, "%s %d rc %d\n",
+                        __func__, __LINE__, rc);
+                goto error;
+        }
         /* load command line */
         rc = mic_x100_load_command_line(mdev, fw);
         if (rc) {
@@ -481,9 +484,11 @@ mic_x100_load_firmware(struct mic_device *mdev, const char *buf)
         /* load ramdisk */
         if (mdev->cosm_dev->ramdisk)
                 rc = mic_x100_load_ramdisk(mdev);
+
+        return rc;
+
 error:
-        dev_dbg(&mdev->pdev->dev, "%s %d rc %d\n", __func__, __LINE__, rc);
-done:
+        release_firmware(fw);
         return rc;
 }
 
diff --git a/drivers/misc/mic/scif/scif_dma.c b/drivers/misc/mic/scif/scif_dma.c
index 95a13c629a8e..cd01a0efda6b 100644
--- a/drivers/misc/mic/scif/scif_dma.c
+++ b/drivers/misc/mic/scif/scif_dma.c
@@ -74,11 +74,6 @@ struct scif_copy_work {
         bool ordered;
 };
 
-#ifndef list_entry_next
-#define list_entry_next(pos, member) \
-        list_entry(pos->member.next, typeof(*pos), member)
-#endif
-
 /**
  * scif_reserve_dma_chan:
  * @ep: Endpoint Descriptor.
@@ -276,13 +271,10 @@ static struct scif_mmu_notif *
 scif_find_mmu_notifier(struct mm_struct *mm, struct scif_endpt_rma_info *rma)
 {
         struct scif_mmu_notif *mmn;
-        struct list_head *item;
 
-        list_for_each(item, &rma->mmn_list) {
-                mmn = list_entry(item, struct scif_mmu_notif, list);
+        list_for_each_entry(mmn, &rma->mmn_list, list)
                 if (mmn->mm == mm)
                         return mmn;
-        }
         return NULL;
 }
 
@@ -293,13 +285,12 @@ scif_add_mmu_notifier(struct mm_struct *mm, struct scif_endpt *ep)
                  = kzalloc(sizeof(*mmn), GFP_KERNEL);
 
         if (!mmn)
-                return ERR_PTR(ENOMEM);
+                return ERR_PTR(-ENOMEM);
 
         scif_init_mmu_notifier(mmn, current->mm, ep);
-        if (mmu_notifier_register(&mmn->ep_mmu_notifier,
-                                  current->mm)) {
+        if (mmu_notifier_register(&mmn->ep_mmu_notifier, current->mm)) {
                 kfree(mmn);
-                return ERR_PTR(EBUSY);
+                return ERR_PTR(-EBUSY);
         }
         list_add(&mmn->list, &ep->rma_info.mmn_list);
         return mmn;
@@ -851,7 +842,7 @@ static void scif_rma_local_cpu_copy(s64 offset, struct scif_window *window,
                 (window->nr_pages << PAGE_SHIFT);
         while (rem_len) {
                 if (offset == end_offset) {
-                        window = list_entry_next(window, list);
+                        window = list_next_entry(window, list);
                         end_offset = window->offset +
                                 (window->nr_pages << PAGE_SHIFT);
                 }
@@ -957,7 +948,7 @@ scif_rma_list_dma_copy_unaligned(struct scif_copy_work *work,
         remaining_len -= tail_len;
         while (remaining_len) {
                 if (offset == end_offset) {
-                        window = list_entry_next(window, list);
+                        window = list_next_entry(window, list);
                         end_offset = window->offset +
                                 (window->nr_pages << PAGE_SHIFT);
                 }
@@ -1064,7 +1055,7 @@ scif_rma_list_dma_copy_unaligned(struct scif_copy_work *work,
         }
         if (tail_len) {
                 if (offset == end_offset) {
-                        window = list_entry_next(window, list);
+                        window = list_next_entry(window, list);
                         end_offset = window->offset +
                                 (window->nr_pages << PAGE_SHIFT);
                 }
@@ -1147,13 +1138,13 @@ static int _scif_rma_list_dma_copy_aligned(struct scif_copy_work *work,
                 (dst_window->nr_pages << PAGE_SHIFT);
         while (remaining_len) {
                 if (src_offset == end_src_offset) {
-                        src_window = list_entry_next(src_window, list);
+                        src_window = list_next_entry(src_window, list);
                         end_src_offset = src_window->offset +
                                 (src_window->nr_pages << PAGE_SHIFT);
                         scif_init_window_iter(src_window, &src_win_iter);
                 }
                 if (dst_offset == end_dst_offset) {
-                        dst_window = list_entry_next(dst_window, list);
+                        dst_window = list_next_entry(dst_window, list);
                         end_dst_offset = dst_window->offset +
                                 (dst_window->nr_pages << PAGE_SHIFT);
                         scif_init_window_iter(dst_window, &dst_win_iter);
@@ -1314,13 +1305,13 @@ static int scif_rma_list_dma_copy_aligned(struct scif_copy_work *work,
         remaining_len -= tail_len;
         while (remaining_len) {
                 if (src_offset == end_src_offset) {
-                        src_window = list_entry_next(src_window, list);
+                        src_window = list_next_entry(src_window, list);
                         end_src_offset = src_window->offset +
                                 (src_window->nr_pages << PAGE_SHIFT);
                         scif_init_window_iter(src_window, &src_win_iter);
                 }
                 if (dst_offset == end_dst_offset) {
-                        dst_window = list_entry_next(dst_window, list);
+                        dst_window = list_next_entry(dst_window, list);
                         end_dst_offset = dst_window->offset +
                                 (dst_window->nr_pages << PAGE_SHIFT);
                         scif_init_window_iter(dst_window, &dst_win_iter);
@@ -1405,9 +1396,9 @@ static int scif_rma_list_dma_copy_aligned(struct scif_copy_work *work,
         if (remaining_len) {
                 loop_len = remaining_len;
                 if (src_offset == end_src_offset)
-                        src_window = list_entry_next(src_window, list);
+                        src_window = list_next_entry(src_window, list);
                 if (dst_offset == end_dst_offset)
-                        dst_window = list_entry_next(dst_window, list);
+                        dst_window = list_next_entry(dst_window, list);
 
                 src_dma_addr = __scif_off_to_dma_addr(src_window, src_offset);
                 dst_dma_addr = __scif_off_to_dma_addr(dst_window, dst_offset);
@@ -1550,12 +1541,12 @@ static int scif_rma_list_cpu_copy(struct scif_copy_work *work)
                         end_dst_offset = dst_window->offset +
                                 (dst_window->nr_pages << PAGE_SHIFT);
                         if (src_offset == end_src_offset) {
-                                src_window = list_entry_next(src_window, list);
+                                src_window = list_next_entry(src_window, list);
                                 scif_init_window_iter(src_window,
                                                       &src_win_iter);
                         }
                         if (dst_offset == end_dst_offset) {
-                                dst_window = list_entry_next(dst_window, list);
+                                dst_window = list_next_entry(dst_window, list);
                                 scif_init_window_iter(dst_window,
                                                       &dst_win_iter);
                         }
@@ -1730,7 +1721,7 @@ static int scif_rma_copy(scif_epd_t epd, off_t loffset, unsigned long addr,
                 mutex_lock(&ep->rma_info.mmn_lock);
                 mmn = scif_find_mmu_notifier(current->mm, &ep->rma_info);
                 if (!mmn)
-                        scif_add_mmu_notifier(current->mm, ep);
+                        mmn = scif_add_mmu_notifier(current->mm, ep);
                 mutex_unlock(&ep->rma_info.mmn_lock);
                 if (IS_ERR(mmn)) {
                         scif_put_peer_dev(spdev);
diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
index 8310b4dbff06..6a451bd65bf3 100644
--- a/drivers/misc/mic/scif/scif_rma.c
+++ b/drivers/misc/mic/scif/scif_rma.c
@@ -1511,7 +1511,7 @@ off_t scif_register_pinned_pages(scif_epd_t epd,
         if ((map_flags & SCIF_MAP_FIXED) &&
             ((ALIGN(offset, PAGE_SIZE) != offset) ||
             (offset < 0) ||
-            (offset + (off_t)len < offset)))
+            (len > LONG_MAX - offset)))
                 return -EINVAL;
 
         might_sleep();
@@ -1614,7 +1614,7 @@ off_t scif_register(scif_epd_t epd, void *addr, size_t len, off_t offset,
         if ((map_flags & SCIF_MAP_FIXED) &&
             ((ALIGN(offset, PAGE_SIZE) != offset) ||
             (offset < 0) ||
-            (offset + (off_t)len < offset)))
+            (len > LONG_MAX - offset)))
                 return -EINVAL;
 
         /* Unsupported protection requested */
@@ -1732,7 +1732,8 @@ scif_unregister(scif_epd_t epd, off_t offset, size_t len)
 
         /* Offset is not page aligned or offset+len wraps around */
         if ((ALIGN(offset, PAGE_SIZE) != offset) ||
-            (offset + (off_t)len < offset))
+            (offset < 0) ||
+            (len > LONG_MAX - offset))
                 return -EINVAL;
 
         err = scif_verify_epd(ep);
diff --git a/drivers/misc/mic/vop/Makefile b/drivers/misc/mic/vop/Makefile
new file mode 100644
index 000000000000..78819c8999f1
--- /dev/null
+++ b/drivers/misc/mic/vop/Makefile
@@ -0,0 +1,9 @@
+#
+# Makefile - Intel MIC Linux driver.
+# Copyright(c) 2016, Intel Corporation.
+#
+obj-m := vop.o
+
+vop-objs += vop_main.o
+vop-objs += vop_debugfs.o
+vop-objs += vop_vringh.o
diff --git a/drivers/misc/mic/vop/vop_debugfs.c b/drivers/misc/mic/vop/vop_debugfs.c
new file mode 100644
index 000000000000..ab43884e5cd7
--- /dev/null
+++ b/drivers/misc/mic/vop/vop_debugfs.c
@@ -0,0 +1,232 @@
+/*
+ * Intel MIC Platform Software Stack (MPSS)
+ *
+ * Copyright(c) 2016 Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * The full GNU General Public License is included in this distribution in
+ * the file called "COPYING".
+ *
+ * Intel Virtio Over PCIe (VOP) driver.
+ *
+ */
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+
+#include "vop_main.h"
+
+static int vop_dp_show(struct seq_file *s, void *pos)
+{
+        struct mic_device_desc *d;
+        struct mic_device_ctrl *dc;
+        struct mic_vqconfig *vqconfig;
+        __u32 *features;
+        __u8 *config;
+        struct vop_info *vi = s->private;
+        struct vop_device *vpdev = vi->vpdev;
+        struct mic_bootparam *bootparam = vpdev->hw_ops->get_dp(vpdev);
+        int j, k;
+
+        seq_printf(s, "Bootparam: magic 0x%x\n",
+                   bootparam->magic);
+        seq_printf(s, "Bootparam: h2c_config_db %d\n",
+                   bootparam->h2c_config_db);
+        seq_printf(s, "Bootparam: node_id %d\n",
+                   bootparam->node_id);
+        seq_printf(s, "Bootparam: c2h_scif_db %d\n",
+                   bootparam->c2h_scif_db);
+        seq_printf(s, "Bootparam: h2c_scif_db %d\n",
+                   bootparam->h2c_scif_db);
+        seq_printf(s, "Bootparam: scif_host_dma_addr 0x%llx\n",
+                   bootparam->scif_host_dma_addr);
+        seq_printf(s, "Bootparam: scif_card_dma_addr 0x%llx\n",
+                   bootparam->scif_card_dma_addr);
+
+        for (j = sizeof(*bootparam);
+                j < MIC_DP_SIZE; j += mic_total_desc_size(d)) {
+                d = (void *)bootparam + j;
+                dc = (void *)d + mic_aligned_desc_size(d);
+
+                /* end of list */
+                if (d->type == 0)
+                        break;
+
+                if (d->type == -1)
+                        continue;
+
+                seq_printf(s, "Type %d ", d->type);
+                seq_printf(s, "Num VQ %d ", d->num_vq);
+                seq_printf(s, "Feature Len %d\n", d->feature_len);
+                seq_printf(s, "Config Len %d ", d->config_len);
+                seq_printf(s, "Shutdown Status %d\n", d->status);
+
+                for (k = 0; k < d->num_vq; k++) {
+                        vqconfig = mic_vq_config(d) + k;
+                        seq_printf(s, "vqconfig[%d]: ", k);
+                        seq_printf(s, "address 0x%llx ",
+                                   vqconfig->address);
+                        seq_printf(s, "num %d ", vqconfig->num);
+                        seq_printf(s, "used address 0x%llx\n",
+                                   vqconfig->used_address);
+                }
+
+                features = (__u32 *)mic_vq_features(d);
+                seq_printf(s, "Features: Host 0x%x ", features[0]);
+                seq_printf(s, "Guest 0x%x\n", features[1]);
+
+                config = mic_vq_configspace(d);
+                for (k = 0; k < d->config_len; k++)
+                        seq_printf(s, "config[%d]=%d\n", k, config[k]);
+
+                seq_puts(s, "Device control:\n");
+                seq_printf(s, "Config Change %d ", dc->config_change);
+                seq_printf(s, "Vdev reset %d\n", dc->vdev_reset);
+                seq_printf(s, "Guest Ack %d ", dc->guest_ack);
+                seq_printf(s, "Host ack %d\n", dc->host_ack);
+                seq_printf(s, "Used address updated %d ",
+                           dc->used_address_updated);
+                seq_printf(s, "Vdev 0x%llx\n", dc->vdev);
+                seq_printf(s, "c2h doorbell %d ", dc->c2h_vdev_db);
+                seq_printf(s, "h2c doorbell %d\n", dc->h2c_vdev_db);
+        }
+        schedule_work(&vi->hotplug_work);
+        return 0;
+}
+
+static int vop_dp_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, vop_dp_show, inode->i_private);
+}
+
+static int vop_dp_debug_release(struct inode *inode, struct file *file)
+{
+        return single_release(inode, file);
+}
+
+static const struct file_operations dp_ops = {
+        .owner   = THIS_MODULE,
+        .open    = vop_dp_debug_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = vop_dp_debug_release
+};
+
+static int vop_vdev_info_show(struct seq_file *s, void *unused)
+{
+        struct vop_info *vi = s->private;
+        struct list_head *pos, *tmp;
+        struct vop_vdev *vdev;
+        int i, j;
+
+        mutex_lock(&vi->vop_mutex);
+        list_for_each_safe(pos, tmp, &vi->vdev_list) {
+                vdev = list_entry(pos, struct vop_vdev, list);
+                seq_printf(s, "VDEV type %d state %s in %ld out %ld in_dma %ld out_dma %ld\n",
+                           vdev->virtio_id,
+                           vop_vdevup(vdev) ? "UP" : "DOWN",
+                           vdev->in_bytes,
+                           vdev->out_bytes,
+                           vdev->in_bytes_dma,
+                           vdev->out_bytes_dma);
+                for (i = 0; i < MIC_MAX_VRINGS; i++) {
+                        struct vring_desc *desc;
+                        struct vring_avail *avail;
+                        struct vring_used *used;
+                        struct vop_vringh *vvr = &vdev->vvr[i];
+                        struct vringh *vrh = &vvr->vrh;
+                        int num = vrh->vring.num;
+
+                        if (!num)
+                                continue;
+                        desc = vrh->vring.desc;
+                        seq_printf(s, "vring i %d avail_idx %d",
+                                   i, vvr->vring.info->avail_idx & (num - 1));
+                        seq_printf(s, " vring i %d avail_idx %d\n",
+                                   i, vvr->vring.info->avail_idx);
+                        seq_printf(s, "vrh i %d weak_barriers %d",
+                                   i, vrh->weak_barriers);
+                        seq_printf(s, " last_avail_idx %d last_used_idx %d",
+                                   vrh->last_avail_idx, vrh->last_used_idx);
+                        seq_printf(s, " completed %d\n", vrh->completed);
+                        for (j = 0; j < num; j++) {
+                                seq_printf(s, "desc[%d] addr 0x%llx len %d",
+                                           j, desc->addr, desc->len);
+                                seq_printf(s, " flags 0x%x next %d\n",
+                                           desc->flags, desc->next);
+                                desc++;
+                        }
+                        avail = vrh->vring.avail;
+                        seq_printf(s, "avail flags 0x%x idx %d\n",
+                                   vringh16_to_cpu(vrh, avail->flags),
+                                   vringh16_to_cpu(vrh,
+                                                   avail->idx) & (num - 1));
+                        seq_printf(s, "avail flags 0x%x idx %d\n",
+                                   vringh16_to_cpu(vrh, avail->flags),
+                                   vringh16_to_cpu(vrh, avail->idx));
+                        for (j = 0; j < num; j++)
+                                seq_printf(s, "avail ring[%d] %d\n",
+                                           j, avail->ring[j]);
+                        used = vrh->vring.used;
+                        seq_printf(s, "used flags 0x%x idx %d\n",
+                                   vringh16_to_cpu(vrh, used->flags),
+                                   vringh16_to_cpu(vrh, used->idx) & (num - 1));
+                        seq_printf(s, "used flags 0x%x idx %d\n",
+                                   vringh16_to_cpu(vrh, used->flags),
+                                   vringh16_to_cpu(vrh, used->idx));
+                        for (j = 0; j < num; j++)
+                                seq_printf(s, "used ring[%d] id %d len %d\n",
+                                           j, vringh32_to_cpu(vrh,
+                                                              used->ring[j].id),
+                                           vringh32_to_cpu(vrh,
+                                                           used->ring[j].len));
+                }
+        }
+        mutex_unlock(&vi->vop_mutex);
+
+        return 0;
+}
+
+static int vop_vdev_info_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, vop_vdev_info_show, inode->i_private);
+}
+
+static int vop_vdev_info_debug_release(struct inode *inode, struct file *file)
+{
+        return single_release(inode, file);
+}
+
+static const struct file_operations vdev_info_ops = {
+        .owner   = THIS_MODULE,
+        .open    = vop_vdev_info_debug_open,
+        .read    = seq_read,
+        .llseek  = seq_lseek,
+        .release = vop_vdev_info_debug_release
+};
+
+void vop_init_debugfs(struct vop_info *vi)
+{
+        char name[16];
+
+        snprintf(name, sizeof(name), "%s%d", KBUILD_MODNAME, vi->vpdev->dnode);
+        vi->dbg = debugfs_create_dir(name, NULL);
+        if (!vi->dbg) {
+                pr_err("can't create debugfs dir vop\n");
+                return;
+        }
+        debugfs_create_file("dp", 0444, vi->dbg, vi, &dp_ops);
+        debugfs_create_file("vdev_info", 0444, vi->dbg, vi, &vdev_info_ops);
+}
+
+void vop_exit_debugfs(struct vop_info *vi)
+{
+        debugfs_remove_recursive(vi->dbg);
+}
diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
new file mode 100644
index 000000000000..1a2b67f3183d
--- /dev/null
+++ b/drivers/misc/mic/vop/vop_main.c
@@ -0,0 +1,755 @@
+/*
+ * Intel MIC Platform Software Stack (MPSS)
+ *
+ * Copyright(c) 2016 Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * The full GNU General Public License is included in this distribution in
+ * the file called "COPYING".
+ *
+ * Adapted from:
+ *
+ * virtio for kvm on s390
+ *
+ * Copyright IBM Corp. 2008
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ *    Author(s): Christian Borntraeger <borntraeger@de.ibm.com>
+ *
+ * Intel Virtio Over PCIe (VOP) driver.
+ *
+ */
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/dma-mapping.h>
+
+#include "vop_main.h"
+
+#define VOP_MAX_VRINGS 4
+
+/*
+ * _vop_vdev - Allocated per virtio device instance injected by the peer.
+ *
+ * @vdev: Virtio device
+ * @desc: Virtio device page descriptor
+ * @dc: Virtio device control
+ * @vpdev: VOP device which is the parent for this virtio device
+ * @vr: Buffer for accessing the VRING
+ * @used: Buffer for used
+ * @used_size: Size of the used buffer
+ * @reset_done: Track whether VOP reset is complete
+ * @virtio_cookie: Cookie returned upon requesting a interrupt
+ * @c2h_vdev_db: The doorbell used by the guest to interrupt the host
+ * @h2c_vdev_db: The doorbell used by the host to interrupt the guest
+ * @dnode: The destination node
+ */
+struct _vop_vdev {
+        struct virtio_device vdev;
+        struct mic_device_desc __iomem *desc;
+        struct mic_device_ctrl __iomem *dc;
+        struct vop_device *vpdev;
+        void __iomem *vr[VOP_MAX_VRINGS];
+        dma_addr_t used[VOP_MAX_VRINGS];
+        int used_size[VOP_MAX_VRINGS];
+        struct completion reset_done;
+        struct mic_irq *virtio_cookie;
+        int c2h_vdev_db;
+        int h2c_vdev_db;
+        int dnode;
+};
+
+#define to_vopvdev(vd) container_of(vd, struct _vop_vdev, vdev)
+
+#define _vop_aligned_desc_size(d) __mic_align(_vop_desc_size(d), 8)
+
+/* Helper API to obtain the parent of the virtio device */
+static inline struct device *_vop_dev(struct _vop_vdev *vdev)
+{
+        return vdev->vdev.dev.parent;
+}
+
+static inline unsigned _vop_desc_size(struct mic_device_desc __iomem *desc)
+{
+        return sizeof(*desc)
+                + ioread8(&desc->num_vq) * sizeof(struct mic_vqconfig)
+                + ioread8(&desc->feature_len) * 2
+                + ioread8(&desc->config_len);
+}
+
+static inline struct mic_vqconfig __iomem *
+_vop_vq_config(struct mic_device_desc __iomem *desc)
+{
+        return (struct mic_vqconfig __iomem *)(desc + 1);
+}
+
+static inline u8 __iomem *
+_vop_vq_features(struct mic_device_desc __iomem *desc)
+{
+        return (u8 __iomem *)(_vop_vq_config(desc) + ioread8(&desc->num_vq));
+}
+
+static inline u8 __iomem *
+_vop_vq_configspace(struct mic_device_desc __iomem *desc)
+{
+        return _vop_vq_features(desc) + ioread8(&desc->feature_len) * 2;
+}
+
+static inline unsigned
+_vop_total_desc_size(struct mic_device_desc __iomem *desc)
+{
+        return _vop_aligned_desc_size(desc) + sizeof(struct mic_device_ctrl);
+}
+
+/* This gets the device's feature bits. */
+static u64 vop_get_features(struct virtio_device *vdev)
+{
+        unsigned int i, bits;
+        u32 features = 0;
+        struct mic_device_desc __iomem *desc = to_vopvdev(vdev)->desc;
+        u8 __iomem *in_features = _vop_vq_features(desc);
+        int feature_len = ioread8(&desc->feature_len);
+
+        bits = min_t(unsigned, feature_len, sizeof(vdev->features)) * 8;
+        for (i = 0; i < bits; i++)
+                if (ioread8(&in_features[i / 8]) & (BIT(i % 8)))
+                        features |= BIT(i);
+
+        return features;
+}
+
+static int vop_finalize_features(struct virtio_device *vdev)
+{
+        unsigned int i, bits;
+        struct mic_device_desc __iomem *desc = to_vopvdev(vdev)->desc;
+        u8 feature_len = ioread8(&desc->feature_len);
+        /* Second half of bitmap is features we accept. */
+        u8 __iomem *out_features =
+                _vop_vq_features(desc) + feature_len;
+
+        /* Give virtio_ring a chance to accept features. */
+        vring_transport_features(vdev);
+
+        memset_io(out_features, 0, feature_len);
+        bits = min_t(unsigned, feature_len,
+                     sizeof(vdev->features)) * 8;
+        for (i = 0; i < bits; i++) {
+                if (__virtio_test_bit(vdev, i))
+                        iowrite8(ioread8(&out_features[i / 8]) | (1 << (i % 8)),
+                                 &out_features[i / 8]);
+        }
+        return 0;
+}
+
+/*
+ * Reading and writing elements in config space
+ */
+static void vop_get(struct virtio_device *vdev, unsigned int offset,
+                    void *buf, unsigned len)
+{
+        struct mic_device_desc __iomem *desc = to_vopvdev(vdev)->desc;
+
+        if (offset + len > ioread8(&desc->config_len))
+                return;
+        memcpy_fromio(buf, _vop_vq_configspace(desc) + offset, len);
+}
+
+static void vop_set(struct virtio_device *vdev, unsigned int offset,
+                    const void *buf, unsigned len)
+{
+        struct mic_device_desc __iomem *desc = to_vopvdev(vdev)->desc;
+
+        if (offset + len > ioread8(&desc->config_len))
+                return;
+        memcpy_toio(_vop_vq_configspace(desc) + offset, buf, len);
+}
+
+/*
+ * The operations to get and set the status word just access the status
+ * field of the device descriptor. set_status also interrupts the host
+ * to tell about status changes.
+ */
+static u8 vop_get_status(struct virtio_device *vdev)
+{
+        return ioread8(&to_vopvdev(vdev)->desc->status);
+}
+
+static void vop_set_status(struct virtio_device *dev, u8 status)
+{
+        struct _vop_vdev *vdev = to_vopvdev(dev);
+        struct vop_device *vpdev = vdev->vpdev;
+
+        if (!status)
+                return;
+        iowrite8(status, &vdev->desc->status);
+        vpdev->hw_ops->send_intr(vpdev, vdev->c2h_vdev_db);
+}
+
+/* Inform host on a virtio device reset and wait for ack from host */
+static void vop_reset_inform_host(struct virtio_device *dev)
+{
+        struct _vop_vdev *vdev = to_vopvdev(dev);
+        struct mic_device_ctrl __iomem *dc = vdev->dc;
+        struct vop_device *vpdev = vdev->vpdev;
+        int retry;
+
+        iowrite8(0, &dc->host_ack);
+        iowrite8(1, &dc->vdev_reset);
+        vpdev->hw_ops->send_intr(vpdev, vdev->c2h_vdev_db);
+
+        /* Wait till host completes all card accesses and acks the reset */
+        for (retry = 100; retry--;) {
+                if (ioread8(&dc->host_ack))
+                        break;
+                msleep(100);
+        };
+
+        dev_dbg(_vop_dev(vdev), "%s: retry: %d\n", __func__, retry);
+
+        /* Reset status to 0 in case we timed out */
+        iowrite8(0, &vdev->desc->status);
+}
+
+static void vop_reset(struct virtio_device *dev)
+{
+        struct _vop_vdev *vdev = to_vopvdev(dev);
+
+        dev_dbg(_vop_dev(vdev), "%s: virtio id %d\n",
+                __func__, dev->id.device);
+
+        vop_reset_inform_host(dev);
+        complete_all(&vdev->reset_done);
+}
+
+/*
+ * The virtio_ring code calls this API when it wants to notify the Host.
+ */
+static bool vop_notify(struct virtqueue *vq)
+{
+        struct _vop_vdev *vdev = vq->priv;
+        struct vop_device *vpdev = vdev->vpdev;
+
+        vpdev->hw_ops->send_intr(vpdev, vdev->c2h_vdev_db);
+        return true;
+}
+
+static void vop_del_vq(struct virtqueue *vq, int n)
+{
+        struct _vop_vdev *vdev = to_vopvdev(vq->vdev);
+        struct vring *vr = (struct vring *)(vq + 1);
+        struct vop_device *vpdev = vdev->vpdev;
+
+        dma_unmap_single(&vpdev->dev, vdev->used[n],
+                         vdev->used_size[n], DMA_BIDIRECTIONAL);
+        free_pages((unsigned long)vr->used, get_order(vdev->used_size[n]));
+        vring_del_virtqueue(vq);
+        vpdev->hw_ops->iounmap(vpdev, vdev->vr[n]);
+        vdev->vr[n] = NULL;
+}
+
+static void vop_del_vqs(struct virtio_device *dev)
+{
+        struct _vop_vdev *vdev = to_vopvdev(dev);
+        struct virtqueue *vq, *n;
+        int idx = 0;
+
+        dev_dbg(_vop_dev(vdev), "%s\n", __func__);
+
+        list_for_each_entry_safe(vq, n, &dev->vqs, list)
+                vop_del_vq(vq, idx++);
+}
+
+/*
+ * This routine will assign vring's allocated in host/io memory. Code in
+ * virtio_ring.c however continues to access this io memory as if it were local
+ * memory without io accessors.
+ */
+static struct virtqueue *vop_find_vq(struct virtio_device *dev,
+                                     unsigned index,
+                                     void (*callback)(struct virtqueue *vq),
+                                     const char *name)
+{
+        struct _vop_vdev *vdev = to_vopvdev(dev);
+        struct vop_device *vpdev = vdev->vpdev;
+        struct mic_vqconfig __iomem *vqconfig;
+        struct mic_vqconfig config;
+        struct virtqueue *vq;
+        void __iomem *va;
+        struct _mic_vring_info __iomem *info;
+        void *used;
+        int vr_size, _vr_size, err, magic;
+        struct vring *vr;
+        u8 type = ioread8(&vdev->desc->type);
+
+        if (index >= ioread8(&vdev->desc->num_vq))
+                return ERR_PTR(-ENOENT);
+
+        if (!name)
+                return ERR_PTR(-ENOENT);
+
+        /* First assign the vring's allocated in host memory */
+        vqconfig = _vop_vq_config(vdev->desc) + index;
+        memcpy_fromio(&config, vqconfig, sizeof(config));
+        _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN);
+        vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info));
+        va = vpdev->hw_ops->ioremap(vpdev, le64_to_cpu(config.address),
+                        vr_size);
+        if (!va)
+                return ERR_PTR(-ENOMEM);
+        vdev->vr[index] = va;
+        memset_io(va, 0x0, _vr_size);
+        vq = vring_new_virtqueue(
+                                index,
+                                le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN,
+                                dev,
+                                false,
+                                (void __force *)va, vop_notify, callback, name);
+        if (!vq) {
+                err = -ENOMEM;
+                goto unmap;
+        }
+        info = va + _vr_size;
+        magic = ioread32(&info->magic);
+
+        if (WARN(magic != MIC_MAGIC + type + index, "magic mismatch")) {
+                err = -EIO;
+                goto unmap;
+        }
+
+        /* Allocate and reassign used ring now */
+        vdev->used_size[index] = PAGE_ALIGN(sizeof(__u16) * 3 +
+                                             sizeof(struct vring_used_elem) *
+                                             le16_to_cpu(config.num));
+        used = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                        get_order(vdev->used_size[index]));
+        if (!used) {
+                err = -ENOMEM;
+                dev_err(_vop_dev(vdev), "%s %d err %d\n",
+                        __func__, __LINE__, err);
+                goto del_vq;
+        }
+        vdev->used[index] = dma_map_single(&vpdev->dev, used,
+                                            vdev->used_size[index],
+                                            DMA_BIDIRECTIONAL);
+        if (dma_mapping_error(&vpdev->dev, vdev->used[index])) {
+                err = -ENOMEM;
+                dev_err(_vop_dev(vdev), "%s %d err %d\n",
+                        __func__, __LINE__, err);
+                goto free_used;
+        }
+        writeq(vdev->used[index], &vqconfig->used_address);
+        /*
+         * To reassign the used ring here we are directly accessing
+         * struct vring_virtqueue which is a private data structure
+         * in virtio_ring.c. At the minimum, a BUILD_BUG_ON() in
+         * vring_new_virtqueue() would ensure that
+         *  (&vq->vring == (struct vring *) (&vq->vq + 1));
+         */
+        vr = (struct vring *)(vq + 1);
+        vr->used = used;
+
+        vq->priv = vdev;
+        return vq;
+free_used:
+        free_pages((unsigned long)used,
+                   get_order(vdev->used_size[index]));
+del_vq:
+        vring_del_virtqueue(vq);
+unmap:
+        vpdev->hw_ops->iounmap(vpdev, vdev->vr[index]);
+        return ERR_PTR(err);
+}
+
+static int vop_find_vqs(struct virtio_device *dev, unsigned nvqs,
+                        struct virtqueue *vqs[],
+                        vq_callback_t *callbacks[],
+                        const char * const names[])
+{
+        struct _vop_vdev *vdev = to_vopvdev(dev);
+        struct vop_device *vpdev = vdev->vpdev;
+        struct mic_device_ctrl __iomem *dc = vdev->dc;
+        int i, err, retry;
+
+        /* We must have this many virtqueues. */
+        if (nvqs > ioread8(&vdev->desc->num_vq))
+                return -ENOENT;
+
+        for (i = 0; i < nvqs; ++i) {
+                dev_dbg(_vop_dev(vdev), "%s: %d: %s\n",
+                        __func__, i, names[i]);
+                vqs[i] = vop_find_vq(dev, i, callbacks[i], names[i]);
+                if (IS_ERR(vqs[i])) {
+                        err = PTR_ERR(vqs[i]);
+                        goto error;
+                }
+        }
+
+        iowrite8(1, &dc->used_address_updated);
+        /*
+         * Send an interrupt to the host to inform it that used
+         * rings have been re-assigned.
+         */
+        vpdev->hw_ops->send_intr(vpdev, vdev->c2h_vdev_db);
+        for (retry = 100; --retry;) {
+                if (!ioread8(&dc->used_address_updated))
+                        break;
+                msleep(100);
+        };
+
+        dev_dbg(_vop_dev(vdev), "%s: retry: %d\n", __func__, retry);
+        if (!retry) {
+                err = -ENODEV;
+                goto error;
+        }
+
+        return 0;
+error:
+        vop_del_vqs(dev);
+        return err;
+}
+
+/*
+ * The config ops structure as defined by virtio config
+ */
+static struct virtio_config_ops vop_vq_config_ops = {
+        .get_features = vop_get_features,
+        .finalize_features = vop_finalize_features,
+        .get = vop_get,
+        .set = vop_set,
+        .get_status = vop_get_status,
+        .set_status = vop_set_status,
+        .reset = vop_reset,
+        .find_vqs = vop_find_vqs,
+        .del_vqs = vop_del_vqs,
+};
+
+static irqreturn_t vop_virtio_intr_handler(int irq, void *data)
+{
+        struct _vop_vdev *vdev = data;
+        struct vop_device *vpdev = vdev->vpdev;
+        struct virtqueue *vq;
+
+        vpdev->hw_ops->ack_interrupt(vpdev, vdev->h2c_vdev_db);
+        list_for_each_entry(vq, &vdev->vdev.vqs, list)
+                vring_interrupt(0, vq);
+
+        return IRQ_HANDLED;
+}
+
+static void vop_virtio_release_dev(struct device *_d)
+{
+        /*
+         * No need for a release method similar to virtio PCI.
+         * Provide an empty one to avoid getting a warning from core.
+         */
+}
+
+/*
+ * adds a new device and register it with virtio
+ * appropriate drivers are loaded by the device model
+ */
+static int _vop_add_device(struct mic_device_desc __iomem *d,
+                           unsigned int offset, struct vop_device *vpdev,
+                           int dnode)
+{
+        struct _vop_vdev *vdev;
+        int ret;
+        u8 type = ioread8(&d->type);
+
+        vdev = kzalloc(sizeof(*vdev), GFP_KERNEL);
+        if (!vdev)
+                return -ENOMEM;
+
+        vdev->vpdev = vpdev;
+        vdev->vdev.dev.parent = &vpdev->dev;
+        vdev->vdev.dev.release = vop_virtio_release_dev;
+        vdev->vdev.id.device = type;
+        vdev->vdev.config = &vop_vq_config_ops;
+        vdev->desc = d;
+        vdev->dc = (void __iomem *)d + _vop_aligned_desc_size(d);
+        vdev->dnode = dnode;
+        vdev->vdev.priv = (void *)(u64)dnode;
+        init_completion(&vdev->reset_done);
+
+        vdev->h2c_vdev_db = vpdev->hw_ops->next_db(vpdev);
+        vdev->virtio_cookie = vpdev->hw_ops->request_irq(vpdev,
+                        vop_virtio_intr_handler, "virtio intr",
+                        vdev, vdev->h2c_vdev_db);
+        if (IS_ERR(vdev->virtio_cookie)) {
+                ret = PTR_ERR(vdev->virtio_cookie);
+                goto kfree;
+        }
+        iowrite8((u8)vdev->h2c_vdev_db, &vdev->dc->h2c_vdev_db);
+        vdev->c2h_vdev_db = ioread8(&vdev->dc->c2h_vdev_db);
+
+        ret = register_virtio_device(&vdev->vdev);
+        if (ret) {
+                dev_err(_vop_dev(vdev),
+                        "Failed to register vop device %u type %u\n",
+                        offset, type);
+                goto free_irq;
+        }
+        writeq((u64)vdev, &vdev->dc->vdev);
+        dev_dbg(_vop_dev(vdev), "%s: registered vop device %u type %u vdev %p\n",
+                __func__, offset, type, vdev);
+
+        return 0;
+
+free_irq:
+        vpdev->hw_ops->free_irq(vpdev, vdev->virtio_cookie, vdev);
+kfree:
+        kfree(vdev);
+        return ret;
+}
+
+/*
+ * match for a vop device with a specific desc pointer
+ */
+static int vop_match_desc(struct device *dev, void *data)
+{
+        struct virtio_device *_dev = dev_to_virtio(dev);
+        struct _vop_vdev *vdev = to_vopvdev(_dev);
+
+        return vdev->desc == (void __iomem *)data;
+}
+
+static void _vop_handle_config_change(struct mic_device_desc __iomem *d,
+                                      unsigned int offset,
+                                      struct vop_device *vpdev)
+{
+        struct mic_device_ctrl __iomem *dc
+                = (void __iomem *)d + _vop_aligned_desc_size(d);
+        struct _vop_vdev *vdev = (struct _vop_vdev *)readq(&dc->vdev);
+
+        if (ioread8(&dc->config_change) != MIC_VIRTIO_PARAM_CONFIG_CHANGED)
+                return;
+
+        dev_dbg(&vpdev->dev, "%s %d\n", __func__, __LINE__);
+        virtio_config_changed(&vdev->vdev);
+        iowrite8(1, &dc->guest_ack);
+}
+
+/*
+ * removes a virtio device if a hot remove event has been
+ * requested by the host.
+ */
+static int _vop_remove_device(struct mic_device_desc __iomem *d,
+                              unsigned int offset, struct vop_device *vpdev)
+{
+        struct mic_device_ctrl __iomem *dc
+                = (void __iomem *)d + _vop_aligned_desc_size(d);
+        struct _vop_vdev *vdev = (struct _vop_vdev *)readq(&dc->vdev);
+        u8 status;
+        int ret = -1;
+
+        if (ioread8(&dc->config_change) == MIC_VIRTIO_PARAM_DEV_REMOVE) {
+                dev_dbg(&vpdev->dev,
+                        "%s %d config_change %d type %d vdev %p\n",
+                        __func__, __LINE__,
+                        ioread8(&dc->config_change), ioread8(&d->type), vdev);
+                status = ioread8(&d->status);
+                reinit_completion(&vdev->reset_done);
+                unregister_virtio_device(&vdev->vdev);
+                vpdev->hw_ops->free_irq(vpdev, vdev->virtio_cookie, vdev);
+                iowrite8(-1, &dc->h2c_vdev_db);
+                if (status & VIRTIO_CONFIG_S_DRIVER_OK)
+                        wait_for_completion(&vdev->reset_done);
+                kfree(vdev);
+                iowrite8(1, &dc->guest_ack);
+                dev_dbg(&vpdev->dev, "%s %d guest_ack %d\n",
+                        __func__, __LINE__, ioread8(&dc->guest_ack));
+                iowrite8(-1, &d->type);
+                ret = 0;
+        }
+        return ret;
+}
+
+#define REMOVE_DEVICES true
+
+static void _vop_scan_devices(void __iomem *dp, struct vop_device *vpdev,
+                              bool remove, int dnode)
+{
+        s8 type;
+        unsigned int i;
+        struct mic_device_desc __iomem *d;
+        struct mic_device_ctrl __iomem *dc;
+        struct device *dev;
+        int ret;
+
+        for (i = sizeof(struct mic_bootparam);
+                        i < MIC_DP_SIZE; i += _vop_total_desc_size(d)) {
+                d = dp + i;
+                dc = (void __iomem *)d + _vop_aligned_desc_size(d);
+                /*
+                 * This read barrier is paired with the corresponding write
+                 * barrier on the host which is inserted before adding or
+                 * removing a virtio device descriptor, by updating the type.
+                 */
+                rmb();
+                type = ioread8(&d->type);
+
+                /* end of list */
+                if (type == 0)
+                        break;
+
+                if (type == -1)
+                        continue;
+
+                /* device already exists */
+                dev = device_find_child(&vpdev->dev, (void __force *)d,
+                                        vop_match_desc);
+                if (dev) {
+                        if (remove)
+                                iowrite8(MIC_VIRTIO_PARAM_DEV_REMOVE,
+                                         &dc->config_change);
+                        put_device(dev);
+                        _vop_handle_config_change(d, i, vpdev);
+                        ret = _vop_remove_device(d, i, vpdev);
+                        if (remove) {
+                                iowrite8(0, &dc->config_change);
+                                iowrite8(0, &dc->guest_ack);
+                        }
+                        continue;
+                }
+
+                /* new device */
+                dev_dbg(&vpdev->dev, "%s %d Adding new virtio device %p\n",
+                        __func__, __LINE__, d);
+                if (!remove)
+                        _vop_add_device(d, i, vpdev, dnode);
+        }
+}
+
+static void vop_scan_devices(struct vop_info *vi,
+                             struct vop_device *vpdev, bool remove)
+{
+        void __iomem *dp = vpdev->hw_ops->get_remote_dp(vpdev);
+
+        if (!dp)
+                return;
+        mutex_lock(&vi->vop_mutex);
+        _vop_scan_devices(dp, vpdev, remove, vpdev->dnode);
+        mutex_unlock(&vi->vop_mutex);
+}
+
+/*
+ * vop_hotplug_device tries to find changes in the device page.
+ */
+static void vop_hotplug_devices(struct work_struct *work)
+{
+        struct vop_info *vi = container_of(work, struct vop_info,
+                                             hotplug_work);
+
+        vop_scan_devices(vi, vi->vpdev, !REMOVE_DEVICES);
+}
+
+/*
+ * Interrupt handler for hot plug/config changes etc.
+ */
+static irqreturn_t vop_extint_handler(int irq, void *data)
+{
+        struct vop_info *vi = data;
+        struct mic_bootparam __iomem *bp;
+        struct vop_device *vpdev = vi->vpdev;
+
+        bp = vpdev->hw_ops->get_remote_dp(vpdev);
+        dev_dbg(&vpdev->dev, "%s %d hotplug work\n",
+                __func__, __LINE__);
+        vpdev->hw_ops->ack_interrupt(vpdev, ioread8(&bp->h2c_config_db));
+        schedule_work(&vi->hotplug_work);
+        return IRQ_HANDLED;
+}
+
+static int vop_driver_probe(struct vop_device *vpdev)
+{
+        struct vop_info *vi;
+        int rc;
+
+        vi = kzalloc(sizeof(*vi), GFP_KERNEL);
+        if (!vi) {
+                rc = -ENOMEM;
+                goto exit;
+        }
+        dev_set_drvdata(&vpdev->dev, vi);
+        vi->vpdev = vpdev;
+
+        mutex_init(&vi->vop_mutex);
+        INIT_WORK(&vi->hotplug_work, vop_hotplug_devices);
+        if (vpdev->dnode) {
+                rc = vop_host_init(vi);
+                if (rc < 0)
+                        goto free;
+        } else {
+                struct mic_bootparam __iomem *bootparam;
+
+                vop_scan_devices(vi, vpdev, !REMOVE_DEVICES);
+
+                vi->h2c_config_db = vpdev->hw_ops->next_db(vpdev);
+                vi->cookie = vpdev->hw_ops->request_irq(vpdev,
+                                                        vop_extint_handler,
+                                                        "virtio_config_intr",
+                                                        vi, vi->h2c_config_db);
+                if (IS_ERR(vi->cookie)) {
+                        rc = PTR_ERR(vi->cookie);
+                        goto free;
+                }
+                bootparam = vpdev->hw_ops->get_remote_dp(vpdev);
+                iowrite8(vi->h2c_config_db, &bootparam->h2c_config_db);
+        }
+        vop_init_debugfs(vi);
+        return 0;
+free:
+        kfree(vi);
+exit:
+        return rc;
+}
+
+static void vop_driver_remove(struct vop_device *vpdev)
+{
+        struct vop_info *vi = dev_get_drvdata(&vpdev->dev);
+
+        if (vpdev->dnode) {
+                vop_host_uninit(vi);
+        } else {
+                struct mic_bootparam __iomem *bootparam =
+                        vpdev->hw_ops->get_remote_dp(vpdev);
+                if (bootparam)
+                        iowrite8(-1, &bootparam->h2c_config_db);
+                vpdev->hw_ops->free_irq(vpdev, vi->cookie, vi);
+                flush_work(&vi->hotplug_work);
+                vop_scan_devices(vi, vpdev, REMOVE_DEVICES);
+        }
+        vop_exit_debugfs(vi);
+        kfree(vi);
+}
+
+static struct vop_device_id id_table[] = {
+        { VOP_DEV_TRNSP, VOP_DEV_ANY_ID },
+        { 0 },
+};
+
+static struct vop_driver vop_driver = {
+        .driver.name =  KBUILD_MODNAME,
+        .driver.owner = THIS_MODULE,
+        .id_table = id_table,
+        .probe = vop_driver_probe,
+        .remove = vop_driver_remove,
+};
+
+module_vop_driver(vop_driver);
+
+MODULE_DEVICE_TABLE(mbus, id_table);
+MODULE_AUTHOR("Intel Corporation");
+MODULE_DESCRIPTION("Intel(R) Virtio Over PCIe (VOP) driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/mic/host/mic_virtio.h b/drivers/misc/mic/vop/vop_main.h
index a80631f2790d..ba47ec7a6386 100644
--- a/drivers/misc/mic/host/mic_virtio.h
+++ b/drivers/misc/mic/vop/vop_main.h
@@ -1,7 +1,7 @@
 /*
  * Intel MIC Platform Software Stack (MPSS)
  *
- * Copyright(c) 2013 Intel Corporation.
+ * Copyright(c) 2016 Intel Corporation.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License, version 2, as
@@ -15,14 +15,21 @@
  * The full GNU General Public License is included in this distribution in
  * the file called "COPYING".
  *
- * Intel MIC Host driver.
+ * Intel Virtio Over PCIe (VOP) driver.
  *
  */
-#ifndef MIC_VIRTIO_H
-#define MIC_VIRTIO_H
+#ifndef _VOP_MAIN_H_
+#define _VOP_MAIN_H_
 
+#include <linux/vringh.h>
 #include <linux/virtio_config.h>
-#include <linux/mic_ioctl.h>
+#include <linux/virtio.h>
+#include <linux/miscdevice.h>
+
+#include <linux/mic_common.h>
+#include "../common/mic_dev.h"
+
+#include "../bus/vop_bus.h"
 
 /*
  * Note on endianness.
@@ -39,38 +46,68 @@
  *    in guest endianness.
  */
 
+/*
+ * vop_info - Allocated per invocation of VOP probe
+ *
+ * @vpdev: VOP device
+ * @hotplug_work: Handle virtio device creation, deletion and configuration
+ * @cookie: Cookie received upon requesting a virtio configuration interrupt
+ * @h2c_config_db: The doorbell used by the peer to indicate a config change
+ * @vdev_list: List of "active" virtio devices injected in the peer node
+ * @vop_mutex: Synchronize access to the device page as well as serialize
+ *             creation/deletion of virtio devices on the peer node
+ * @dp: Peer device page information
+ * @dbg: Debugfs entry
+ * @dma_ch: The DMA channel used by this transport for data transfers.
+ * @name: Name for this transport used in misc device creation.
+ * @miscdev: The misc device registered.
+ */
+struct vop_info {
+        struct vop_device *vpdev;
+        struct work_struct hotplug_work;
+        struct mic_irq *cookie;
+        int h2c_config_db;
+        struct list_head vdev_list;
+        struct mutex vop_mutex;
+        void __iomem *dp;
+        struct dentry *dbg;
+        struct dma_chan *dma_ch;
+        char name[16];
+        struct miscdevice miscdev;
+};
+
 /**
- * struct mic_vringh - Virtio ring host information.
+ * struct vop_vringh - Virtio ring host information.
  *
- * @vring: The MIC vring used for setting up user space mappings.
+ * @vring: The VOP vring used for setting up user space mappings.
  * @vrh: The host VRINGH used for accessing the card vrings.
  * @riov: The VRINGH read kernel IOV.
  * @wiov: The VRINGH write kernel IOV.
+ * @head: The VRINGH head index address passed to vringh_getdesc_kern(..).
  * @vr_mutex: Mutex for synchronizing access to the VRING.
  * @buf: Temporary kernel buffer used to copy in/out data
  * from/to the card via DMA.
  * @buf_da: dma address of buf.
- * @mvdev: Back pointer to MIC virtio device for vringh_notify(..).
- * @head: The VRINGH head index address passed to vringh_getdesc_kern(..).
+ * @vdev: Back pointer to VOP virtio device for vringh_notify(..).
  */
-struct mic_vringh {
+struct vop_vringh {
         struct mic_vring vring;
         struct vringh vrh;
         struct vringh_kiov riov;
         struct vringh_kiov wiov;
+        u16 head;
         struct mutex vr_mutex;
         void *buf;
         dma_addr_t buf_da;
-        struct mic_vdev *mvdev;
-        u16 head;
+        struct vop_vdev *vdev;
 };
 
 /**
- * struct mic_vdev - Host information for a card Virtio device.
+ * struct vop_vdev - Host information for a card Virtio device.
  *
  * @virtio_id - Virtio device id.
  * @waitq - Waitqueue to allow ring3 apps to poll.
- * @mdev - Back pointer to host MIC device.
+ * @vpdev - pointer to VOP bus device.
  * @poll_wake - Used for waking up threads blocked in poll.
  * @out_bytes - Debug stats for number of bytes copied from host to card.
  * @in_bytes - Debug stats for number of bytes copied from card to host.
@@ -82,18 +119,23 @@ struct mic_vringh {
  * the transfer length did not have the required DMA alignment.
  * @tx_dst_unaligned - Debug stats for number of bytes copied where the
  * destination address on the card did not have the required DMA alignment.
- * @mvr - Store per VRING data structures.
+ * @vvr - Store per VRING data structures.
  * @virtio_bh_work - Work struct used to schedule virtio bottom half handling.
  * @dd - Virtio device descriptor.
  * @dc - Virtio device control fields.
  * @list - List of Virtio devices.
  * @virtio_db - The doorbell used by the card to interrupt the host.
  * @virtio_cookie - The cookie returned while requesting interrupts.
+ * @vi: Transport information.
+ * @vdev_mutex: Mutex synchronizing virtio device injection,
+ *              removal and data transfers.
+ * @destroy: Track if a virtio device is being destroyed.
+ * @deleted: The virtio device has been deleted.
  */
-struct mic_vdev {
+struct vop_vdev {
         int virtio_id;
         wait_queue_head_t waitq;
-        struct mic_device *mdev;
+        struct vop_device *vpdev;
         int poll_wake;
         unsigned long out_bytes;
         unsigned long in_bytes;
@@ -101,55 +143,28 @@ struct mic_vdev {
         unsigned long in_bytes_dma;
         unsigned long tx_len_unaligned;
         unsigned long tx_dst_unaligned;
-        struct mic_vringh mvr[MIC_MAX_VRINGS];
+        unsigned long rx_dst_unaligned;
+        struct vop_vringh vvr[MIC_MAX_VRINGS];
         struct work_struct virtio_bh_work;
         struct mic_device_desc *dd;
         struct mic_device_ctrl *dc;
         struct list_head list;
         int virtio_db;
         struct mic_irq *virtio_cookie;
+        struct vop_info *vi;
+        struct mutex vdev_mutex;
+        struct completion destroy;
+        bool deleted;
 };
 
-void mic_virtio_uninit(struct mic_device *mdev);
-int mic_virtio_add_device(struct mic_vdev *mvdev,
-                        void __user *argp);
-void mic_virtio_del_device(struct mic_vdev *mvdev);
-int mic_virtio_config_change(struct mic_vdev *mvdev,
-                        void __user *argp);
-int mic_virtio_copy_desc(struct mic_vdev *mvdev,
-        struct mic_copy_desc *request);
-void mic_virtio_reset_devices(struct mic_device *mdev);
-void mic_bh_handler(struct work_struct *work);
-
-/* Helper API to obtain the MIC PCIe device */
-static inline struct device *mic_dev(struct mic_vdev *mvdev)
-{
-        return &mvdev->mdev->pdev->dev;
-}
-
-/* Helper API to check if a virtio device is initialized */
-static inline int mic_vdev_inited(struct mic_vdev *mvdev)
-{
-        /* Device has not been created yet */
-        if (!mvdev->dd || !mvdev->dd->type) {
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, -EINVAL);
-                return -EINVAL;
-        }
-
-        /* Device has been removed/deleted */
-        if (mvdev->dd->type == -1) {
-                dev_err(mic_dev(mvdev), "%s %d err %d\n",
-                        __func__, __LINE__, -ENODEV);
-                return -ENODEV;
-        }
-
-        return 0;
-}
-
 /* Helper API to check if a virtio device is running */
-static inline bool mic_vdevup(struct mic_vdev *mvdev)
+static inline bool vop_vdevup(struct vop_vdev *vdev)
 {
-        return !!mvdev->dd->status;
+        return !!vdev->dd->status;
 }
+
+void vop_init_debugfs(struct vop_info *vi);
+void vop_exit_debugfs(struct vop_info *vi);
+int vop_host_init(struct vop_info *vi);
+void vop_host_uninit(struct vop_info *vi);
 #endif
diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c
new file mode 100644
index 000000000000..e94c7fb6712a
--- /dev/null
+++ b/drivers/misc/mic/vop/vop_vringh.c
@@ -0,0 +1,1165 @@
+/*
+ * Intel MIC Platform Software Stack (MPSS)
+ *
+ * Copyright(c) 2016 Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License, version 2, as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * The full GNU General Public License is included in this distribution in
+ * the file called "COPYING".
+ *
+ * Intel Virtio Over PCIe (VOP) driver.
+ *
+ */
+#include <linux/sched.h>
+#include <linux/poll.h>
+#include <linux/dma-mapping.h>
+
+#include <linux/mic_common.h>
+#include "../common/mic_dev.h"
+
+#include <linux/mic_ioctl.h>
+#include "vop_main.h"
+
+/* Helper API to obtain the VOP PCIe device */
+static inline struct device *vop_dev(struct vop_vdev *vdev)
+{
+        return vdev->vpdev->dev.parent;
+}
+
+/* Helper API to check if a virtio device is initialized */
+static inline int vop_vdev_inited(struct vop_vdev *vdev)
+{
+        if (!vdev)
+                return -EINVAL;
+        /* Device has not been created yet */
+        if (!vdev->dd || !vdev->dd->type) {
+                dev_err(vop_dev(vdev), "%s %d err %d\n",
+                        __func__, __LINE__, -EINVAL);
+                return -EINVAL;
+        }
+        /* Device has been removed/deleted */
+        if (vdev->dd->type == -1) {
+                dev_dbg(vop_dev(vdev), "%s %d err %d\n",
+                        __func__, __LINE__, -ENODEV);
+                return -ENODEV;
+        }
+        return 0;
+}
+
+static void _vop_notify(struct vringh *vrh)
+{
+        struct vop_vringh *vvrh = container_of(vrh, struct vop_vringh, vrh);
+        struct vop_vdev *vdev = vvrh->vdev;
+        struct vop_device *vpdev = vdev->vpdev;
+        s8 db = vdev->dc->h2c_vdev_db;
+
+        if (db != -1)
+                vpdev->hw_ops->send_intr(vpdev, db);
+}
+
+static void vop_virtio_init_post(struct vop_vdev *vdev)
+{
+        struct mic_vqconfig *vqconfig = mic_vq_config(vdev->dd);
+        struct vop_device *vpdev = vdev->vpdev;
+        int i, used_size;
+
+        for (i = 0; i < vdev->dd->num_vq; i++) {
+                used_size = PAGE_ALIGN(sizeof(u16) * 3 +
+                                sizeof(struct vring_used_elem) *
+                                le16_to_cpu(vqconfig->num));
+                if (!le64_to_cpu(vqconfig[i].used_address)) {
+                        dev_warn(vop_dev(vdev), "used_address zero??\n");
+                        continue;
+                }
+                vdev->vvr[i].vrh.vring.used =
+                        (void __force *)vpdev->hw_ops->ioremap(
+                        vpdev,
+                        le64_to_cpu(vqconfig[i].used_address),
+                        used_size);
+        }
+
+        vdev->dc->used_address_updated = 0;
+
+        dev_info(vop_dev(vdev), "%s: device type %d LINKUP\n",
+                 __func__, vdev->virtio_id);
+}
+
+static inline void vop_virtio_device_reset(struct vop_vdev *vdev)
+{
+        int i;
+
+        dev_dbg(vop_dev(vdev), "%s: status %d device type %d RESET\n",
+                __func__, vdev->dd->status, vdev->virtio_id);
+
+        for (i = 0; i < vdev->dd->num_vq; i++)
+                /*
+                 * Avoid lockdep false positive. The + 1 is for the vop
+                 * mutex which is held in the reset devices code path.
+                 */
+                mutex_lock_nested(&vdev->vvr[i].vr_mutex, i + 1);
+
+        /* 0 status means "reset" */
+        vdev->dd->status = 0;
+        vdev->dc->vdev_reset = 0;
+        vdev->dc->host_ack = 1;
+
+        for (i = 0; i < vdev->dd->num_vq; i++) {
+                struct vringh *vrh = &vdev->vvr[i].vrh;
+
+                vdev->vvr[i].vring.info->avail_idx = 0;
+                vrh->completed = 0;
+                vrh->last_avail_idx = 0;
+                vrh->last_used_idx = 0;
+        }
+
+        for (i = 0; i < vdev->dd->num_vq; i++)
+                mutex_unlock(&vdev->vvr[i].vr_mutex);
+}
+
+static void vop_virtio_reset_devices(struct vop_info *vi)
+{
+        struct list_head *pos, *tmp;
+        struct vop_vdev *vdev;
+
+        list_for_each_safe(pos, tmp, &vi->vdev_list) {
+                vdev = list_entry(pos, struct vop_vdev, list);
+                vop_virtio_device_reset(vdev);
+                vdev->poll_wake = 1;
+                wake_up(&vdev->waitq);
+        }
+}
+
+static void vop_bh_handler(struct work_struct *work)
+{
+        struct vop_vdev *vdev = container_of(work, struct vop_vdev,
+                        virtio_bh_work);
+
+        if (vdev->dc->used_address_updated)
+                vop_virtio_init_post(vdev);
+
+        if (vdev->dc->vdev_reset)
+                vop_virtio_device_reset(vdev);
+
+        vdev->poll_wake = 1;
+        wake_up(&vdev->waitq);
+}
+
+static irqreturn_t _vop_virtio_intr_handler(int irq, void *data)
+{
+        struct vop_vdev *vdev = data;
+        struct vop_device *vpdev = vdev->vpdev;
+
+        vpdev->hw_ops->ack_interrupt(vpdev, vdev->virtio_db);
+        schedule_work(&vdev->virtio_bh_work);
+        return IRQ_HANDLED;
+}
+
+static int vop_virtio_config_change(struct vop_vdev *vdev, void *argp)
+{
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
+        int ret = 0, retry, i;
+        struct vop_device *vpdev = vdev->vpdev;
+        struct vop_info *vi = dev_get_drvdata(&vpdev->dev);
+        struct mic_bootparam *bootparam = vpdev->hw_ops->get_dp(vpdev);
+        s8 db = bootparam->h2c_config_db;
+
+        mutex_lock(&vi->vop_mutex);
+        for (i = 0; i < vdev->dd->num_vq; i++)
+                mutex_lock_nested(&vdev->vvr[i].vr_mutex, i + 1);
+
+        if (db == -1 || vdev->dd->type == -1) {
+                ret = -EIO;
+                goto exit;
+        }
+
+        memcpy(mic_vq_configspace(vdev->dd), argp, vdev->dd->config_len);
+        vdev->dc->config_change = MIC_VIRTIO_PARAM_CONFIG_CHANGED;
+        vpdev->hw_ops->send_intr(vpdev, db);
+
+        for (retry = 100; retry--;) {
+                ret = wait_event_timeout(wake, vdev->dc->guest_ack,
+                                         msecs_to_jiffies(100));
+                if (ret)
+                        break;
+        }
+
+        dev_dbg(vop_dev(vdev),
+                "%s %d retry: %d\n", __func__, __LINE__, retry);
+        vdev->dc->config_change = 0;
+        vdev->dc->guest_ack = 0;
+exit:
+        for (i = 0; i < vdev->dd->num_vq; i++)
+                mutex_unlock(&vdev->vvr[i].vr_mutex);
+        mutex_unlock(&vi->vop_mutex);
+        return ret;
+}
+
+static int vop_copy_dp_entry(struct vop_vdev *vdev,
+                             struct mic_device_desc *argp, __u8 *type,
+                             struct mic_device_desc **devpage)
+{
+        struct vop_device *vpdev = vdev->vpdev;
+        struct mic_device_desc *devp;
+        struct mic_vqconfig *vqconfig;
+        int ret = 0, i;
+        bool slot_found = false;
+
+        vqconfig = mic_vq_config(argp);
+        for (i = 0; i < argp->num_vq; i++) {
+                if (le16_to_cpu(vqconfig[i].num) > MIC_MAX_VRING_ENTRIES) {
+                        ret =  -EINVAL;
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, ret);
+                        goto exit;
+                }
+        }
+
+        /* Find the first free device page entry */
+        for (i = sizeof(struct mic_bootparam);
+                i < MIC_DP_SIZE - mic_total_desc_size(argp);
+                i += mic_total_desc_size(devp)) {
+                devp = vpdev->hw_ops->get_dp(vpdev) + i;
+                if (devp->type == 0 || devp->type == -1) {
+                        slot_found = true;
+                        break;
+                }
+        }
+        if (!slot_found) {
+                ret =  -EINVAL;
+                dev_err(vop_dev(vdev), "%s %d err %d\n",
+                        __func__, __LINE__, ret);
+                goto exit;
+        }
+        /*
+         * Save off the type before doing the memcpy. Type will be set in the
+         * end after completing all initialization for the new device.
+         */
+        *type = argp->type;
+        argp->type = 0;
+        memcpy(devp, argp, mic_desc_size(argp));
+
+        *devpage = devp;
+exit:
+        return ret;
+}
+
+static void vop_init_device_ctrl(struct vop_vdev *vdev,
+                                 struct mic_device_desc *devpage)
+{
+        struct mic_device_ctrl *dc;
+
+        dc = (void *)devpage + mic_aligned_desc_size(devpage);
+
+        dc->config_change = 0;
+        dc->guest_ack = 0;
+        dc->vdev_reset = 0;
+        dc->host_ack = 0;
+        dc->used_address_updated = 0;
+        dc->c2h_vdev_db = -1;
+        dc->h2c_vdev_db = -1;
+        vdev->dc = dc;
+}
+
+static int vop_virtio_add_device(struct vop_vdev *vdev,
+                                 struct mic_device_desc *argp)
+{
+        struct vop_info *vi = vdev->vi;
+        struct vop_device *vpdev = vi->vpdev;
+        struct mic_device_desc *dd = NULL;
+        struct mic_vqconfig *vqconfig;
+        int vr_size, i, j, ret;
+        u8 type = 0;
+        s8 db = -1;
+        char irqname[16];
+        struct mic_bootparam *bootparam;
+        u16 num;
+        dma_addr_t vr_addr;
+
+        bootparam = vpdev->hw_ops->get_dp(vpdev);
+        init_waitqueue_head(&vdev->waitq);
+        INIT_LIST_HEAD(&vdev->list);
+        vdev->vpdev = vpdev;
+
+        ret = vop_copy_dp_entry(vdev, argp, &type, &dd);
+        if (ret) {
+                dev_err(vop_dev(vdev), "%s %d err %d\n",
+                        __func__, __LINE__, ret);
+                kfree(vdev);
+                return ret;
+        }
+
+        vop_init_device_ctrl(vdev, dd);
+
+        vdev->dd = dd;
+        vdev->virtio_id = type;
+        vqconfig = mic_vq_config(dd);
+        INIT_WORK(&vdev->virtio_bh_work, vop_bh_handler);
+
+        for (i = 0; i < dd->num_vq; i++) {
+                struct vop_vringh *vvr = &vdev->vvr[i];
+                struct mic_vring *vr = &vdev->vvr[i].vring;
+
+                num = le16_to_cpu(vqconfig[i].num);
+                mutex_init(&vvr->vr_mutex);
+                vr_size = PAGE_ALIGN(vring_size(num, MIC_VIRTIO_RING_ALIGN) +
+                        sizeof(struct _mic_vring_info));
+                vr->va = (void *)
+                        __get_free_pages(GFP_KERNEL | __GFP_ZERO,
+                                         get_order(vr_size));
+                if (!vr->va) {
+                        ret = -ENOMEM;
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, ret);
+                        goto err;
+                }
+                vr->len = vr_size;
+                vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN);
+                vr->info->magic = cpu_to_le32(MIC_MAGIC + vdev->virtio_id + i);
+                vr_addr = dma_map_single(&vpdev->dev, vr->va, vr_size,
+                                         DMA_BIDIRECTIONAL);
+                if (dma_mapping_error(&vpdev->dev, vr_addr)) {
+                        free_pages((unsigned long)vr->va, get_order(vr_size));
+                        ret = -ENOMEM;
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, ret);
+                        goto err;
+                }
+                vqconfig[i].address = cpu_to_le64(vr_addr);
+
+                vring_init(&vr->vr, num, vr->va, MIC_VIRTIO_RING_ALIGN);
+                ret = vringh_init_kern(&vvr->vrh,
+                                       *(u32 *)mic_vq_features(vdev->dd),
+                                       num, false, vr->vr.desc, vr->vr.avail,
+                                       vr->vr.used);
+                if (ret) {
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, ret);
+                        goto err;
+                }
+                vringh_kiov_init(&vvr->riov, NULL, 0);
+                vringh_kiov_init(&vvr->wiov, NULL, 0);
+                vvr->head = USHRT_MAX;
+                vvr->vdev = vdev;
+                vvr->vrh.notify = _vop_notify;
+                dev_dbg(&vpdev->dev,
+                        "%s %d index %d va %p info %p vr_size 0x%x\n",
+                        __func__, __LINE__, i, vr->va, vr->info, vr_size);
+                vvr->buf = (void *)__get_free_pages(GFP_KERNEL,
+                                        get_order(VOP_INT_DMA_BUF_SIZE));
+                vvr->buf_da = dma_map_single(&vpdev->dev,
+                                          vvr->buf, VOP_INT_DMA_BUF_SIZE,
+                                          DMA_BIDIRECTIONAL);
+        }
+
+        snprintf(irqname, sizeof(irqname), "vop%dvirtio%d", vpdev->index,
+                 vdev->virtio_id);
+        vdev->virtio_db = vpdev->hw_ops->next_db(vpdev);
+        vdev->virtio_cookie = vpdev->hw_ops->request_irq(vpdev,
+                        _vop_virtio_intr_handler, irqname, vdev,
+                        vdev->virtio_db);
+        if (IS_ERR(vdev->virtio_cookie)) {
+                ret = PTR_ERR(vdev->virtio_cookie);
+                dev_dbg(&vpdev->dev, "request irq failed\n");
+                goto err;
+        }
+
+        vdev->dc->c2h_vdev_db = vdev->virtio_db;
+
+        /*
+         * Order the type update with previous stores. This write barrier
+         * is paired with the corresponding read barrier before the uncached
+         * system memory read of the type, on the card while scanning the
+         * device page.
+         */
+        smp_wmb();
+        dd->type = type;
+        argp->type = type;
+
+        if (bootparam) {
+                db = bootparam->h2c_config_db;
+                if (db != -1)
+                        vpdev->hw_ops->send_intr(vpdev, db);
+        }
+        dev_dbg(&vpdev->dev, "Added virtio id %d db %d\n", dd->type, db);
+        return 0;
+err:
+        vqconfig = mic_vq_config(dd);
+        for (j = 0; j < i; j++) {
+                struct vop_vringh *vvr = &vdev->vvr[j];
+
+                dma_unmap_single(&vpdev->dev, le64_to_cpu(vqconfig[j].address),
+                                 vvr->vring.len, DMA_BIDIRECTIONAL);
+                free_pages((unsigned long)vvr->vring.va,
+                           get_order(vvr->vring.len));
+        }
+        return ret;
+}
+
+static void vop_dev_remove(struct vop_info *pvi, struct mic_device_ctrl *devp,
+                           struct vop_device *vpdev)
+{
+        struct mic_bootparam *bootparam = vpdev->hw_ops->get_dp(vpdev);
+        s8 db;
+        int ret, retry;
+        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wake);
+
+        devp->config_change = MIC_VIRTIO_PARAM_DEV_REMOVE;
+        db = bootparam->h2c_config_db;
+        if (db != -1)
+                vpdev->hw_ops->send_intr(vpdev, db);
+        else
+                goto done;
+        for (retry = 15; retry--;) {
+                ret = wait_event_timeout(wake, devp->guest_ack,
+                                         msecs_to_jiffies(1000));
+                if (ret)
+                        break;
+        }
+done:
+        devp->config_change = 0;
+        devp->guest_ack = 0;
+}
+
+static void vop_virtio_del_device(struct vop_vdev *vdev)
+{
+        struct vop_info *vi = vdev->vi;
+        struct vop_device *vpdev = vdev->vpdev;
+        int i;
+        struct mic_vqconfig *vqconfig;
+        struct mic_bootparam *bootparam = vpdev->hw_ops->get_dp(vpdev);
+
+        if (!bootparam)
+                goto skip_hot_remove;
+        vop_dev_remove(vi, vdev->dc, vpdev);
+skip_hot_remove:
+        vpdev->hw_ops->free_irq(vpdev, vdev->virtio_cookie, vdev);
+        flush_work(&vdev->virtio_bh_work);
+        vqconfig = mic_vq_config(vdev->dd);
+        for (i = 0; i < vdev->dd->num_vq; i++) {
+                struct vop_vringh *vvr = &vdev->vvr[i];
+
+                dma_unmap_single(&vpdev->dev,
+                                 vvr->buf_da, VOP_INT_DMA_BUF_SIZE,
+                                 DMA_BIDIRECTIONAL);
+                free_pages((unsigned long)vvr->buf,
+                           get_order(VOP_INT_DMA_BUF_SIZE));
+                vringh_kiov_cleanup(&vvr->riov);
+                vringh_kiov_cleanup(&vvr->wiov);
+                dma_unmap_single(&vpdev->dev, le64_to_cpu(vqconfig[i].address),
+                                 vvr->vring.len, DMA_BIDIRECTIONAL);
+                free_pages((unsigned long)vvr->vring.va,
+                           get_order(vvr->vring.len));
+        }
+        /*
+         * Order the type update with previous stores. This write barrier
+         * is paired with the corresponding read barrier before the uncached
+         * system memory read of the type, on the card while scanning the
+         * device page.
+         */
+        smp_wmb();
+        vdev->dd->type = -1;
+}
+
+/*
+ * vop_sync_dma - Wrapper for synchronous DMAs.
+ *
+ * @dev - The address of the pointer to the device instance used
+ * for DMA registration.
+ * @dst - destination DMA address.
+ * @src - source DMA address.
+ * @len - size of the transfer.
+ *
+ * Return DMA_SUCCESS on success
+ */
+static int vop_sync_dma(struct vop_vdev *vdev, dma_addr_t dst, dma_addr_t src,
+                        size_t len)
+{
+        int err = 0;
+        struct dma_device *ddev;
+        struct dma_async_tx_descriptor *tx;
+        struct vop_info *vi = dev_get_drvdata(&vdev->vpdev->dev);
+        struct dma_chan *vop_ch = vi->dma_ch;
+
+        if (!vop_ch) {
+                err = -EBUSY;
+                goto error;
+        }
+        ddev = vop_ch->device;
+        tx = ddev->device_prep_dma_memcpy(vop_ch, dst, src, len,
+                DMA_PREP_FENCE);
+        if (!tx) {
+                err = -ENOMEM;
+                goto error;
+        } else {
+                dma_cookie_t cookie;
+
+                cookie = tx->tx_submit(tx);
+                if (dma_submit_error(cookie)) {
+                        err = -ENOMEM;
+                        goto error;
+                }
+                dma_async_issue_pending(vop_ch);
+                err = dma_sync_wait(vop_ch, cookie);
+        }
+error:
+        if (err)
+                dev_err(&vi->vpdev->dev, "%s %d err %d\n",
+                        __func__, __LINE__, err);
+        return err;
+}
+
+#define VOP_USE_DMA true
+
+/*
+ * Initiates the copies across the PCIe bus from card memory to a user
+ * space buffer. When transfers are done using DMA, source/destination
+ * addresses and transfer length must follow the alignment requirements of
+ * the MIC DMA engine.
+ */
+static int vop_virtio_copy_to_user(struct vop_vdev *vdev, void __user *ubuf,
+                                   size_t len, u64 daddr, size_t dlen,
+                                   int vr_idx)
+{
+        struct vop_device *vpdev = vdev->vpdev;
+        void __iomem *dbuf = vpdev->hw_ops->ioremap(vpdev, daddr, len);
+        struct vop_vringh *vvr = &vdev->vvr[vr_idx];
+        struct vop_info *vi = dev_get_drvdata(&vpdev->dev);
+        size_t dma_alignment = 1 << vi->dma_ch->device->copy_align;
+        bool x200 = is_dma_copy_aligned(vi->dma_ch->device, 1, 1, 1);
+        size_t dma_offset, partlen;
+        int err;
+
+        if (!VOP_USE_DMA) {
+                if (copy_to_user(ubuf, (void __force *)dbuf, len)) {
+                        err = -EFAULT;
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, err);
+                        goto err;
+                }
+                vdev->in_bytes += len;
+                err = 0;
+                goto err;
+        }
+
+        dma_offset = daddr - round_down(daddr, dma_alignment);
+        daddr -= dma_offset;
+        len += dma_offset;
+        /*
+         * X100 uses DMA addresses as seen by the card so adding
+         * the aperture base is not required for DMA. However x200
+         * requires DMA addresses to be an offset into the bar so
+         * add the aperture base for x200.
+         */
+        if (x200)
+                daddr += vpdev->aper->pa;
+        while (len) {
+                partlen = min_t(size_t, len, VOP_INT_DMA_BUF_SIZE);
+                err = vop_sync_dma(vdev, vvr->buf_da, daddr,
+                                   ALIGN(partlen, dma_alignment));
+                if (err) {
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, err);
+                        goto err;
+                }
+                if (copy_to_user(ubuf, vvr->buf + dma_offset,
+                                 partlen - dma_offset)) {
+                        err = -EFAULT;
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, err);
+                        goto err;
+                }
+                daddr += partlen;
+                ubuf += partlen;
+                dbuf += partlen;
+                vdev->in_bytes_dma += partlen;
+                vdev->in_bytes += partlen;
+                len -= partlen;
+                dma_offset = 0;
+        }
+        err = 0;
+err:
+        vpdev->hw_ops->iounmap(vpdev, dbuf);
+        dev_dbg(vop_dev(vdev),
+                "%s: ubuf %p dbuf %p len 0x%lx vr_idx 0x%x\n",
+                __func__, ubuf, dbuf, len, vr_idx);
+        return err;
+}
+
+/*
+ * Initiates copies across the PCIe bus from a user space buffer to card
+ * memory. When transfers are done using DMA, source/destination addresses
+ * and transfer length must follow the alignment requirements of the MIC
+ * DMA engine.
+ */
+static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf,
+                                     size_t len, u64 daddr, size_t dlen,
+                                     int vr_idx)
+{
+        struct vop_device *vpdev = vdev->vpdev;
+        void __iomem *dbuf = vpdev->hw_ops->ioremap(vpdev, daddr, len);
+        struct vop_vringh *vvr = &vdev->vvr[vr_idx];
+        struct vop_info *vi = dev_get_drvdata(&vdev->vpdev->dev);
+        size_t dma_alignment = 1 << vi->dma_ch->device->copy_align;
+        bool x200 = is_dma_copy_aligned(vi->dma_ch->device, 1, 1, 1);
+        size_t partlen;
+        bool dma = VOP_USE_DMA;
+        int err = 0;
+
+        if (daddr & (dma_alignment - 1)) {
+                vdev->tx_dst_unaligned += len;
+                dma = false;
+        } else if (ALIGN(len, dma_alignment) > dlen) {
+                vdev->tx_len_unaligned += len;
+                dma = false;
+        }
+
+        if (!dma)
+                goto memcpy;
+
+        /*
+         * X100 uses DMA addresses as seen by the card so adding
+         * the aperture base is not required for DMA. However x200
+         * requires DMA addresses to be an offset into the bar so
+         * add the aperture base for x200.
+         */
+        if (x200)
+                daddr += vpdev->aper->pa;
+        while (len) {
+                partlen = min_t(size_t, len, VOP_INT_DMA_BUF_SIZE);
+
+                if (copy_from_user(vvr->buf, ubuf, partlen)) {
+                        err = -EFAULT;
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, err);
+                        goto err;
+                }
+                err = vop_sync_dma(vdev, daddr, vvr->buf_da,
+                                   ALIGN(partlen, dma_alignment));
+                if (err) {
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, err);
+                        goto err;
+                }
+                daddr += partlen;
+                ubuf += partlen;
+                dbuf += partlen;
+                vdev->out_bytes_dma += partlen;
+                vdev->out_bytes += partlen;
+                len -= partlen;
+        }
+memcpy:
+        /*
+         * We are copying to IO below and should ideally use something
+         * like copy_from_user_toio(..) if it existed.
+         */
+        if (copy_from_user((void __force *)dbuf, ubuf, len)) {
+                err = -EFAULT;
+                dev_err(vop_dev(vdev), "%s %d err %d\n",
+                        __func__, __LINE__, err);
+                goto err;
+        }
+        vdev->out_bytes += len;
+        err = 0;
+err:
+        vpdev->hw_ops->iounmap(vpdev, dbuf);
+        dev_dbg(vop_dev(vdev),
+                "%s: ubuf %p dbuf %p len 0x%lx vr_idx 0x%x\n",
+                __func__, ubuf, dbuf, len, vr_idx);
+        return err;
+}
+
+#define MIC_VRINGH_READ true
+
+/* Determine the total number of bytes consumed in a VRINGH KIOV */
+static inline u32 vop_vringh_iov_consumed(struct vringh_kiov *iov)
+{
+        int i;
+        u32 total = iov->consumed;
+
+        for (i = 0; i < iov->i; i++)
+                total += iov->iov[i].iov_len;
+        return total;
+}
+
+/*
+ * Traverse the VRINGH KIOV and issue the APIs to trigger the copies.
+ * This API is heavily based on the vringh_iov_xfer(..) implementation
+ * in vringh.c. The reason we cannot reuse vringh_iov_pull_kern(..)
+ * and vringh_iov_push_kern(..) directly is because there is no
+ * way to override the VRINGH xfer(..) routines as of v3.10.
+ */
+static int vop_vringh_copy(struct vop_vdev *vdev, struct vringh_kiov *iov,
+                           void __user *ubuf, size_t len, bool read, int vr_idx,
+                           size_t *out_len)
+{
+        int ret = 0;
+        size_t partlen, tot_len = 0;
+
+        while (len && iov->i < iov->used) {
+                struct kvec *kiov = &iov->iov[iov->i];
+
+                partlen = min(kiov->iov_len, len);
+                if (read)
+                        ret = vop_virtio_copy_to_user(vdev, ubuf, partlen,
+                                                      (u64)kiov->iov_base,
+                                                      kiov->iov_len,
+                                                      vr_idx);
+                else
+                        ret = vop_virtio_copy_from_user(vdev, ubuf, partlen,
+                                                        (u64)kiov->iov_base,
+                                                        kiov->iov_len,
+                                                        vr_idx);
+                if (ret) {
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, ret);
+                        break;
+                }
+                len -= partlen;
+                ubuf += partlen;
+                tot_len += partlen;
+                iov->consumed += partlen;
+                kiov->iov_len -= partlen;
+                kiov->iov_base += partlen;
+                if (!kiov->iov_len) {
+                        /* Fix up old iov element then increment. */
+                        kiov->iov_len = iov->consumed;
+                        kiov->iov_base -= iov->consumed;
+
+                        iov->consumed = 0;
+                        iov->i++;
+                }
+        }
+        *out_len = tot_len;
+        return ret;
+}
+
+/*
+ * Use the standard VRINGH infrastructure in the kernel to fetch new
+ * descriptors, initiate the copies and update the used ring.
+ */
+static int _vop_virtio_copy(struct vop_vdev *vdev, struct mic_copy_desc *copy)
+{
+        int ret = 0;
+        u32 iovcnt = copy->iovcnt;
+        struct iovec iov;
+        struct iovec __user *u_iov = copy->iov;
+        void __user *ubuf = NULL;
+        struct vop_vringh *vvr = &vdev->vvr[copy->vr_idx];
+        struct vringh_kiov *riov = &vvr->riov;
+        struct vringh_kiov *wiov = &vvr->wiov;
+        struct vringh *vrh = &vvr->vrh;
+        u16 *head = &vvr->head;
+        struct mic_vring *vr = &vvr->vring;
+        size_t len = 0, out_len;
+
+        copy->out_len = 0;
+        /* Fetch a new IOVEC if all previous elements have been processed */
+        if (riov->i == riov->used && wiov->i == wiov->used) {
+                ret = vringh_getdesc_kern(vrh, riov, wiov,
+                                          head, GFP_KERNEL);
+                /* Check if there are available descriptors */
+                if (ret <= 0)
+                        return ret;
+        }
+        while (iovcnt) {
+                if (!len) {
+                        /* Copy over a new iovec from user space. */
+                        ret = copy_from_user(&iov, u_iov, sizeof(*u_iov));
+                        if (ret) {
+                                ret = -EINVAL;
+                                dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                        __func__, __LINE__, ret);
+                                break;
+                        }
+                        len = iov.iov_len;
+                        ubuf = iov.iov_base;
+                }
+                /* Issue all the read descriptors first */
+                ret = vop_vringh_copy(vdev, riov, ubuf, len,
+                                      MIC_VRINGH_READ, copy->vr_idx, &out_len);
+                if (ret) {
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, ret);
+                        break;
+                }
+                len -= out_len;
+                ubuf += out_len;
+                copy->out_len += out_len;
+                /* Issue the write descriptors next */
+                ret = vop_vringh_copy(vdev, wiov, ubuf, len,
+                                      !MIC_VRINGH_READ, copy->vr_idx, &out_len);
+                if (ret) {
+                        dev_err(vop_dev(vdev), "%s %d err %d\n",
+                                __func__, __LINE__, ret);
+                        break;
+                }
+                len -= out_len;
+                ubuf += out_len;
+                copy->out_len += out_len;
+                if (!len) {
+                        /* One user space iovec is now completed */
+                        iovcnt--;
+                        u_iov++;
+                }
+                /* Exit loop if all elements in KIOVs have been processed. */
+                if (riov->i == riov->used && wiov->i == wiov->used)
+                        break;
+        }
+        /*
+         * Update the used ring if a descriptor was available and some data was
+         * copied in/out and the user asked for a used ring update.
+         */
+        if (*head != USHRT_MAX && copy->out_len && copy->update_used) {
+                u32 total = 0;
+
+                /* Determine the total data consumed */
+                total += vop_vringh_iov_consumed(riov);
+                total += vop_vringh_iov_consumed(wiov);
+                vringh_complete_kern(vrh, *head, total);
+                *head = USHRT_MAX;
+                if (vringh_need_notify_kern(vrh) > 0)
+                        vringh_notify(vrh);
+                vringh_kiov_cleanup(riov);
+                vringh_kiov_cleanup(wiov);
+                /* Update avail idx for user space */
+                vr->info->avail_idx = vrh->last_avail_idx;
+        }
+        return ret;
+}
+
+static inline int vop_verify_copy_args(struct vop_vdev *vdev,
+                                       struct mic_copy_desc *copy)
+{
+        if (!vdev || copy->vr_idx >= vdev->dd->num_vq)
+                return -EINVAL;
+        return 0;
+}
+
+/* Copy a specified number of virtio descriptors in a chain */
+static int vop_virtio_copy_desc(struct vop_vdev *vdev,
+                                struct mic_copy_desc *copy)
+{
+        int err;
+        struct vop_vringh *vvr;
+
+        err = vop_verify_copy_args(vdev, copy);
+        if (err)
+                return err;
+
+        vvr = &vdev->vvr[copy->vr_idx];
+        mutex_lock(&vvr->vr_mutex);
+        if (!vop_vdevup(vdev)) {
+                err = -ENODEV;
+                dev_err(vop_dev(vdev), "%s %d err %d\n",
+                        __func__, __LINE__, err);
+                goto err;
+        }
+        err = _vop_virtio_copy(vdev, copy);
+        if (err) {
+                dev_err(vop_dev(vdev), "%s %d err %d\n",
+                        __func__, __LINE__, err);
+        }
+err:
+        mutex_unlock(&vvr->vr_mutex);
+        return err;
+}
+
+static int vop_open(struct inode *inode, struct file *f)
+{
+        struct vop_vdev *vdev;
+        struct vop_info *vi = container_of(f->private_data,
+                struct vop_info, miscdev);
+
+        vdev = kzalloc(sizeof(*vdev), GFP_KERNEL);
+        if (!vdev)
+                return -ENOMEM;
+        vdev->vi = vi;
+        mutex_init(&vdev->vdev_mutex);
+        f->private_data = vdev;
+        init_completion(&vdev->destroy);
+        complete(&vdev->destroy);
+        return 0;
+}
+
+static int vop_release(struct inode *inode, struct file *f)
+{
+        struct vop_vdev *vdev = f->private_data, *vdev_tmp;
+        struct vop_info *vi = vdev->vi;
+        struct list_head *pos, *tmp;
+        bool found = false;
+
+        mutex_lock(&vdev->vdev_mutex);
+        if (vdev->deleted)
+                goto unlock;
+        mutex_lock(&vi->vop_mutex);
+        list_for_each_safe(pos, tmp, &vi->vdev_list) {
+                vdev_tmp = list_entry(pos, struct vop_vdev, list);
+                if (vdev == vdev_tmp) {
+                        vop_virtio_del_device(vdev);
+                        list_del(pos);
+                        found = true;
+                        break;
+                }
+        }
+        mutex_unlock(&vi->vop_mutex);
+unlock:
+        mutex_unlock(&vdev->vdev_mutex);
+        if (!found)
+                wait_for_completion(&vdev->destroy);
+        f->private_data = NULL;
+        kfree(vdev);
+        return 0;
+}
+
+static long vop_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+{
+        struct vop_vdev *vdev = f->private_data;
+        struct vop_info *vi = vdev->vi;
+        void __user *argp = (void __user *)arg;
+        int ret;
+
+        switch (cmd) {
+        case MIC_VIRTIO_ADD_DEVICE:
+        {
+                struct mic_device_desc dd, *dd_config;
+
+                if (copy_from_user(&dd, argp, sizeof(dd)))
+                        return -EFAULT;
+
+                if (mic_aligned_desc_size(&dd) > MIC_MAX_DESC_BLK_SIZE ||
+                    dd.num_vq > MIC_MAX_VRINGS)
+                        return -EINVAL;
+
+                dd_config = kzalloc(mic_desc_size(&dd), GFP_KERNEL);
+                if (!dd_config)
+                        return -ENOMEM;
+                if (copy_from_user(dd_config, argp, mic_desc_size(&dd))) {
+                        ret = -EFAULT;
+                        goto free_ret;
+                }
+                mutex_lock(&vdev->vdev_mutex);
+                mutex_lock(&vi->vop_mutex);
+                ret = vop_virtio_add_device(vdev, dd_config);
+                if (ret)
+                        goto unlock_ret;
+                list_add_tail(&vdev->list, &vi->vdev_list);
+unlock_ret:
+                mutex_unlock(&vi->vop_mutex);
+                mutex_unlock(&vdev->vdev_mutex);
+free_ret:
+                kfree(dd_config);
+                return ret;
+        }
+        case MIC_VIRTIO_COPY_DESC:
+        {
+                struct mic_copy_desc copy;
+
+                mutex_lock(&vdev->vdev_mutex);
+                ret = vop_vdev_inited(vdev);
+                if (ret)
+                        goto _unlock_ret;
+
+                if (copy_from_user(&copy, argp, sizeof(copy))) {
+                        ret = -EFAULT;
+                        goto _unlock_ret;
+                }
+
+                ret = vop_virtio_copy_desc(vdev, &copy);
+                if (ret < 0)
+                        goto _unlock_ret;
+                if (copy_to_user(
+                        &((struct mic_copy_desc __user *)argp)->out_len,
+                        &copy.out_len, sizeof(copy.out_len)))
+                        ret = -EFAULT;
+_unlock_ret:
+                mutex_unlock(&vdev->vdev_mutex);
+                return ret;
+        }
+        case MIC_VIRTIO_CONFIG_CHANGE:
+        {
+                void *buf;
+
+                mutex_lock(&vdev->vdev_mutex);
+                ret = vop_vdev_inited(vdev);
+                if (ret)
+                        goto __unlock_ret;
+                buf = kzalloc(vdev->dd->config_len, GFP_KERNEL);
+                if (!buf) {
+                        ret = -ENOMEM;
+                        goto __unlock_ret;
+                }
+                if (copy_from_user(buf, argp, vdev->dd->config_len)) {
+                        ret = -EFAULT;
+                        goto done;
+                }
+                ret = vop_virtio_config_change(vdev, buf);
+done:
+                kfree(buf);
+__unlock_ret:
+                mutex_unlock(&vdev->vdev_mutex);
+                return ret;
+        }
+        default:
+                return -ENOIOCTLCMD;
+        };
+        return 0;
+}
+
+/*
+ * We return POLLIN | POLLOUT from poll when new buffers are enqueued, and
+ * not when previously enqueued buffers may be available. This means that
+ * in the card->host (TX) path, when userspace is unblocked by poll it
+ * must drain all available descriptors or it can stall.
+ */
+static unsigned int vop_poll(struct file *f, poll_table *wait)
+{
+        struct vop_vdev *vdev = f->private_data;
+        int mask = 0;
+
+        mutex_lock(&vdev->vdev_mutex);
+        if (vop_vdev_inited(vdev)) {
+                mask = POLLERR;
+                goto done;
+        }
+        poll_wait(f, &vdev->waitq, wait);
+        if (vop_vdev_inited(vdev)) {
+                mask = POLLERR;
+        } else if (vdev->poll_wake) {
+                vdev->poll_wake = 0;
+                mask = POLLIN | POLLOUT;
+        }
+done:
+        mutex_unlock(&vdev->vdev_mutex);
+        return mask;
+}
+
+static inline int
+vop_query_offset(struct vop_vdev *vdev, unsigned long offset,
+                 unsigned long *size, unsigned long *pa)
+{
+        struct vop_device *vpdev = vdev->vpdev;
+        unsigned long start = MIC_DP_SIZE;
+        int i;
+
+        /*
+         * MMAP interface is as follows:
+         * offset                               region
+         * 0x0                                  virtio device_page
+         * 0x1000                               first vring
+         * 0x1000 + size of 1st vring           second vring
+         * ....
+         */
+        if (!offset) {
+                *pa = virt_to_phys(vpdev->hw_ops->get_dp(vpdev));
+                *size = MIC_DP_SIZE;
+                return 0;
+        }
+
+        for (i = 0; i < vdev->dd->num_vq; i++) {
+                struct vop_vringh *vvr = &vdev->vvr[i];
+
+                if (offset == start) {
+                        *pa = virt_to_phys(vvr->vring.va);
+                        *size = vvr->vring.len;
+                        return 0;
+                }
+                start += vvr->vring.len;
+        }
+        return -1;
+}
+
+/*
+ * Maps the device page and virtio rings to user space for readonly access.
+ */
+static int vop_mmap(struct file *f, struct vm_area_struct *vma)
+{
+        struct vop_vdev *vdev = f->private_data;
+        unsigned long offset = vma->vm_pgoff << PAGE_SHIFT;
+        unsigned long pa, size = vma->vm_end - vma->vm_start, size_rem = size;
+        int i, err;
+
+        err = vop_vdev_inited(vdev);
+        if (err)
+                goto ret;
+        if (vma->vm_flags & VM_WRITE) {
+                err = -EACCES;
+                goto ret;
+        }
+        while (size_rem) {
+                i = vop_query_offset(vdev, offset, &size, &pa);
+                if (i < 0) {
+                        err = -EINVAL;
+                        goto ret;
+                }
+                err = remap_pfn_range(vma, vma->vm_start + offset,
+                                      pa >> PAGE_SHIFT, size,
+                                      vma->vm_page_prot);
+                if (err)
+                        goto ret;
+                size_rem -= size;
+                offset += size;
+        }
+ret:
+        return err;
+}
+
+static const struct file_operations vop_fops = {
+        .open = vop_open,
+        .release = vop_release,
+        .unlocked_ioctl = vop_ioctl,
+        .poll = vop_poll,
+        .mmap = vop_mmap,
+        .owner = THIS_MODULE,
+};
+
+int vop_host_init(struct vop_info *vi)
+{
+        int rc;
+        struct miscdevice *mdev;
+        struct vop_device *vpdev = vi->vpdev;
+
+        INIT_LIST_HEAD(&vi->vdev_list);
+        vi->dma_ch = vpdev->dma_ch;
+        mdev = &vi->miscdev;
+        mdev->minor = MISC_DYNAMIC_MINOR;
+        snprintf(vi->name, sizeof(vi->name), "vop_virtio%d", vpdev->index);
+        mdev->name = vi->name;
+        mdev->fops = &vop_fops;
+        mdev->parent = &vpdev->dev;
+
+        rc = misc_register(mdev);
+        if (rc)
+                dev_err(&vpdev->dev, "%s failed rc %d\n", __func__, rc);
+        return rc;
+}
+
+void vop_host_uninit(struct vop_info *vi)
+{
+        struct list_head *pos, *tmp;
+        struct vop_vdev *vdev;
+
+        mutex_lock(&vi->vop_mutex);
+        vop_virtio_reset_devices(vi);
+        list_for_each_safe(pos, tmp, &vi->vdev_list) {
+                vdev = list_entry(pos, struct vop_vdev, list);
+                list_del(pos);
+                reinit_completion(&vdev->destroy);
+                mutex_unlock(&vi->vop_mutex);
+                mutex_lock(&vdev->vdev_mutex);
+                vop_virtio_del_device(vdev);
+                vdev->deleted = true;
+                mutex_unlock(&vdev->vdev_mutex);
+                complete(&vdev->destroy);
+                mutex_lock(&vi->vop_mutex);
+        }
+        mutex_unlock(&vi->vop_mutex);
+        misc_deregister(&vi->miscdev);
+}
diff --git a/drivers/misc/pch_phub.c b/drivers/misc/pch_phub.c
index 9a17a9bab8d6..15bb0c8cdda3 100644
--- a/drivers/misc/pch_phub.c
+++ b/drivers/misc/pch_phub.c
@@ -503,8 +503,7 @@ static ssize_t pch_phub_bin_read(struct file *filp, struct kobject *kobj,
         int err;
         ssize_t rom_size;
 
-        struct pch_phub_reg *chip =
-                dev_get_drvdata(container_of(kobj, struct device, kobj));
+        struct pch_phub_reg *chip = dev_get_drvdata(kobj_to_dev(kobj));
 
         ret = mutex_lock_interruptible(&pch_phub_mutex);
         if (ret) {
@@ -567,8 +566,7 @@ static ssize_t pch_phub_bin_write(struct file *filp, struct kobject *kobj,
         unsigned int addr_offset;
         int ret;
         ssize_t rom_size;
-        struct pch_phub_reg *chip =
-                dev_get_drvdata(container_of(kobj, struct device, kobj));
+        struct pch_phub_reg *chip = dev_get_drvdata(kobj_to_dev(kobj));
 
         ret = mutex_lock_interruptible(&pch_phub_mutex);
         if (ret)
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index 6e3af8b42cdd..dcdbd58672cc 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -632,7 +632,6 @@ long st_register(struct st_proto_s *new_proto)
                 spin_unlock_irqrestore(&st_gdata->lock, flags);
                 return err;
         }
-        pr_debug("done %s(%d) ", __func__, new_proto->chnl_id);
 }
 EXPORT_SYMBOL_GPL(st_register);
 
diff --git a/drivers/misc/vmw_vmci/vmci_driver.c b/drivers/misc/vmw_vmci/vmci_driver.c
index b823f9a6e464..896be150e28f 100644
--- a/drivers/misc/vmw_vmci/vmci_driver.c
+++ b/drivers/misc/vmw_vmci/vmci_driver.c
@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
 
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
-MODULE_VERSION("1.1.3.0-k");
+MODULE_VERSION("1.1.4.0-k");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 5914263090fc..fe207e542032 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -47,13 +47,10 @@
 #include "queue.h"
 
 MODULE_ALIAS("mmc:block");
-
-#ifdef KERNEL
 #ifdef MODULE_PARAM_PREFIX
 #undef MODULE_PARAM_PREFIX
 #endif
 #define MODULE_PARAM_PREFIX "mmcblk."
-#endif
 
 #define INAND_CMD38_ARG_EXT_CSD  113
 #define INAND_CMD38_ARG_ERASE    0x00
@@ -655,8 +652,10 @@ static int mmc_blk_ioctl_multi_cmd(struct block_device *bdev,
         }
 
         md = mmc_blk_get(bdev->bd_disk);
-        if (!md)
+        if (!md) {
+                err = -EINVAL;
                 goto cmd_err;
+        }
 
         card = md->queue.card;
         if (IS_ERR(card)) {
diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
index 1c1b45ef3faf..3446097a43c0 100644
--- a/drivers/mmc/host/mmc_spi.c
+++ b/drivers/mmc/host/mmc_spi.c
@@ -925,6 +925,10 @@ mmc_spi_data_do(struct mmc_spi_host *host, struct mmc_command *cmd,
 
                         dma_addr = dma_map_page(dma_dev, sg_page(sg), 0,
                                                 PAGE_SIZE, dir);
+                        if (dma_mapping_error(dma_dev, dma_addr)) {
+                                data->error = -EFAULT;
+                                break;
+                        }
                         if (direction == DMA_TO_DEVICE)
                                 t->tx_dma = dma_addr + sg->offset;
                         else
@@ -1393,10 +1397,12 @@ static int mmc_spi_probe(struct spi_device *spi)
                 host->dma_dev = dev;
                 host->ones_dma = dma_map_single(dev, ones,
                                 MMC_SPI_BLOCKSIZE, DMA_TO_DEVICE);
+                if (dma_mapping_error(dev, host->ones_dma))
+                        goto fail_ones_dma;
                 host->data_dma = dma_map_single(dev, host->data,
                                 sizeof(*host->data), DMA_BIDIRECTIONAL);
-
-                /* REVISIT in theory those map operations can fail... */
+                if (dma_mapping_error(dev, host->data_dma))
+                        goto fail_data_dma;
 
                 dma_sync_single_for_cpu(host->dma_dev,
                                 host->data_dma, sizeof(*host->data),
@@ -1462,6 +1468,11 @@ fail_glue_init:
         if (host->dma_dev)
                 dma_unmap_single(host->dma_dev, host->data_dma,
                                 sizeof(*host->data), DMA_BIDIRECTIONAL);
+fail_data_dma:
+        if (host->dma_dev)
+                dma_unmap_single(host->dma_dev, host->ones_dma,
+                                MMC_SPI_BLOCKSIZE, DMA_TO_DEVICE);
+fail_ones_dma:
         kfree(host->data);
 
 fail_nobuf1:
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index ce08896b9d69..da824772bbb4 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -86,7 +86,7 @@ struct pxamci_host {
 static inline void pxamci_init_ocr(struct pxamci_host *host)
 {
 #ifdef CONFIG_REGULATOR
-        host->vcc = regulator_get_optional(mmc_dev(host->mmc), "vmmc");
+        host->vcc = devm_regulator_get_optional(mmc_dev(host->mmc), "vmmc");
 
         if (IS_ERR(host->vcc))
                 host->vcc = NULL;
@@ -654,12 +654,8 @@ static int pxamci_probe(struct platform_device *pdev)
 
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         irq = platform_get_irq(pdev, 0);
-        if (!r || irq < 0)
-                return -ENXIO;
-
-        r = request_mem_region(r->start, SZ_4K, DRIVER_NAME);
-        if (!r)
-                return -EBUSY;
+        if (irq < 0)
+                return irq;
 
         mmc = mmc_alloc_host(sizeof(struct pxamci_host), &pdev->dev);
         if (!mmc) {
@@ -695,7 +691,7 @@ static int pxamci_probe(struct platform_device *pdev)
         host->pdata = pdev->dev.platform_data;
         host->clkrt = CLKRT_OFF;
 
-        host->clk = clk_get(&pdev->dev, NULL);
+        host->clk = devm_clk_get(&pdev->dev, NULL);
         if (IS_ERR(host->clk)) {
                 ret = PTR_ERR(host->clk);
                 host->clk = NULL;
@@ -727,9 +723,9 @@ static int pxamci_probe(struct platform_device *pdev)
         host->irq = irq;
         host->imask = MMC_I_MASK_ALL;
 
-        host->base = ioremap(r->start, SZ_4K);
-        if (!host->base) {
-                ret = -ENOMEM;
+        host->base = devm_ioremap_resource(&pdev->dev, r);
+        if (IS_ERR(host->base)) {
+                ret = PTR_ERR(host->base);
                 goto out;
         }
 
@@ -742,7 +738,8 @@ static int pxamci_probe(struct platform_device *pdev)
         writel(64, host->base + MMC_RESTO);
         writel(host->imask, host->base + MMC_I_MASK);
 
-        ret = request_irq(host->irq, pxamci_irq, 0, DRIVER_NAME, host);
+        ret = devm_request_irq(&pdev->dev, host->irq, pxamci_irq, 0,
+                               DRIVER_NAME, host);
         if (ret)
                 goto out;
 
@@ -804,7 +801,7 @@ static int pxamci_probe(struct platform_device *pdev)
                 dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro);
                 goto out;
         } else {
-                mmc->caps |= host->pdata->gpio_card_ro_invert ?
+                mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
                         0 : MMC_CAP2_RO_ACTIVE_HIGH;
         }
 
@@ -833,14 +830,9 @@ out:
                         dma_release_channel(host->dma_chan_rx);
                 if (host->dma_chan_tx)
                         dma_release_channel(host->dma_chan_tx);
-                if (host->base)
-                        iounmap(host->base);
-                if (host->clk)
-                        clk_put(host->clk);
         }
         if (mmc)
                 mmc_free_host(mmc);
-        release_resource(r);
         return ret;
 }
 
@@ -859,9 +851,6 @@ static int pxamci_remove(struct platform_device *pdev)
                         gpio_ro = host->pdata->gpio_card_ro;
                         gpio_power = host->pdata->gpio_power;
                 }
-                if (host->vcc)
-                        regulator_put(host->vcc);
-
                 if (host->pdata && host->pdata->exit)
                         host->pdata->exit(&pdev->dev, mmc);
 
@@ -870,16 +859,10 @@ static int pxamci_remove(struct platform_device *pdev)
                        END_CMD_RES|PRG_DONE|DATA_TRAN_DONE,
                        host->base + MMC_I_MASK);
 
-                free_irq(host->irq, host);
                 dmaengine_terminate_all(host->dma_chan_rx);
                 dmaengine_terminate_all(host->dma_chan_tx);
                 dma_release_channel(host->dma_chan_rx);
                 dma_release_channel(host->dma_chan_tx);
-                iounmap(host->base);
-
-                clk_put(host->clk);
-
-                release_resource(host->res);
 
                 mmc_free_host(mmc);
         }
diff --git a/drivers/mmc/host/sdhci-acpi.c b/drivers/mmc/host/sdhci-acpi.c
index f6047fc94062..a5cda926d38e 100644
--- a/drivers/mmc/host/sdhci-acpi.c
+++ b/drivers/mmc/host/sdhci-acpi.c
@@ -146,6 +146,33 @@ static const struct sdhci_acpi_chip sdhci_acpi_chip_int = {
         .ops = &sdhci_acpi_ops_int,
 };
 
+static int bxt_get_cd(struct mmc_host *mmc)
+{
+        int gpio_cd = mmc_gpio_get_cd(mmc);
+        struct sdhci_host *host = mmc_priv(mmc);
+        unsigned long flags;
+        int ret = 0;
+
+        if (!gpio_cd)
+                return 0;
+
+        pm_runtime_get_sync(mmc->parent);
+
+        spin_lock_irqsave(&host->lock, flags);
+
+        if (host->flags & SDHCI_DEVICE_DEAD)
+                goto out;
+
+        ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT);
+out:
+        spin_unlock_irqrestore(&host->lock, flags);
+
+        pm_runtime_mark_last_busy(mmc->parent);
+        pm_runtime_put_autosuspend(mmc->parent);
+
+        return ret;
+}
+
 static int sdhci_acpi_emmc_probe_slot(struct platform_device *pdev,
                                       const char *hid, const char *uid)
 {
@@ -196,6 +223,9 @@ static int sdhci_acpi_sd_probe_slot(struct platform_device *pdev,
 
         /* Platform specific code during sd probe slot goes here */
 
+        if (hid && !strcmp(hid, "80865ACA"))
+                host->mmc_host_ops.get_cd = bxt_get_cd;
+
         return 0;
 }
 
diff --git a/drivers/mmc/host/sdhci-of-at91.c b/drivers/mmc/host/sdhci-of-at91.c
index 7e7d8f0c9438..9cb86fb25976 100644
--- a/drivers/mmc/host/sdhci-of-at91.c
+++ b/drivers/mmc/host/sdhci-of-at91.c
@@ -217,6 +217,7 @@ static int sdhci_at91_probe(struct platform_device *pdev)
 pm_runtime_disable:
         pm_runtime_disable(&pdev->dev);
         pm_runtime_set_suspended(&pdev->dev);
+        pm_runtime_put_noidle(&pdev->dev);
 clocks_disable_unprepare:
         clk_disable_unprepare(priv->gck);
         clk_disable_unprepare(priv->mainck);
diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
index cc851b065d0a..df3b8eced8c4 100644
--- a/drivers/mmc/host/sdhci-pci-core.c
+++ b/drivers/mmc/host/sdhci-pci-core.c
@@ -330,6 +330,33 @@ static void spt_read_drive_strength(struct sdhci_host *host)
         sdhci_pci_spt_drive_strength = 0x10 | ((val >> 12) & 0xf);
 }
 
+static int bxt_get_cd(struct mmc_host *mmc)
+{
+        int gpio_cd = mmc_gpio_get_cd(mmc);
+        struct sdhci_host *host = mmc_priv(mmc);
+        unsigned long flags;
+        int ret = 0;
+
+        if (!gpio_cd)
+                return 0;
+
+        pm_runtime_get_sync(mmc->parent);
+
+        spin_lock_irqsave(&host->lock, flags);
+
+        if (host->flags & SDHCI_DEVICE_DEAD)
+                goto out;
+
+        ret = !!(sdhci_readl(host, SDHCI_PRESENT_STATE) & SDHCI_CARD_PRESENT);
+out:
+        spin_unlock_irqrestore(&host->lock, flags);
+
+        pm_runtime_mark_last_busy(mmc->parent);
+        pm_runtime_put_autosuspend(mmc->parent);
+
+        return ret;
+}
+
 static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot)
 {
         slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE |
@@ -362,6 +389,10 @@ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
         slot->cd_con_id = NULL;
         slot->cd_idx = 0;
         slot->cd_override_level = true;
+        if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD ||
+            slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD)
+                slot->host->mmc_host_ops.get_cd = bxt_get_cd;
+
         return 0;
 }
 
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index d622435d1bcc..add9fdfd1d8f 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1360,7 +1360,7 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
         sdhci_runtime_pm_get(host);
 
         /* Firstly check card presence */
-        present = sdhci_do_get_cd(host);
+        present = mmc->ops->get_cd(mmc);
 
         spin_lock_irqsave(&host->lock, flags);
 
@@ -2849,6 +2849,8 @@ struct sdhci_host *sdhci_alloc_host(struct device *dev,
 
         host = mmc_priv(mmc);
         host->mmc = mmc;
+        host->mmc_host_ops = sdhci_ops;
+        mmc->ops = &host->mmc_host_ops;
 
         return host;
 }
@@ -3037,7 +3039,6 @@ int sdhci_add_host(struct sdhci_host *host)
         /*
          * Set host parameters.
          */
-        mmc->ops = &sdhci_ops;
         max_clk = host->max_clk;
 
         if (host->ops->get_min_clock)
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index 7654ae5d2b4e..0115e9907bf8 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -430,6 +430,7 @@ struct sdhci_host {
 
         /* Internal data */
         struct mmc_host *mmc;   /* MMC structure */
+        struct mmc_host_ops mmc_host_ops;       /* MMC host ops */
         u64 dma_mask;           /* custom DMA mask */
 
 #if defined(CONFIG_LEDS_CLASS) || defined(CONFIG_LEDS_CLASS_MODULE)
diff --git a/drivers/mmc/host/sh_mmcif.c b/drivers/mmc/host/sh_mmcif.c
index 1ca8a1359cbc..6234eab38ff3 100644
--- a/drivers/mmc/host/sh_mmcif.c
+++ b/drivers/mmc/host/sh_mmcif.c
@@ -445,7 +445,7 @@ static void sh_mmcif_request_dma(struct sh_mmcif_host *host)
                                                         pdata->slave_id_rx);
         } else {
                 host->chan_tx = dma_request_slave_channel(dev, "tx");
-                host->chan_tx = dma_request_slave_channel(dev, "rx");
+                host->chan_rx = dma_request_slave_channel(dev, "rx");
         }
         dev_dbg(dev, "%s: got channel TX %p RX %p\n", __func__, host->chan_tx,
                 host->chan_rx);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 49eea8981332..3010080cfeee 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7831,6 +7831,14 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
         return ret;
 }
 
+static bool tg3_tso_bug_gso_check(struct tg3_napi *tnapi, struct sk_buff *skb)
+{
+        /* Check if we will never have enough descriptors,
+         * as gso_segs can be more than current ring size
+         */
+        return skb_shinfo(skb)->gso_segs < tnapi->tx_pending / 3;
+}
+
 static netdev_tx_t tg3_start_xmit(struct sk_buff *, struct net_device *);
 
 /* Use GSO to workaround all TSO packets that meet HW bug conditions
@@ -7934,14 +7942,19 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
                  * vlan encapsulated.
                  */
                 if (skb->protocol == htons(ETH_P_8021Q) ||
-                    skb->protocol == htons(ETH_P_8021AD))
-                        return tg3_tso_bug(tp, tnapi, txq, skb);
+                    skb->protocol == htons(ETH_P_8021AD)) {
+                        if (tg3_tso_bug_gso_check(tnapi, skb))
+                                return tg3_tso_bug(tp, tnapi, txq, skb);
+                        goto drop;
+                }
 
                 if (!skb_is_gso_v6(skb)) {
                         if (unlikely((ETH_HLEN + hdr_len) > 80) &&
-                            tg3_flag(tp, TSO_BUG))
-                                return tg3_tso_bug(tp, tnapi, txq, skb);
-
+                            tg3_flag(tp, TSO_BUG)) {
+                                if (tg3_tso_bug_gso_check(tnapi, skb))
+                                        return tg3_tso_bug(tp, tnapi, txq, skb);
+                                goto drop;
+                        }
                         ip_csum = iph->check;
                         ip_tot_len = iph->tot_len;
                         iph->check = 0;
@@ -8073,7 +8086,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
         if (would_hit_hwbug) {
                 tg3_tx_skb_unmap(tnapi, tnapi->tx_prod, i);
 
-                if (mss) {
+                if (mss && tg3_tso_bug_gso_check(tnapi, skb)) {
                         /* If it's a TSO packet, do GSO instead of
                          * allocating and copying to a large linear SKB
                          */
diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
index 1671fa3332c2..7ba6d530b0c0 100644
--- a/drivers/net/ethernet/cisco/enic/enic.h
+++ b/drivers/net/ethernet/cisco/enic/enic.h
@@ -33,7 +33,7 @@
 
 #define DRV_NAME                "enic"
 #define DRV_DESCRIPTION         "Cisco VIC Ethernet NIC Driver"
-#define DRV_VERSION             "2.3.0.12"
+#define DRV_VERSION             "2.3.0.20"
 #define DRV_COPYRIGHT           "Copyright 2008-2013 Cisco Systems, Inc"
 
 #define ENIC_BARS_MAX           6
diff --git a/drivers/net/ethernet/cisco/enic/vnic_dev.c b/drivers/net/ethernet/cisco/enic/vnic_dev.c
index 1ffd1050860b..1fdf5fe12a95 100644
--- a/drivers/net/ethernet/cisco/enic/vnic_dev.c
+++ b/drivers/net/ethernet/cisco/enic/vnic_dev.c
@@ -298,7 +298,8 @@ static int _vnic_dev_cmd2(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
                           int wait)
 {
         struct devcmd2_controller *dc2c = vdev->devcmd2;
-        struct devcmd2_result *result = dc2c->result + dc2c->next_result;
+        struct devcmd2_result *result;
+        u8 color;
         unsigned int i;
         int delay, err;
         u32 fetch_index, new_posted;
@@ -336,13 +337,17 @@ static int _vnic_dev_cmd2(struct vnic_dev *vdev, enum vnic_devcmd_cmd cmd,
         if (dc2c->cmd_ring[posted].flags & DEVCMD2_FNORESULT)
                 return 0;
 
+        result = dc2c->result + dc2c->next_result;
+        color = dc2c->color;
+
+        dc2c->next_result++;
+        if (dc2c->next_result == dc2c->result_size) {
+                dc2c->next_result = 0;
+                dc2c->color = dc2c->color ? 0 : 1;
+        }
+
         for (delay = 0; delay < wait; delay++) {
-                if (result->color == dc2c->color) {
-                        dc2c->next_result++;
-                        if (dc2c->next_result == dc2c->result_size) {
-                                dc2c->next_result = 0;
-                                dc2c->color = dc2c->color ? 0 : 1;
-                        }
+                if (result->color == color) {
                         if (result->error) {
                                 err = result->error;
                                 if (err != ERR_ECMDUNKNOWN ||
diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index d48d5793407d..e94ca1c3fc7c 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2429,7 +2429,7 @@ err_thread:
         flush_workqueue(priv->mfunc.master.comm_wq);
         destroy_workqueue(priv->mfunc.master.comm_wq);
 err_slaves:
-        while (--i) {
+        while (i--) {
                 for (port = 1; port <= MLX4_MAX_PORTS; port++)
                         kfree(priv->mfunc.master.slave_state[i].vlan_filter[port]);
         }
diff --git a/drivers/net/ethernet/synopsys/dwc_eth_qos.c b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
index 70814b7386b3..fc8bbff2d7e3 100644
--- a/drivers/net/ethernet/synopsys/dwc_eth_qos.c
+++ b/drivers/net/ethernet/synopsys/dwc_eth_qos.c
@@ -1880,9 +1880,9 @@ static int dwceqos_open(struct net_device *ndev)
         }
         netdev_reset_queue(ndev);
 
+        dwceqos_init_hw(lp);
         napi_enable(&lp->napi);
         phy_start(lp->phy_dev);
-        dwceqos_init_hw(lp);
 
         netif_start_queue(ndev);
         tasklet_enable(&lp->tx_bdreclaim_tasklet);
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 0b14ac3b8d11..028e3873c310 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1039,6 +1039,17 @@ static netdev_tx_t geneve_xmit(struct sk_buff *skb, struct net_device *dev)
         return geneve_xmit_skb(skb, dev, info);
 }
 
+static int geneve_change_mtu(struct net_device *dev, int new_mtu)
+{
+        /* GENEVE overhead is not fixed, so we can't enforce a more
+         * precise max MTU.
+         */
+        if (new_mtu < 68 || new_mtu > IP_MAX_MTU)
+                return -EINVAL;
+        dev->mtu = new_mtu;
+        return 0;
+}
+
 static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb)
 {
         struct ip_tunnel_info *info = skb_tunnel_info(skb);
@@ -1083,7 +1094,7 @@ static const struct net_device_ops geneve_netdev_ops = {
         .ndo_stop               = geneve_stop,
         .ndo_start_xmit         = geneve_xmit,
         .ndo_get_stats64        = ip_tunnel_get_stats64,
-        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_change_mtu         = geneve_change_mtu,
         .ndo_validate_addr      = eth_validate_addr,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_fill_metadata_dst  = geneve_fill_metadata_dst,
@@ -1442,11 +1453,21 @@ struct net_device *geneve_dev_create_fb(struct net *net, const char *name,
 
         err = geneve_configure(net, dev, &geneve_remote_unspec,
                                0, 0, 0, htons(dst_port), true, 0);
-        if (err) {
-                free_netdev(dev);
-                return ERR_PTR(err);
-        }
+        if (err)
+                goto err;
+
+        /* openvswitch users expect packet sizes to be unrestricted,
+         * so set the largest MTU we can.
+         */
+        err = geneve_change_mtu(dev, IP_MAX_MTU);
+        if (err)
+                goto err;
+
         return dev;
+
+ err:
+        free_netdev(dev);
+        return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(geneve_dev_create_fb);
 
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 65439188c582..a31cd954b308 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2367,29 +2367,43 @@ static void vxlan_set_multicast_list(struct net_device *dev)
 {
 }
 
-static int vxlan_change_mtu(struct net_device *dev, int new_mtu)
+static int __vxlan_change_mtu(struct net_device *dev,
+                              struct net_device *lowerdev,
+                              struct vxlan_rdst *dst, int new_mtu, bool strict)
 {
-        struct vxlan_dev *vxlan = netdev_priv(dev);
-        struct vxlan_rdst *dst = &vxlan->default_dst;
-        struct net_device *lowerdev;
-        int max_mtu;
+        int max_mtu = IP_MAX_MTU;
 
-        lowerdev = __dev_get_by_index(vxlan->net, dst->remote_ifindex);
-        if (lowerdev == NULL)
-                return eth_change_mtu(dev, new_mtu);
+        if (lowerdev)
+                max_mtu = lowerdev->mtu;
 
         if (dst->remote_ip.sa.sa_family == AF_INET6)
-                max_mtu = lowerdev->mtu - VXLAN6_HEADROOM;
+                max_mtu -= VXLAN6_HEADROOM;
         else
-                max_mtu = lowerdev->mtu - VXLAN_HEADROOM;
+                max_mtu -= VXLAN_HEADROOM;
 
-        if (new_mtu < 68 || new_mtu > max_mtu)
+        if (new_mtu < 68)
                 return -EINVAL;
 
+        if (new_mtu > max_mtu) {
+                if (strict)
+                        return -EINVAL;
+
+                new_mtu = max_mtu;
+        }
+
         dev->mtu = new_mtu;
         return 0;
 }
 
+static int vxlan_change_mtu(struct net_device *dev, int new_mtu)
+{
+        struct vxlan_dev *vxlan = netdev_priv(dev);
+        struct vxlan_rdst *dst = &vxlan->default_dst;
+        struct net_device *lowerdev = __dev_get_by_index(vxlan->net,
+                                                         dst->remote_ifindex);
+        return __vxlan_change_mtu(dev, lowerdev, dst, new_mtu, true);
+}
+
 static int egress_ipv4_tun_info(struct net_device *dev, struct sk_buff *skb,
                                 struct ip_tunnel_info *info,
                                 __be16 sport, __be16 dport)
@@ -2765,6 +2779,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         int err;
         bool use_ipv6 = false;
         __be16 default_port = vxlan->cfg.dst_port;
+        struct net_device *lowerdev = NULL;
 
         vxlan->net = src_net;
 
@@ -2785,9 +2800,7 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
         }
 
         if (conf->remote_ifindex) {
-                struct net_device *lowerdev
-                         = __dev_get_by_index(src_net, conf->remote_ifindex);
-
+                lowerdev = __dev_get_by_index(src_net, conf->remote_ifindex);
                 dst->remote_ifindex = conf->remote_ifindex;
 
                 if (!lowerdev) {
@@ -2811,6 +2824,12 @@ static int vxlan_dev_configure(struct net *src_net, struct net_device *dev,
                 needed_headroom = lowerdev->hard_header_len;
         }
 
+        if (conf->mtu) {
+                err = __vxlan_change_mtu(dev, lowerdev, dst, conf->mtu, false);
+                if (err)
+                        return err;
+        }
+
         if (use_ipv6 || conf->flags & VXLAN_F_COLLECT_METADATA)
                 needed_headroom += VXLAN6_HEADROOM;
         else
diff --git a/drivers/nvmem/Kconfig b/drivers/nvmem/Kconfig
index bc4ea585b42e..5bd18cc1a69c 100644
--- a/drivers/nvmem/Kconfig
+++ b/drivers/nvmem/Kconfig
@@ -25,6 +25,15 @@ config NVMEM_IMX_OCOTP
           This driver can also be built as a module. If so, the module
           will be called nvmem-imx-ocotp.
 
+config NVMEM_LPC18XX_EEPROM
+        tristate "NXP LPC18XX EEPROM Memory Support"
+        depends on ARCH_LPC18XX || COMPILE_TEST
+        help
+          Say Y here to include support for NXP LPC18xx EEPROM memory found in
+          NXP LPC185x/3x and LPC435x/3x/2x/1x devices.
+          To compile this driver as a module, choose M here: the module
+          will be called nvmem_lpc18xx_eeprom.
+
 config NVMEM_MXS_OCOTP
         tristate "Freescale MXS On-Chip OTP Memory Support"
         depends on ARCH_MXS || COMPILE_TEST
@@ -36,6 +45,17 @@ config NVMEM_MXS_OCOTP
           This driver can also be built as a module. If so, the module
           will be called nvmem-mxs-ocotp.
 
+config MTK_EFUSE
+        tristate "Mediatek SoCs EFUSE support"
+        depends on ARCH_MEDIATEK || COMPILE_TEST
+        select REGMAP_MMIO
+        help
+          This is a driver to access hardware related data like sensor
+          calibration, HDMI impedance etc.
+
+          This driver can also be built as a module. If so, the module
+          will be called efuse-mtk.
+
 config QCOM_QFPROM
         tristate "QCOM QFPROM Support"
         depends on ARCH_QCOM || COMPILE_TEST
diff --git a/drivers/nvmem/Makefile b/drivers/nvmem/Makefile
index 95dde3f8f085..45ab1ae08fa9 100644
--- a/drivers/nvmem/Makefile
+++ b/drivers/nvmem/Makefile
@@ -8,8 +8,12 @@ nvmem_core-y			:= core.o
 # Devices
 obj-$(CONFIG_NVMEM_IMX_OCOTP)   += nvmem-imx-ocotp.o
 nvmem-imx-ocotp-y               := imx-ocotp.o
+obj-$(CONFIG_NVMEM_LPC18XX_EEPROM)      += nvmem_lpc18xx_eeprom.o
+nvmem_lpc18xx_eeprom-y  := lpc18xx_eeprom.o
 obj-$(CONFIG_NVMEM_MXS_OCOTP)   += nvmem-mxs-ocotp.o
 nvmem-mxs-ocotp-y               := mxs-ocotp.o
+obj-$(CONFIG_MTK_EFUSE)         += nvmem_mtk-efuse.o
+nvmem_mtk-efuse-y               := mtk-efuse.o
 obj-$(CONFIG_QCOM_QFPROM)       += nvmem_qfprom.o
 nvmem_qfprom-y                  := qfprom.o
 obj-$(CONFIG_ROCKCHIP_EFUSE)    += nvmem_rockchip_efuse.o
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index 6fd4e5a5ef4a..de14fae6f7f6 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -70,6 +70,9 @@ static ssize_t bin_attr_nvmem_read(struct file *filp, struct kobject *kobj,
         if (pos >= nvmem->size)
                 return 0;
 
+        if (count < nvmem->word_size)
+                return -EINVAL;
+
         if (pos + count > nvmem->size)
                 count = nvmem->size - pos;
 
@@ -95,6 +98,9 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
         if (pos >= nvmem->size)
                 return 0;
 
+        if (count < nvmem->word_size)
+                return -EINVAL;
+
         if (pos + count > nvmem->size)
                 count = nvmem->size - pos;
 
@@ -288,9 +294,11 @@ static int nvmem_add_cells(struct nvmem_device *nvmem,
 
         return 0;
 err:
-        while (--i)
+        while (i--)
                 nvmem_cell_drop(cells[i]);
 
+        kfree(cells);
+
         return rval;
 }
 
diff --git a/drivers/nvmem/lpc18xx_eeprom.c b/drivers/nvmem/lpc18xx_eeprom.c
new file mode 100644
index 000000000000..878fce789341
--- /dev/null
+++ b/drivers/nvmem/lpc18xx_eeprom.c
@@ -0,0 +1,330 @@
+/*
+ * NXP LPC18xx/LPC43xx EEPROM memory NVMEM driver
+ *
+ * Copyright (c) 2015 Ariel D'Alessandro <ariel@vanguardiasur.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ */
+
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/nvmem-provider.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <linux/reset.h>
+
+/* Registers */
+#define LPC18XX_EEPROM_AUTOPROG                 0x00c
+#define LPC18XX_EEPROM_AUTOPROG_WORD            0x1
+
+#define LPC18XX_EEPROM_CLKDIV                   0x014
+
+#define LPC18XX_EEPROM_PWRDWN                   0x018
+#define LPC18XX_EEPROM_PWRDWN_NO                0x0
+#define LPC18XX_EEPROM_PWRDWN_YES               0x1
+
+#define LPC18XX_EEPROM_INTSTAT                  0xfe0
+#define LPC18XX_EEPROM_INTSTAT_END_OF_PROG      BIT(2)
+
+#define LPC18XX_EEPROM_INTSTATCLR               0xfe8
+#define LPC18XX_EEPROM_INTSTATCLR_PROG_CLR_ST   BIT(2)
+
+/* Fixed page size (bytes) */
+#define LPC18XX_EEPROM_PAGE_SIZE                0x80
+
+/* EEPROM device requires a ~1500 kHz clock (min 800 kHz, max 1600 kHz) */
+#define LPC18XX_EEPROM_CLOCK_HZ                 1500000
+
+/* EEPROM requires 3 ms of erase/program time between each writing */
+#define LPC18XX_EEPROM_PROGRAM_TIME             3
+
+struct lpc18xx_eeprom_dev {
+        struct clk *clk;
+        void __iomem *reg_base;
+        void __iomem *mem_base;
+        struct nvmem_device *nvmem;
+        unsigned reg_bytes;
+        unsigned val_bytes;
+};
+
+static struct regmap_config lpc18xx_regmap_config = {
+        .reg_bits = 32,
+        .reg_stride = 4,
+        .val_bits = 32,
+};
+
+static inline void lpc18xx_eeprom_writel(struct lpc18xx_eeprom_dev *eeprom,
+                                         u32 reg, u32 val)
+{
+        writel(val, eeprom->reg_base + reg);
+}
+
+static inline u32 lpc18xx_eeprom_readl(struct lpc18xx_eeprom_dev *eeprom,
+                                       u32 reg)
+{
+        return readl(eeprom->reg_base + reg);
+}
+
+static int lpc18xx_eeprom_busywait_until_prog(struct lpc18xx_eeprom_dev *eeprom)
+{
+        unsigned long end;
+        u32 val;
+
+        /* Wait until EEPROM program operation has finished */
+        end = jiffies + msecs_to_jiffies(LPC18XX_EEPROM_PROGRAM_TIME * 10);
+
+        while (time_is_after_jiffies(end)) {
+                val = lpc18xx_eeprom_readl(eeprom, LPC18XX_EEPROM_INTSTAT);
+
+                if (val & LPC18XX_EEPROM_INTSTAT_END_OF_PROG) {
+                        lpc18xx_eeprom_writel(eeprom, LPC18XX_EEPROM_INTSTATCLR,
+                                        LPC18XX_EEPROM_INTSTATCLR_PROG_CLR_ST);
+                        return 0;
+                }
+
+                usleep_range(LPC18XX_EEPROM_PROGRAM_TIME * USEC_PER_MSEC,
+                             (LPC18XX_EEPROM_PROGRAM_TIME + 1) * USEC_PER_MSEC);
+        }
+
+        return -ETIMEDOUT;
+}
+
+static int lpc18xx_eeprom_gather_write(void *context, const void *reg,
+                                       size_t reg_size, const void *val,
+                                       size_t val_size)
+{
+        struct lpc18xx_eeprom_dev *eeprom = context;
+        unsigned int offset = *(u32 *)reg;
+        int ret;
+
+        if (offset % lpc18xx_regmap_config.reg_stride)
+                return -EINVAL;
+
+        lpc18xx_eeprom_writel(eeprom, LPC18XX_EEPROM_PWRDWN,
+                              LPC18XX_EEPROM_PWRDWN_NO);
+
+        /* Wait 100 us while the EEPROM wakes up */
+        usleep_range(100, 200);
+
+        while (val_size) {
+                writel(*(u32 *)val, eeprom->mem_base + offset);
+                ret = lpc18xx_eeprom_busywait_until_prog(eeprom);
+                if (ret < 0)
+                        return ret;
+
+                val_size -= eeprom->val_bytes;
+                val += eeprom->val_bytes;
+                offset += eeprom->val_bytes;
+        }
+
+        lpc18xx_eeprom_writel(eeprom, LPC18XX_EEPROM_PWRDWN,
+                              LPC18XX_EEPROM_PWRDWN_YES);
+
+        return 0;
+}
+
+static int lpc18xx_eeprom_write(void *context, const void *data, size_t count)
+{
+        struct lpc18xx_eeprom_dev *eeprom = context;
+        unsigned int offset = eeprom->reg_bytes;
+
+        if (count <= offset)
+                return -EINVAL;
+
+        return lpc18xx_eeprom_gather_write(context, data, eeprom->reg_bytes,
+                                           data + offset, count - offset);
+}
+
+static int lpc18xx_eeprom_read(void *context, const void *reg, size_t reg_size,
+                               void *val, size_t val_size)
+{
+        struct lpc18xx_eeprom_dev *eeprom = context;
+        unsigned int offset = *(u32 *)reg;
+
+        lpc18xx_eeprom_writel(eeprom, LPC18XX_EEPROM_PWRDWN,
+                              LPC18XX_EEPROM_PWRDWN_NO);
+
+        /* Wait 100 us while the EEPROM wakes up */
+        usleep_range(100, 200);
+
+        while (val_size) {
+                *(u32 *)val = readl(eeprom->mem_base + offset);
+                val_size -= eeprom->val_bytes;
+                val += eeprom->val_bytes;
+                offset += eeprom->val_bytes;
+        }
+
+        lpc18xx_eeprom_writel(eeprom, LPC18XX_EEPROM_PWRDWN,
+                              LPC18XX_EEPROM_PWRDWN_YES);
+
+        return 0;
+}
+
+static struct regmap_bus lpc18xx_eeprom_bus = {
+        .write = lpc18xx_eeprom_write,
+        .gather_write = lpc18xx_eeprom_gather_write,
+        .read = lpc18xx_eeprom_read,
+        .reg_format_endian_default = REGMAP_ENDIAN_NATIVE,
+        .val_format_endian_default = REGMAP_ENDIAN_NATIVE,
+};
+
+static bool lpc18xx_eeprom_writeable_reg(struct device *dev, unsigned int reg)
+{
+        /*
+         * The last page contains the EEPROM initialization data and is not
+         * writable.
+         */
+        return reg <= lpc18xx_regmap_config.max_register -
+                                                LPC18XX_EEPROM_PAGE_SIZE;
+}
+
+static bool lpc18xx_eeprom_readable_reg(struct device *dev, unsigned int reg)
+{
+        return reg <= lpc18xx_regmap_config.max_register;
+}
+
+static struct nvmem_config lpc18xx_nvmem_config = {
+        .name = "lpc18xx-eeprom",
+        .owner = THIS_MODULE,
+};
+
+static int lpc18xx_eeprom_probe(struct platform_device *pdev)
+{
+        struct lpc18xx_eeprom_dev *eeprom;
+        struct device *dev = &pdev->dev;
+        struct reset_control *rst;
+        unsigned long clk_rate;
+        struct regmap *regmap;
+        struct resource *res;
+        int ret;
+
+        eeprom = devm_kzalloc(dev, sizeof(*eeprom), GFP_KERNEL);
+        if (!eeprom)
+                return -ENOMEM;
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "reg");
+        eeprom->reg_base = devm_ioremap_resource(dev, res);
+        if (IS_ERR(eeprom->reg_base))
+                return PTR_ERR(eeprom->reg_base);
+
+        res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "mem");
+        eeprom->mem_base = devm_ioremap_resource(dev, res);
+        if (IS_ERR(eeprom->mem_base))
+                return PTR_ERR(eeprom->mem_base);
+
+        eeprom->clk = devm_clk_get(&pdev->dev, "eeprom");
+        if (IS_ERR(eeprom->clk)) {
+                dev_err(&pdev->dev, "failed to get eeprom clock\n");
+                return PTR_ERR(eeprom->clk);
+        }
+
+        ret = clk_prepare_enable(eeprom->clk);
+        if (ret < 0) {
+                dev_err(dev, "failed to prepare/enable eeprom clk: %d\n", ret);
+                return ret;
+        }
+
+        rst = devm_reset_control_get(dev, NULL);
+        if (IS_ERR(rst)) {
+                dev_err(dev, "failed to get reset: %ld\n", PTR_ERR(rst));
+                ret = PTR_ERR(rst);
+                goto err_clk;
+        }
+
+        ret = reset_control_assert(rst);
+        if (ret < 0) {
+                dev_err(dev, "failed to assert reset: %d\n", ret);
+                goto err_clk;
+        }
+
+        eeprom->val_bytes = lpc18xx_regmap_config.val_bits / BITS_PER_BYTE;
+        eeprom->reg_bytes = lpc18xx_regmap_config.reg_bits / BITS_PER_BYTE;
+
+        /*
+         * Clock rate is generated by dividing the system bus clock by the
+         * division factor, contained in the divider register (minus 1 encoded).
+         */
+        clk_rate = clk_get_rate(eeprom->clk);
+        clk_rate = DIV_ROUND_UP(clk_rate, LPC18XX_EEPROM_CLOCK_HZ) - 1;
+        lpc18xx_eeprom_writel(eeprom, LPC18XX_EEPROM_CLKDIV, clk_rate);
+
+        /*
+         * Writing a single word to the page will start the erase/program cycle
+         * automatically
+         */
+        lpc18xx_eeprom_writel(eeprom, LPC18XX_EEPROM_AUTOPROG,
+                              LPC18XX_EEPROM_AUTOPROG_WORD);
+
+        lpc18xx_eeprom_writel(eeprom, LPC18XX_EEPROM_PWRDWN,
+                              LPC18XX_EEPROM_PWRDWN_YES);
+
+        lpc18xx_regmap_config.max_register = resource_size(res) - 1;
+        lpc18xx_regmap_config.writeable_reg = lpc18xx_eeprom_writeable_reg;
+        lpc18xx_regmap_config.readable_reg = lpc18xx_eeprom_readable_reg;
+
+        regmap = devm_regmap_init(dev, &lpc18xx_eeprom_bus, eeprom,
+                                  &lpc18xx_regmap_config);
+        if (IS_ERR(regmap)) {
+                dev_err(dev, "regmap init failed: %ld\n", PTR_ERR(regmap));
+                ret = PTR_ERR(regmap);
+                goto err_clk;
+        }
+
+        lpc18xx_nvmem_config.dev = dev;
+
+        eeprom->nvmem = nvmem_register(&lpc18xx_nvmem_config);
+        if (IS_ERR(eeprom->nvmem)) {
+                ret = PTR_ERR(eeprom->nvmem);
+                goto err_clk;
+        }
+
+        platform_set_drvdata(pdev, eeprom);
+
+        return 0;
+
+err_clk:
+        clk_disable_unprepare(eeprom->clk);
+
+        return ret;
+}
+
+static int lpc18xx_eeprom_remove(struct platform_device *pdev)
+{
+        struct lpc18xx_eeprom_dev *eeprom = platform_get_drvdata(pdev);
+        int ret;
+
+        ret = nvmem_unregister(eeprom->nvmem);
+        if (ret < 0)
+                return ret;
+
+        clk_disable_unprepare(eeprom->clk);
+
+        return 0;
+}
+
+static const struct of_device_id lpc18xx_eeprom_of_match[] = {
+        { .compatible = "nxp,lpc1857-eeprom" },
+        { },
+};
+MODULE_DEVICE_TABLE(of, lpc18xx_eeprom_of_match);
+
+static struct platform_driver lpc18xx_eeprom_driver = {
+        .probe = lpc18xx_eeprom_probe,
+        .remove = lpc18xx_eeprom_remove,
+        .driver = {
+                .name = "lpc18xx-eeprom",
+                .of_match_table = lpc18xx_eeprom_of_match,
+        },
+};
+
+module_platform_driver(lpc18xx_eeprom_driver);
+
+MODULE_AUTHOR("Ariel D'Alessandro <ariel@vanguardiasur.com.ar>");
+MODULE_DESCRIPTION("NXP LPC18xx EEPROM memory Driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/nvmem/mtk-efuse.c b/drivers/nvmem/mtk-efuse.c
new file mode 100644
index 000000000000..7b35f5b630cd
--- /dev/null
+++ b/drivers/nvmem/mtk-efuse.c
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2015 MediaTek Inc.
+ * Author: Andrew-CT Chen <andrew-ct.chen@mediatek.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/nvmem-provider.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+static struct regmap_config mtk_regmap_config = {
+        .reg_bits = 32,
+        .val_bits = 32,
+        .reg_stride = 4,
+};
+
+static int mtk_efuse_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct resource *res;
+        struct nvmem_device *nvmem;
+        struct nvmem_config *econfig;
+        struct regmap *regmap;
+        void __iomem *base;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        base = devm_ioremap_resource(dev, res);
+        if (IS_ERR(base))
+                return PTR_ERR(base);
+
+        econfig = devm_kzalloc(dev, sizeof(*econfig), GFP_KERNEL);
+        if (!econfig)
+                return -ENOMEM;
+
+        mtk_regmap_config.max_register = resource_size(res) - 1;
+
+        regmap = devm_regmap_init_mmio(dev, base, &mtk_regmap_config);
+        if (IS_ERR(regmap)) {
+                dev_err(dev, "regmap init failed\n");
+                return PTR_ERR(regmap);
+        }
+
+        econfig->dev = dev;
+        econfig->owner = THIS_MODULE;
+        nvmem = nvmem_register(econfig);
+        if (IS_ERR(nvmem))
+                return PTR_ERR(nvmem);
+
+        platform_set_drvdata(pdev, nvmem);
+
+        return 0;
+}
+
+static int mtk_efuse_remove(struct platform_device *pdev)
+{
+        struct nvmem_device *nvmem = platform_get_drvdata(pdev);
+
+        return nvmem_unregister(nvmem);
+}
+
+static const struct of_device_id mtk_efuse_of_match[] = {
+        { .compatible = "mediatek,mt8173-efuse",},
+        { .compatible = "mediatek,efuse",},
+        {/* sentinel */},
+};
+MODULE_DEVICE_TABLE(of, mtk_efuse_of_match);
+
+static struct platform_driver mtk_efuse_driver = {
+        .probe = mtk_efuse_probe,
+        .remove = mtk_efuse_remove,
+        .driver = {
+                .name = "mediatek,efuse",
+                .of_match_table = mtk_efuse_of_match,
+        },
+};
+module_platform_driver(mtk_efuse_driver);
+MODULE_AUTHOR("Andrew-CT Chen <andrew-ct.chen@mediatek.com>");
+MODULE_DESCRIPTION("Mediatek EFUSE driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/nvmem/qfprom.c b/drivers/nvmem/qfprom.c
index afb67e7eeee4..3829e5fbf8c3 100644
--- a/drivers/nvmem/qfprom.c
+++ b/drivers/nvmem/qfprom.c
@@ -21,6 +21,7 @@ static struct regmap_config qfprom_regmap_config = {
         .reg_bits = 32,
         .val_bits = 8,
         .reg_stride = 1,
+        .val_format_endian = REGMAP_ENDIAN_LITTLE,
 };
 
 static struct nvmem_config econfig = {
diff --git a/drivers/nvmem/rockchip-efuse.c b/drivers/nvmem/rockchip-efuse.c
index f55213424222..a009795111e9 100644
--- a/drivers/nvmem/rockchip-efuse.c
+++ b/drivers/nvmem/rockchip-efuse.c
@@ -14,16 +14,16 @@
  * more details.
  */
 
-#include <linux/platform_device.h>
-#include <linux/nvmem-provider.h>
-#include <linux/slab.h>
-#include <linux/regmap.h>
+#include <linux/clk.h>
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/io.h>
 #include <linux/module.h>
-#include <linux/delay.h>
+#include <linux/nvmem-provider.h>
+#include <linux/slab.h>
 #include <linux/of.h>
-#include <linux/clk.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
 
 #define EFUSE_A_SHIFT                   6
 #define EFUSE_A_MASK                    0x3ff
@@ -35,10 +35,10 @@
 #define REG_EFUSE_CTRL                  0x0000
 #define REG_EFUSE_DOUT                  0x0004
 
-struct rockchip_efuse_context {
+struct rockchip_efuse_chip {
         struct device *dev;
         void __iomem *base;
-        struct clk *efuse_clk;
+        struct clk *clk;
 };
 
 static int rockchip_efuse_write(void *context, const void *data, size_t count)
@@ -52,34 +52,32 @@ static int rockchip_efuse_read(void *context,
                                void *val, size_t val_size)
 {
         unsigned int offset = *(u32 *)reg;
-        struct rockchip_efuse_context *_context = context;
-        void __iomem *base = _context->base;
-        struct clk *clk = _context->efuse_clk;
+        struct rockchip_efuse_chip *efuse = context;
         u8 *buf = val;
         int ret;
 
-        ret = clk_prepare_enable(clk);
+        ret = clk_prepare_enable(efuse->clk);
         if (ret < 0) {
-                dev_err(_context->dev, "failed to prepare/enable efuse clk\n");
+                dev_err(efuse->dev, "failed to prepare/enable efuse clk\n");
                 return ret;
         }
 
-        writel(EFUSE_LOAD | EFUSE_PGENB, base + REG_EFUSE_CTRL);
+        writel(EFUSE_LOAD | EFUSE_PGENB, efuse->base + REG_EFUSE_CTRL);
         udelay(1);
         while (val_size) {
-                writel(readl(base + REG_EFUSE_CTRL) &
+                writel(readl(efuse->base + REG_EFUSE_CTRL) &
                              (~(EFUSE_A_MASK << EFUSE_A_SHIFT)),
-                             base + REG_EFUSE_CTRL);
-                writel(readl(base + REG_EFUSE_CTRL) |
+                             efuse->base + REG_EFUSE_CTRL);
+                writel(readl(efuse->base + REG_EFUSE_CTRL) |
                              ((offset & EFUSE_A_MASK) << EFUSE_A_SHIFT),
-                             base + REG_EFUSE_CTRL);
+                             efuse->base + REG_EFUSE_CTRL);
                 udelay(1);
-                writel(readl(base + REG_EFUSE_CTRL) |
-                             EFUSE_STROBE, base + REG_EFUSE_CTRL);
+                writel(readl(efuse->base + REG_EFUSE_CTRL) |
+                             EFUSE_STROBE, efuse->base + REG_EFUSE_CTRL);
                 udelay(1);
-                *buf++ = readb(base + REG_EFUSE_DOUT);
-                writel(readl(base + REG_EFUSE_CTRL) &
-                     (~EFUSE_STROBE), base + REG_EFUSE_CTRL);
+                *buf++ = readb(efuse->base + REG_EFUSE_DOUT);
+                writel(readl(efuse->base + REG_EFUSE_CTRL) &
+                     (~EFUSE_STROBE), efuse->base + REG_EFUSE_CTRL);
                 udelay(1);
 
                 val_size -= 1;
@@ -87,9 +85,9 @@ static int rockchip_efuse_read(void *context,
         }
 
         /* Switch to standby mode */
-        writel(EFUSE_PGENB | EFUSE_CSB, base + REG_EFUSE_CTRL);
+        writel(EFUSE_PGENB | EFUSE_CSB, efuse->base + REG_EFUSE_CTRL);
 
-        clk_disable_unprepare(clk);
+        clk_disable_unprepare(efuse->clk);
 
         return 0;
 }
@@ -114,48 +112,44 @@ static struct nvmem_config econfig = {
 };
 
 static const struct of_device_id rockchip_efuse_match[] = {
-        { .compatible = "rockchip,rockchip-efuse",},
+        { .compatible = "rockchip,rockchip-efuse", },
         { /* sentinel */},
 };
 MODULE_DEVICE_TABLE(of, rockchip_efuse_match);
 
 static int rockchip_efuse_probe(struct platform_device *pdev)
 {
-        struct device *dev = &pdev->dev;
         struct resource *res;
         struct nvmem_device *nvmem;
         struct regmap *regmap;
-        void __iomem *base;
-        struct clk *clk;
-        struct rockchip_efuse_context *context;
+        struct rockchip_efuse_chip *efuse;
 
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        base = devm_ioremap_resource(dev, res);
-        if (IS_ERR(base))
-                return PTR_ERR(base);
+        efuse = devm_kzalloc(&pdev->dev, sizeof(struct rockchip_efuse_chip),
+                             GFP_KERNEL);
+        if (!efuse)
+                return -ENOMEM;
 
-        context = devm_kzalloc(dev, sizeof(struct rockchip_efuse_context),
-                               GFP_KERNEL);
-        if (IS_ERR(context))
-                return PTR_ERR(context);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        efuse->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(efuse->base))
+                return PTR_ERR(efuse->base);
 
-        clk = devm_clk_get(dev, "pclk_efuse");
-        if (IS_ERR(clk))
-                return PTR_ERR(clk);
+        efuse->clk = devm_clk_get(&pdev->dev, "pclk_efuse");
+        if (IS_ERR(efuse->clk))
+                return PTR_ERR(efuse->clk);
 
-        context->dev = dev;
-        context->base = base;
-        context->efuse_clk = clk;
+        efuse->dev = &pdev->dev;
 
         rockchip_efuse_regmap_config.max_register = resource_size(res) - 1;
 
-        regmap = devm_regmap_init(dev, &rockchip_efuse_bus,
-                                  context, &rockchip_efuse_regmap_config);
+        regmap = devm_regmap_init(efuse->dev, &rockchip_efuse_bus,
+                                  efuse, &rockchip_efuse_regmap_config);
         if (IS_ERR(regmap)) {
-                dev_err(dev, "regmap init failed\n");
+                dev_err(efuse->dev, "regmap init failed\n");
                 return PTR_ERR(regmap);
         }
-        econfig.dev = dev;
+
+        econfig.dev = efuse->dev;
         nvmem = nvmem_register(&econfig);
         if (IS_ERR(nvmem))
                 return PTR_ERR(nvmem);
diff --git a/drivers/nvmem/sunxi_sid.c b/drivers/nvmem/sunxi_sid.c
index cfa3b85064dd..bc88b4084055 100644
--- a/drivers/nvmem/sunxi_sid.c
+++ b/drivers/nvmem/sunxi_sid.c
@@ -13,10 +13,8 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
  */
 
-
 #include <linux/device.h>
 #include <linux/io.h>
 #include <linux/module.h>
@@ -27,7 +25,6 @@
 #include <linux/slab.h>
 #include <linux/random.h>
 
-
 static struct nvmem_config econfig = {
         .name = "sunxi-sid",
         .read_only = true,
@@ -55,8 +52,8 @@ static u8 sunxi_sid_read_byte(const struct sunxi_sid *sid,
 }
 
 static int sunxi_sid_read(void *context,
-                            const void *reg, size_t reg_size,
-                            void *val, size_t val_size)
+                          const void *reg, size_t reg_size,
+                          void *val, size_t val_size)
 {
         struct sunxi_sid *sid = context;
         unsigned int offset = *(u32 *)reg;
@@ -130,7 +127,7 @@ static int sunxi_sid_probe(struct platform_device *pdev)
         if (IS_ERR(nvmem))
                 return PTR_ERR(nvmem);
 
-        randomness = kzalloc(sizeof(u8) * size, GFP_KERNEL);
+        randomness = kzalloc(sizeof(u8) * (size), GFP_KERNEL);
         if (!randomness) {
                 ret = -EINVAL;
                 goto err_unreg_nvmem;
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 5648317d355f..39c4be41ef83 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -154,6 +154,7 @@ static const struct of_device_id whitelist_phys[] = {
         { .compatible = "marvell,88E1111", },
         { .compatible = "marvell,88e1116", },
         { .compatible = "marvell,88e1118", },
+        { .compatible = "marvell,88e1145", },
         { .compatible = "marvell,88e1149r", },
         { .compatible = "marvell,88e1310", },
         { .compatible = "marvell,88E1510", },
diff --git a/drivers/pci/host/pcie-iproc.c b/drivers/pci/host/pcie-iproc.c
index 5816bceddb65..a576aeeb22da 100644
--- a/drivers/pci/host/pcie-iproc.c
+++ b/drivers/pci/host/pcie-iproc.c
@@ -64,7 +64,6 @@
 #define OARR_SIZE_CFG                BIT(OARR_SIZE_CFG_SHIFT)
 
 #define MAX_NUM_OB_WINDOWS           2
-#define MAX_NUM_PAXC_PF              4
 
 #define IPROC_PCIE_REG_INVALID 0xffff
 
@@ -170,20 +169,6 @@ static inline void iproc_pcie_ob_write(struct iproc_pcie *pcie,
         writel(val, pcie->base + offset + (window * 8));
 }
 
-static inline bool iproc_pcie_device_is_valid(struct iproc_pcie *pcie,
-                                              unsigned int slot,
-                                              unsigned int fn)
-{
-        if (slot > 0)
-                return false;
-
-        /* PAXC can only support limited number of functions */
-        if (pcie->type == IPROC_PCIE_PAXC && fn >= MAX_NUM_PAXC_PF)
-                return false;
-
-        return true;
-}
-
 /**
  * Note access to the configuration registers are protected at the higher layer
  * by 'pci_lock' in drivers/pci/access.c
@@ -199,11 +184,11 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct pci_bus *bus,
         u32 val;
         u16 offset;
 
-        if (!iproc_pcie_device_is_valid(pcie, slot, fn))
-                return NULL;
-
         /* root complex access */
         if (busno == 0) {
+                if (slot > 0 || fn > 0)
+                        return NULL;
+
                 iproc_pcie_write_reg(pcie, IPROC_PCIE_CFG_IND_ADDR,
                                      where & CFG_IND_ADDR_MASK);
                 offset = iproc_pcie_reg_offset(pcie, IPROC_PCIE_CFG_IND_DATA);
@@ -213,6 +198,14 @@ static void __iomem *iproc_pcie_map_cfg_bus(struct pci_bus *bus,
                         return (pcie->base + offset);
         }
 
+        /*
+         * PAXC is connected to an internally emulated EP within the SoC.  It
+         * allows only one device.
+         */
+        if (pcie->type == IPROC_PCIE_PAXC)
+                if (slot > 0)
+                        return NULL;
+
         /* EP device access */
         val = (busno << CFG_ADDR_BUS_NUM_SHIFT) |
                 (slot << CFG_ADDR_DEV_NUM_SHIFT) |
diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
index 0bf82a20a0fb..48d21e0edd56 100644
--- a/drivers/pci/pcie/aer/aerdrv.c
+++ b/drivers/pci/pcie/aer/aerdrv.c
@@ -262,7 +262,6 @@ static struct aer_rpc *aer_alloc_rpc(struct pcie_device *dev)
         rpc->rpd = dev;
         INIT_WORK(&rpc->dpc_handler, aer_isr);
         mutex_init(&rpc->rpc_mutex);
-        init_waitqueue_head(&rpc->wait_release);
 
         /* Use PCIe bus function to store rpc into PCIe device */
         set_service_data(dev, rpc);
@@ -285,8 +284,7 @@ static void aer_remove(struct pcie_device *dev)
                 if (rpc->isr)
                         free_irq(dev->irq, dev);
 
-                wait_event(rpc->wait_release, rpc->prod_idx == rpc->cons_idx);
-
+                flush_work(&rpc->dpc_handler);
                 aer_disable_rootport(rpc);
                 kfree(rpc);
                 set_service_data(dev, NULL);
diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h
index 84420b7c9456..945c939a86c5 100644
--- a/drivers/pci/pcie/aer/aerdrv.h
+++ b/drivers/pci/pcie/aer/aerdrv.h
@@ -72,7 +72,6 @@ struct aer_rpc {
                                          * recovery on the same
                                          * root port hierarchy
                                          */
-        wait_queue_head_t wait_release;
 };
 
 struct aer_broadcast_data {
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index 712392504ed9..521e39c1b66d 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -811,8 +811,6 @@ void aer_isr(struct work_struct *work)
         while (get_e_source(rpc, &e_src))
                 aer_isr_one_error(p_device, &e_src);
         mutex_unlock(&rpc->rpc_mutex);
-
-        wake_up(&rpc->wait_release);
 }
 
 /**
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index e7e117d5dbbe..0124d17bd9fe 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -224,6 +224,7 @@ config PHY_MT65XX_USB3
 
 config PHY_HI6220_USB
         tristate "hi6220 USB PHY support"
+        depends on (ARCH_HISI && ARM64) || COMPILE_TEST
         select GENERIC_PHY
         select MFD_SYSCON
         help
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 8c7f27db6ad3..e7e574dc667a 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -275,20 +275,21 @@ EXPORT_SYMBOL_GPL(phy_exit);
 
 int phy_power_on(struct phy *phy)
 {
-        int ret;
+        int ret = 0;
 
         if (!phy)
-                return 0;
+                goto out;
 
         if (phy->pwr) {
                 ret = regulator_enable(phy->pwr);
                 if (ret)
-                        return ret;
+                        goto out;
         }
 
         ret = phy_pm_runtime_get_sync(phy);
         if (ret < 0 && ret != -ENOTSUPP)
-                return ret;
+                goto err_pm_sync;
+
         ret = 0; /* Override possible ret == -ENOTSUPP */
 
         mutex_lock(&phy->mutex);
@@ -296,19 +297,20 @@ int phy_power_on(struct phy *phy)
                 ret = phy->ops->power_on(phy);
                 if (ret < 0) {
                         dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
-                        goto out;
+                        goto err_pwr_on;
                 }
         }
         ++phy->power_count;
         mutex_unlock(&phy->mutex);
         return 0;
 
-out:
+err_pwr_on:
         mutex_unlock(&phy->mutex);
         phy_pm_runtime_put_sync(phy);
+err_pm_sync:
         if (phy->pwr)
                 regulator_disable(phy->pwr);
-
+out:
         return ret;
 }
 EXPORT_SYMBOL_GPL(phy_power_on);
diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
index 4a3fc6e59f8e..840f3eae428b 100644
--- a/drivers/phy/phy-twl4030-usb.c
+++ b/drivers/phy/phy-twl4030-usb.c
@@ -715,6 +715,7 @@ static int twl4030_usb_probe(struct platform_device *pdev)
         pm_runtime_use_autosuspend(&pdev->dev);
         pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
         pm_runtime_enable(&pdev->dev);
+        pm_runtime_get_sync(&pdev->dev);
 
         /* Our job is to use irqs and status from the power module
          * to keep the transceiver disabled when nothing's connected.
@@ -750,6 +751,7 @@ static int twl4030_usb_remove(struct platform_device *pdev)
         struct twl4030_usb *twl = platform_get_drvdata(pdev);
         int val;
 
+        usb_remove_phy(&twl->phy);
         pm_runtime_get_sync(twl->dev);
         cancel_delayed_work(&twl->id_workaround_work);
         device_remove_file(twl->dev, &dev_attr_vbus);
@@ -757,6 +759,13 @@ static int twl4030_usb_remove(struct platform_device *pdev)
         /* set transceiver mode to power on defaults */
         twl4030_usb_set_mode(twl, -1);
 
+        /* idle ulpi before powering off */
+        if (cable_present(twl->linkstat))
+                pm_runtime_put_noidle(twl->dev);
+        pm_runtime_mark_last_busy(twl->dev);
+        pm_runtime_put_sync_suspend(twl->dev);
+        pm_runtime_disable(twl->dev);
+
         /* autogate 60MHz ULPI clock,
          * clear dpll clock request for i2c access,
          * disable 32KHz
@@ -771,11 +780,6 @@ static int twl4030_usb_remove(struct platform_device *pdev)
         /* disable complete OTG block */
         twl4030_usb_clear_bits(twl, POWER_CTRL, POWER_CTRL_OTG_ENAB);
 
-        if (cable_present(twl->linkstat))
-                pm_runtime_put_noidle(twl->dev);
-        pm_runtime_mark_last_busy(twl->dev);
-        pm_runtime_put(twl->dev);
-
         return 0;
 }
 
diff --git a/drivers/platform/Kconfig b/drivers/platform/Kconfig
index 0adccbf5c83f..c11db8bceea1 100644
--- a/drivers/platform/Kconfig
+++ b/drivers/platform/Kconfig
@@ -4,8 +4,7 @@ endif
 if MIPS
 source "drivers/platform/mips/Kconfig"
 endif
-if GOLDFISH
+
 source "drivers/platform/goldfish/Kconfig"
-endif
 
 source "drivers/platform/chrome/Kconfig"
diff --git a/drivers/platform/goldfish/Kconfig b/drivers/platform/goldfish/Kconfig
index 635ef25cc722..50331e3e54f3 100644
--- a/drivers/platform/goldfish/Kconfig
+++ b/drivers/platform/goldfish/Kconfig
@@ -1,5 +1,23 @@
+menuconfig GOLDFISH
+        bool "Platform support for Goldfish virtual devices"
+        depends on X86_32 || X86_64 || ARM || ARM64 || MIPS
+        ---help---
+          Say Y here to get to see options for the Goldfish virtual platform.
+          This option alone does not add any kernel code.
+
+          Unless you are building for the Android Goldfish emulator say N here.
+
+if GOLDFISH
+
+config GOLDFISH_BUS
+        bool "Goldfish platform bus"
+        ---help---
+          This is a virtual bus to host Goldfish Android Virtual Devices.
+
 config GOLDFISH_PIPE
         tristate "Goldfish virtual device for QEMU pipes"
         ---help---
           This is a virtual device to drive the QEMU pipe interface used by
           the Goldfish Android Virtual Device.
+
+endif # GOLDFISH
diff --git a/drivers/platform/goldfish/Makefile b/drivers/platform/goldfish/Makefile
index a0022395eee9..d3487125838c 100644
--- a/drivers/platform/goldfish/Makefile
+++ b/drivers/platform/goldfish/Makefile
@@ -1,5 +1,5 @@
 #
 # Makefile for Goldfish platform specific drivers
 #
-obj-$(CONFIG_GOLDFISH)  +=      pdev_bus.o
+obj-$(CONFIG_GOLDFISH_BUS)      += pdev_bus.o
 obj-$(CONFIG_GOLDFISH_PIPE)     += goldfish_pipe.o
diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
index 9f6734ce1873..9973cebb4d6f 100644
--- a/drivers/platform/goldfish/goldfish_pipe.c
+++ b/drivers/platform/goldfish/goldfish_pipe.c
@@ -2,6 +2,7 @@
  * Copyright (C) 2011 Google, Inc.
  * Copyright (C) 2012 Intel, Inc.
  * Copyright (C) 2013 Intel, Inc.
+ * Copyright (C) 2014 Linaro Limited
  *
  * This software is licensed under the terms of the GNU General Public
  * License version 2, as published by the Free Software Foundation, and
@@ -58,6 +59,8 @@
 #include <linux/io.h>
 #include <linux/goldfish.h>
 #include <linux/dma-mapping.h>
+#include <linux/mm.h>
+#include <linux/acpi.h>
 
 /*
  * IMPORTANT: The following constants must match the ones used and defined
@@ -76,6 +79,7 @@
 #define PIPE_REG_PARAMS_ADDR_LOW        0x18  /* read/write: batch data address */
 #define PIPE_REG_PARAMS_ADDR_HIGH       0x1c  /* read/write: batch data address */
 #define PIPE_REG_ACCESS_PARAMS          0x20  /* write: batch access */
+#define PIPE_REG_VERSION                0x24  /* read: device version */
 
 /* list of commands for PIPE_REG_COMMAND */
 #define CMD_OPEN                        1  /* open new channel */
@@ -91,12 +95,6 @@
 #define CMD_WRITE_BUFFER        4  /* send a user buffer to the emulator */
 #define CMD_WAKE_ON_WRITE       5  /* tell the emulator to wake us when writing
                                      is possible */
-
-/* The following commands are related to read operations, they must be
- * listed in the same order than the corresponding write ones, since we
- * will use (CMD_READ_BUFFER - CMD_WRITE_BUFFER) as a special offset
- * in goldfish_pipe_read_write() below.
- */
 #define CMD_READ_BUFFER        6  /* receive a user buffer from the emulator */
 #define CMD_WAKE_ON_READ       7  /* tell the emulator to wake us when reading
                                    * is possible */
@@ -131,6 +129,7 @@ struct goldfish_pipe_dev {
         unsigned char __iomem *base;
         struct access_params *aps;
         int irq;
+        u32 version;
 };
 
 static struct goldfish_pipe_dev   pipe_dev[1];
@@ -263,19 +262,14 @@ static int access_with_param(struct goldfish_pipe_dev *dev, const int cmd,
         return 0;
 }
 
-/* This function is used for both reading from and writing to a given
- * pipe.
- */
 static ssize_t goldfish_pipe_read_write(struct file *filp, char __user *buffer,
-                                    size_t bufflen, int is_write)
+                                       size_t bufflen, int is_write)
 {
         unsigned long irq_flags;
         struct goldfish_pipe *pipe = filp->private_data;
         struct goldfish_pipe_dev *dev = pipe->dev;
-        const int cmd_offset = is_write ? 0
-                                        : (CMD_READ_BUFFER - CMD_WRITE_BUFFER);
         unsigned long address, address_end;
-        int ret = 0;
+        int count = 0, ret = -EINVAL;
 
         /* If the emulator already closed the pipe, no need to go further */
         if (test_bit(BIT_CLOSED_ON_HOST, &pipe->flags))
@@ -298,79 +292,107 @@ static ssize_t goldfish_pipe_read_write(struct file *filp, char __user *buffer,
         address_end = address + bufflen;
 
         while (address < address_end) {
-                unsigned long  page_end = (address & PAGE_MASK) + PAGE_SIZE;
-                unsigned long  next     = page_end < address_end ? page_end
-                                                                 : address_end;
-                unsigned long  avail    = next - address;
+                unsigned long page_end = (address & PAGE_MASK) + PAGE_SIZE;
+                unsigned long next     = page_end < address_end ? page_end
+                                                                : address_end;
+                unsigned long avail    = next - address;
                 int status, wakeBit;
+                struct page *page;
+
+                /* Either vaddr or paddr depending on the device version */
+                unsigned long xaddr;
+
+                /*
+                 * We grab the pages on a page-by-page basis in case user
+                 * space gives us a potentially huge buffer but the read only
+                 * returns a small amount, then there's no need to pin that
+                 * much memory to the process.
+                 */
+                down_read(&current->mm->mmap_sem);
+                ret = get_user_pages(current, current->mm, address, 1,
+                                     !is_write, 0, &page, NULL);
+                up_read(&current->mm->mmap_sem);
+                if (ret < 0)
+                        break;
 
-                /* Ensure that the corresponding page is properly mapped */
-                /* FIXME: this isn't safe or sufficient - use get_user_pages */
-                if (is_write) {
-                        char c;
-                        /* Ensure that the page is mapped and readable */
-                        if (__get_user(c, (char __user *)address)) {
-                                if (!ret)
-                                        ret = -EFAULT;
-                                break;
-                        }
+                if (dev->version) {
+                        /* Device version 1 or newer (qemu-android) expects the
+                         * physical address.
+                         */
+                        xaddr = page_to_phys(page) | (address & ~PAGE_MASK);
                 } else {
-                        /* Ensure that the page is mapped and writable */
-                        if (__put_user(0, (char __user *)address)) {
-                                if (!ret)
-                                        ret = -EFAULT;
-                                break;
-                        }
+                        /* Device version 0 (classic emulator) expects the
+                         * virtual address.
+                         */
+                        xaddr = address;
                 }
 
                 /* Now, try to transfer the bytes in the current page */
                 spin_lock_irqsave(&dev->lock, irq_flags);
-                if (access_with_param(dev, CMD_WRITE_BUFFER + cmd_offset,
-                                address, avail, pipe, &status)) {
+                if (access_with_param(dev,
+                                is_write ? CMD_WRITE_BUFFER : CMD_READ_BUFFER,
+                                xaddr, avail, pipe, &status)) {
                         gf_write_ptr(pipe, dev->base + PIPE_REG_CHANNEL,
                                      dev->base + PIPE_REG_CHANNEL_HIGH);
                         writel(avail, dev->base + PIPE_REG_SIZE);
-                        gf_write_ptr((void *)address,
+                        gf_write_ptr((void *)xaddr,
                                      dev->base + PIPE_REG_ADDRESS,
                                      dev->base + PIPE_REG_ADDRESS_HIGH);
-                        writel(CMD_WRITE_BUFFER + cmd_offset,
+                        writel(is_write ? CMD_WRITE_BUFFER : CMD_READ_BUFFER,
                                         dev->base + PIPE_REG_COMMAND);
                         status = readl(dev->base + PIPE_REG_STATUS);
                 }
                 spin_unlock_irqrestore(&dev->lock, irq_flags);
 
+                if (status > 0 && !is_write)
+                        set_page_dirty(page);
+                put_page(page);
+
                 if (status > 0) { /* Correct transfer */
-                        ret += status;
+                        count += status;
                         address += status;
                         continue;
-                }
-
-                if (status == 0)  /* EOF */
+                } else if (status == 0) { /* EOF */
+                        ret = 0;
                         break;
-
-                /* An error occured. If we already transfered stuff, just
-                * return with its count. We expect the next call to return
-                * an error code */
-                if (ret > 0)
+                } else if (status < 0 && count > 0) {
+                        /*
+                         * An error occurred and we already transferred
+                         * something on one of the previous pages.
+                         * Just return what we already copied and log this
+                         * err.
+                         *
+                         * Note: This seems like an incorrect approach but
+                         * cannot change it until we check if any user space
+                         * ABI relies on this behavior.
+                         */
+                        if (status != PIPE_ERROR_AGAIN)
+                                pr_info_ratelimited("goldfish_pipe: backend returned error %d on %s\n",
+                                        status, is_write ? "write" : "read");
+                        ret = 0;
                         break;
+                }
 
-                /* If the error is not PIPE_ERROR_AGAIN, or if we are not in
-                * non-blocking mode, just return the error code.
-                */
+                /*
+                 * If the error is not PIPE_ERROR_AGAIN, or if we are not in
+                 * non-blocking mode, just return the error code.
+                 */
                 if (status != PIPE_ERROR_AGAIN ||
                         (filp->f_flags & O_NONBLOCK) != 0) {
                         ret = goldfish_pipe_error_convert(status);
                         break;
                 }
 
-                /* We will have to wait until more data/space is available.
-                * First, mark the pipe as waiting for a specific wake signal.
-                */
+                /*
+                 * The backend blocked the read/write, wait until the backend
+                 * tells us it's ready to process more data.
+                 */
                 wakeBit = is_write ? BIT_WAKE_ON_WRITE : BIT_WAKE_ON_READ;
                 set_bit(wakeBit, &pipe->flags);
 
                 /* Tell the emulator we're going to wait for a wake event */
-                goldfish_cmd(pipe, CMD_WAKE_ON_WRITE + cmd_offset);
+                goldfish_cmd(pipe,
+                        is_write ? CMD_WAKE_ON_WRITE : CMD_WAKE_ON_READ);
 
                 /* Unlock the pipe, then wait for the wake signal */
                 mutex_unlock(&pipe->lock);
@@ -388,12 +410,13 @@ static ssize_t goldfish_pipe_read_write(struct file *filp, char __user *buffer,
                 /* Try to re-acquire the lock */
                 if (mutex_lock_interruptible(&pipe->lock))
                         return -ERESTARTSYS;
-
-                /* Try the transfer again */
-                continue;
         }
         mutex_unlock(&pipe->lock);
-        return ret;
+
+        if (ret < 0)
+                return ret;
+        else
+                return count;
 }
 
 static ssize_t goldfish_pipe_read(struct file *filp, char __user *buffer,
@@ -446,10 +469,11 @@ static irqreturn_t goldfish_pipe_interrupt(int irq, void *dev_id)
         unsigned long irq_flags;
         int count = 0;
 
-        /* We're going to read from the emulator a list of (channel,flags)
-        * pairs corresponding to the wake events that occured on each
-        * blocked pipe (i.e. channel).
-        */
+        /*
+         * We're going to read from the emulator a list of (channel,flags)
+         * pairs corresponding to the wake events that occurred on each
+         * blocked pipe (i.e. channel).
+         */
         spin_lock_irqsave(&dev->lock, irq_flags);
         for (;;) {
                 /* First read the channel, 0 means the end of the list */
@@ -600,6 +624,12 @@ static int goldfish_pipe_probe(struct platform_device *pdev)
                 goto error;
         }
         setup_access_params_addr(pdev, dev);
+
+        /* Although the pipe device in the classic Android emulator does not
+         * recognize the 'version' register, it won't treat this as an error
+         * either and will simply return 0, which is fine.
+         */
+        dev->version = readl(dev->base + PIPE_REG_VERSION);
         return 0;
 
 error:
@@ -615,11 +645,26 @@ static int goldfish_pipe_remove(struct platform_device *pdev)
         return 0;
 }
 
+static const struct acpi_device_id goldfish_pipe_acpi_match[] = {
+        { "GFSH0003", 0 },
+        { },
+};
+MODULE_DEVICE_TABLE(acpi, goldfish_pipe_acpi_match);
+
+static const struct of_device_id goldfish_pipe_of_match[] = {
+        { .compatible = "google,android-pipe", },
+        {},
+};
+MODULE_DEVICE_TABLE(of, goldfish_pipe_of_match);
+
 static struct platform_driver goldfish_pipe = {
         .probe = goldfish_pipe_probe,
         .remove = goldfish_pipe_remove,
         .driver = {
-                .name = "goldfish_pipe"
+                .name = "goldfish_pipe",
+                .owner = THIS_MODULE,
+                .of_match_table = goldfish_pipe_of_match,
+                .acpi_match_table = ACPI_PTR(goldfish_pipe_acpi_match),
         }
 };
 
diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
index 20f0ad9bb9f3..e20f23e04c24 100644
--- a/drivers/platform/x86/intel-hid.c
+++ b/drivers/platform/x86/intel-hid.c
@@ -41,8 +41,7 @@ static const struct key_entry intel_hid_keymap[] = {
         { KE_KEY, 4, { KEY_HOME } },
         { KE_KEY, 5, { KEY_END } },
         { KE_KEY, 6, { KEY_PAGEUP } },
-        { KE_KEY, 4, { KEY_PAGEDOWN } },
-        { KE_KEY, 4, { KEY_HOME } },
+        { KE_KEY, 7, { KEY_PAGEDOWN } },
         { KE_KEY, 8, { KEY_RFKILL } },
         { KE_KEY, 9, { KEY_POWER } },
         { KE_KEY, 11, { KEY_SLEEP } },
diff --git a/drivers/platform/x86/intel_scu_ipcutil.c b/drivers/platform/x86/intel_scu_ipcutil.c
index 02bc5a6343c3..aa454241489c 100644
--- a/drivers/platform/x86/intel_scu_ipcutil.c
+++ b/drivers/platform/x86/intel_scu_ipcutil.c
@@ -49,7 +49,7 @@ struct scu_ipc_data {
 
 static int scu_reg_access(u32 cmd, struct scu_ipc_data  *data)
 {
-        int count = data->count;
+        unsigned int count = data->count;
 
         if (count == 0 || count == 3 || count > 4)
                 return -EINVAL;
diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c
index 361358134315..93880ed6291c 100644
--- a/drivers/scsi/device_handler/scsi_dh_rdac.c
+++ b/drivers/scsi/device_handler/scsi_dh_rdac.c
@@ -562,7 +562,7 @@ static int mode_select_handle_sense(struct scsi_device *sdev,
                         /*
                          * Command Lock contention
                          */
-                        err = SCSI_DH_RETRY;
+                        err = SCSI_DH_IMM_RETRY;
                 break;
         default:
                 break;
@@ -612,6 +612,8 @@ retry:
                 err = mode_select_handle_sense(sdev, h->sense);
                 if (err == SCSI_DH_RETRY && retry_cnt--)
                         goto retry;
+                if (err == SCSI_DH_IMM_RETRY)
+                        goto retry;
         }
         if (err == SCSI_DH_OK) {
                 h->state = RDAC_STATE_ACTIVE;
diff --git a/drivers/scsi/hisi_sas/Kconfig b/drivers/scsi/hisi_sas/Kconfig
index b67661836c9f..d1dd1616f983 100644
--- a/drivers/scsi/hisi_sas/Kconfig
+++ b/drivers/scsi/hisi_sas/Kconfig
@@ -1,6 +1,6 @@
 config SCSI_HISI_SAS
         tristate "HiSilicon SAS"
-        depends on HAS_DMA
+        depends on HAS_DMA && HAS_IOMEM
         depends on ARM64 || COMPILE_TEST
         select SCSI_SAS_LIBSAS
         select BLK_DEV_INTEGRITY
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
index 057fdeb720ac..eea24d7531cf 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
@@ -1289,13 +1289,10 @@ static int slot_complete_v1_hw(struct hisi_hba *hisi_hba,
                 goto out;
         }
 
-        if (cmplt_hdr_data & CMPLT_HDR_ERR_RCRD_XFRD_MSK) {
-                if (!(cmplt_hdr_data & CMPLT_HDR_CMD_CMPLT_MSK) ||
-                    !(cmplt_hdr_data & CMPLT_HDR_RSPNS_XFRD_MSK))
-                        ts->stat = SAS_DATA_OVERRUN;
-                else
-                        slot_err_v1_hw(hisi_hba, task, slot);
+        if (cmplt_hdr_data & CMPLT_HDR_ERR_RCRD_XFRD_MSK &&
+                !(cmplt_hdr_data & CMPLT_HDR_RSPNS_XFRD_MSK)) {
 
+                slot_err_v1_hw(hisi_hba, task, slot);
                 goto out;
         }
 
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 52a87657c7dd..692a7570b5e1 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -2204,7 +2204,7 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
         /* Clear outstanding commands array. */
         for (que = 0; que < ha->max_req_queues; que++) {
                 req = ha->req_q_map[que];
-                if (!req)
+                if (!req || !test_bit(que, ha->req_qid_map))
                         continue;
                 req->out_ptr = (void *)(req->ring + req->length);
                 *req->out_ptr = 0;
@@ -2221,7 +2221,7 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
 
         for (que = 0; que < ha->max_rsp_queues; que++) {
                 rsp = ha->rsp_q_map[que];
-                if (!rsp)
+                if (!rsp || !test_bit(que, ha->rsp_qid_map))
                         continue;
                 rsp->in_ptr = (void *)(rsp->ring + rsp->length);
                 *rsp->in_ptr = 0;
@@ -4981,7 +4981,7 @@ qla25xx_init_queues(struct qla_hw_data *ha)
 
         for (i = 1; i < ha->max_rsp_queues; i++) {
                 rsp = ha->rsp_q_map[i];
-                if (rsp) {
+                if (rsp && test_bit(i, ha->rsp_qid_map)) {
                         rsp->options &= ~BIT_0;
                         ret = qla25xx_init_rsp_que(base_vha, rsp);
                         if (ret != QLA_SUCCESS)
@@ -4996,8 +4996,8 @@ qla25xx_init_queues(struct qla_hw_data *ha)
         }
         for (i = 1; i < ha->max_req_queues; i++) {
                 req = ha->req_q_map[i];
-                if (req) {
-                /* Clear outstanding commands array. */
+                if (req && test_bit(i, ha->req_qid_map)) {
+                        /* Clear outstanding commands array. */
                         req->options &= ~BIT_0;
                         ret = qla25xx_init_req_que(base_vha, req);
                         if (ret != QLA_SUCCESS)
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index d4d65eb0e9b4..4af95479a9db 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3063,9 +3063,9 @@ qla24xx_enable_msix(struct qla_hw_data *ha, struct rsp_que *rsp)
                     "MSI-X: Failed to enable support "
                     "-- %d/%d\n Retry with %d vectors.\n",
                     ha->msix_count, ret, ret);
+                ha->msix_count = ret;
+                ha->max_rsp_queues = ha->msix_count - 1;
         }
-        ha->msix_count = ret;
-        ha->max_rsp_queues = ha->msix_count - 1;
         ha->msix_entries = kzalloc(sizeof(struct qla_msix_entry) *
                                 ha->msix_count, GFP_KERNEL);
         if (!ha->msix_entries) {
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index c5dd594f6c31..cf7ba52bae66 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -600,7 +600,7 @@ qla25xx_delete_queues(struct scsi_qla_host *vha)
         /* Delete request queues */
         for (cnt = 1; cnt < ha->max_req_queues; cnt++) {
                 req = ha->req_q_map[cnt];
-                if (req) {
+                if (req && test_bit(cnt, ha->req_qid_map)) {
                         ret = qla25xx_delete_req_que(vha, req);
                         if (ret != QLA_SUCCESS) {
                                 ql_log(ql_log_warn, vha, 0x00ea,
@@ -614,7 +614,7 @@ qla25xx_delete_queues(struct scsi_qla_host *vha)
         /* Delete response queues */
         for (cnt = 1; cnt < ha->max_rsp_queues; cnt++) {
                 rsp = ha->rsp_q_map[cnt];
-                if (rsp) {
+                if (rsp && test_bit(cnt, ha->rsp_qid_map)) {
                         ret = qla25xx_delete_rsp_que(vha, rsp);
                         if (ret != QLA_SUCCESS) {
                                 ql_log(ql_log_warn, vha, 0x00eb,
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index f1788db43195..f6c7ce35b542 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -409,6 +409,9 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
         int cnt;
 
         for (cnt = 0; cnt < ha->max_req_queues; cnt++) {
+                if (!test_bit(cnt, ha->req_qid_map))
+                        continue;
+
                 req = ha->req_q_map[cnt];
                 qla2x00_free_req_que(ha, req);
         }
@@ -416,6 +419,9 @@ static void qla2x00_free_queues(struct qla_hw_data *ha)
         ha->req_q_map = NULL;
 
         for (cnt = 0; cnt < ha->max_rsp_queues; cnt++) {
+                if (!test_bit(cnt, ha->rsp_qid_map))
+                        continue;
+
                 rsp = ha->rsp_q_map[cnt];
                 qla2x00_free_rsp_que(ha, rsp);
         }
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index 8075a4cdb45c..ee967becd257 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -105,7 +105,7 @@ static void qlt_response_pkt(struct scsi_qla_host *ha, response_t *pkt);
 static int qlt_issue_task_mgmt(struct qla_tgt_sess *sess, uint32_t lun,
         int fn, void *iocb, int flags);
 static void qlt_send_term_exchange(struct scsi_qla_host *ha, struct qla_tgt_cmd
-        *cmd, struct atio_from_isp *atio, int ha_locked);
+        *cmd, struct atio_from_isp *atio, int ha_locked, int ul_abort);
 static void qlt_reject_free_srr_imm(struct scsi_qla_host *ha,
         struct qla_tgt_srr_imm *imm, int ha_lock);
 static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
@@ -1756,7 +1756,7 @@ void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *mcmd)
                 qlt_send_notify_ack(vha, &mcmd->orig_iocb.imm_ntfy,
                     0, 0, 0, 0, 0, 0);
         else {
-                if (mcmd->se_cmd.se_tmr_req->function == TMR_ABORT_TASK)
+                if (mcmd->orig_iocb.atio.u.raw.entry_type == ABTS_RECV_24XX)
                         qlt_24xx_send_abts_resp(vha, &mcmd->orig_iocb.abts,
                             mcmd->fc_tm_rsp, false);
                 else
@@ -2665,7 +2665,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
                         /* no need to terminate. FW already freed exchange. */
                         qlt_abort_cmd_on_host_reset(cmd->vha, cmd);
                 else
-                        qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                        qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0);
                 spin_unlock_irqrestore(&ha->hardware_lock, flags);
                 return 0;
         }
@@ -3173,7 +3173,8 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
 }
 
 static void qlt_send_term_exchange(struct scsi_qla_host *vha,
-        struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked)
+        struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked,
+        int ul_abort)
 {
         unsigned long flags = 0;
         int rc;
@@ -3193,8 +3194,7 @@ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
                 qlt_alloc_qfull_cmd(vha, atio, 0, 0);
 
 done:
-        if (cmd && (!cmd->aborted ||
-            !cmd->cmd_sent_to_fw)) {
+        if (cmd && !ul_abort && !cmd->aborted) {
                 if (cmd->sg_mapped)
                         qlt_unmap_sg(vha, cmd);
                 vha->hw->tgt.tgt_ops->free_cmd(cmd);
@@ -3253,21 +3253,38 @@ static void qlt_chk_exch_leak_thresh_hold(struct scsi_qla_host *vha)
 
 }
 
-void qlt_abort_cmd(struct qla_tgt_cmd *cmd)
+int qlt_abort_cmd(struct qla_tgt_cmd *cmd)
 {
         struct qla_tgt *tgt = cmd->tgt;
         struct scsi_qla_host *vha = tgt->vha;
         struct se_cmd *se_cmd = &cmd->se_cmd;
+        unsigned long flags;
 
         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf014,
             "qla_target(%d): terminating exchange for aborted cmd=%p "
             "(se_cmd=%p, tag=%llu)", vha->vp_idx, cmd, &cmd->se_cmd,
             se_cmd->tag);
 
+        spin_lock_irqsave(&cmd->cmd_lock, flags);
+        if (cmd->aborted) {
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+                /*
+                 * It's normal to see 2 calls in this path:
+                 *  1) XFER Rdy completion + CMD_T_ABORT
+                 *  2) TCM TMR - drain_state_list
+                 */
+                ql_dbg(ql_dbg_tgt_mgt, vha, 0xffff,
+                        "multiple abort. %p transport_state %x, t_state %x,"
+                        " se_cmd_flags %x \n", cmd, cmd->se_cmd.transport_state,
+                        cmd->se_cmd.t_state,cmd->se_cmd.se_cmd_flags);
+                return EIO;
+        }
         cmd->aborted = 1;
         cmd->cmd_flags |= BIT_6;
+        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
 
-        qlt_send_term_exchange(vha, cmd, &cmd->atio, 0);
+        qlt_send_term_exchange(vha, cmd, &cmd->atio, 0, 1);
+        return 0;
 }
 EXPORT_SYMBOL(qlt_abort_cmd);
 
@@ -3282,6 +3299,9 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd)
 
         BUG_ON(cmd->cmd_in_wq);
 
+        if (cmd->sg_mapped)
+                qlt_unmap_sg(cmd->vha, cmd);
+
         if (!cmd->q_full)
                 qlt_decr_num_pend_cmds(cmd->vha);
 
@@ -3399,7 +3419,7 @@ static int qlt_term_ctio_exchange(struct scsi_qla_host *vha, void *ctio,
                 term = 1;
 
         if (term)
-                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0);
 
         return term;
 }
@@ -3580,12 +3600,13 @@ static void qlt_do_ctio_completion(struct scsi_qla_host *vha, uint32_t handle,
                 case CTIO_PORT_LOGGED_OUT:
                 case CTIO_PORT_UNAVAILABLE:
                 {
-                        int logged_out = (status & 0xFFFF);
+                        int logged_out =
+                                (status & 0xFFFF) == CTIO_PORT_LOGGED_OUT;
+
                         ql_dbg(ql_dbg_tgt_mgt, vha, 0xf059,
                             "qla_target(%d): CTIO with %s status %x "
                             "received (state %x, se_cmd %p)\n", vha->vp_idx,
-                            (logged_out == CTIO_PORT_LOGGED_OUT) ?
-                            "PORT LOGGED OUT" : "PORT UNAVAILABLE",
+                            logged_out ? "PORT LOGGED OUT" : "PORT UNAVAILABLE",
                             status, cmd->state, se_cmd);
 
                         if (logged_out && cmd->sess) {
@@ -3754,6 +3775,7 @@ static void __qlt_do_work(struct qla_tgt_cmd *cmd)
                 goto out_term;
         }
 
+        spin_lock_init(&cmd->cmd_lock);
         cdb = &atio->u.isp24.fcp_cmnd.cdb[0];
         cmd->se_cmd.tag = atio->u.isp24.exchange_addr;
         cmd->unpacked_lun = scsilun_to_int(
@@ -3796,7 +3818,7 @@ out_term:
          */
         cmd->cmd_flags |= BIT_2;
         spin_lock_irqsave(&ha->hardware_lock, flags);
-        qlt_send_term_exchange(vha, NULL, &cmd->atio, 1);
+        qlt_send_term_exchange(vha, NULL, &cmd->atio, 1, 0);
 
         qlt_decr_num_pend_cmds(vha);
         percpu_ida_free(&sess->se_sess->sess_tag_pool, cmd->se_cmd.map_tag);
@@ -3918,7 +3940,7 @@ static void qlt_create_sess_from_atio(struct work_struct *work)
 
 out_term:
         spin_lock_irqsave(&ha->hardware_lock, flags);
-        qlt_send_term_exchange(vha, NULL, &op->atio, 1);
+        qlt_send_term_exchange(vha, NULL, &op->atio, 1, 0);
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
         kfree(op);
 
@@ -3982,7 +4004,8 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
 
         cmd->cmd_in_wq = 1;
         cmd->cmd_flags |= BIT_0;
-        cmd->se_cmd.cpuid = -1;
+        cmd->se_cmd.cpuid = ha->msix_count ?
+                ha->tgt.rspq_vector_cpuid : WORK_CPU_UNBOUND;
 
         spin_lock(&vha->cmd_list_lock);
         list_add_tail(&cmd->cmd_list, &vha->qla_cmd_list);
@@ -3990,7 +4013,6 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
 
         INIT_WORK(&cmd->work, qlt_do_work);
         if (ha->msix_count) {
-                cmd->se_cmd.cpuid = ha->tgt.rspq_vector_cpuid;
                 if (cmd->atio.u.isp24.fcp_cmnd.rddata)
                         queue_work_on(smp_processor_id(), qla_tgt_wq,
                             &cmd->work);
@@ -4771,7 +4793,7 @@ out_reject:
                 dump_stack();
         } else {
                 cmd->cmd_flags |= BIT_9;
-                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1);
+                qlt_send_term_exchange(vha, cmd, &cmd->atio, 1, 0);
         }
         spin_unlock_irqrestore(&ha->hardware_lock, flags);
 }
@@ -4950,7 +4972,7 @@ static void qlt_prepare_srr_imm(struct scsi_qla_host *vha,
                                     sctio, sctio->srr_id);
                                 list_del(&sctio->srr_list_entry);
                                 qlt_send_term_exchange(vha, sctio->cmd,
-                                    &sctio->cmd->atio, 1);
+                                    &sctio->cmd->atio, 1, 0);
                                 kfree(sctio);
                         }
                 }
@@ -5123,7 +5145,7 @@ static int __qlt_send_busy(struct scsi_qla_host *vha,
             atio->u.isp24.fcp_hdr.s_id);
         spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
         if (!sess) {
-                qlt_send_term_exchange(vha, NULL, atio, 1);
+                qlt_send_term_exchange(vha, NULL, atio, 1, 0);
                 return 0;
         }
         /* Sending marker isn't necessary, since we called from ISR */
@@ -5406,7 +5428,7 @@ static void qlt_24xx_atio_pkt(struct scsi_qla_host *vha,
 #if 1 /* With TERM EXCHANGE some FC cards refuse to boot */
                                 qlt_send_busy(vha, atio, SAM_STAT_BUSY);
 #else
-                                qlt_send_term_exchange(vha, NULL, atio, 1);
+                                qlt_send_term_exchange(vha, NULL, atio, 1, 0);
 #endif
 
                                 if (!ha_locked)
@@ -5523,7 +5545,7 @@ static void qlt_response_pkt(struct scsi_qla_host *vha, response_t *pkt)
 #if 1 /* With TERM EXCHANGE some FC cards refuse to boot */
                                 qlt_send_busy(vha, atio, 0);
 #else
-                                qlt_send_term_exchange(vha, NULL, atio, 1);
+                                qlt_send_term_exchange(vha, NULL, atio, 1, 0);
 #endif
                         } else {
                                 if (tgt->tgt_stop) {
@@ -5532,7 +5554,7 @@ static void qlt_response_pkt(struct scsi_qla_host *vha, response_t *pkt)
                                             "command to target, sending TERM "
                                             "EXCHANGE for rsp\n");
                                         qlt_send_term_exchange(vha, NULL,
-                                            atio, 1);
+                                            atio, 1, 0);
                                 } else {
                                         ql_dbg(ql_dbg_tgt, vha, 0xe060,
                                             "qla_target(%d): Unable to send "
@@ -5960,7 +5982,7 @@ static void qlt_tmr_work(struct qla_tgt *tgt,
         return;
 
 out_term:
-        qlt_send_term_exchange(vha, NULL, &prm->tm_iocb2, 0);
+        qlt_send_term_exchange(vha, NULL, &prm->tm_iocb2, 1, 0);
         if (sess)
                 ha->tgt.tgt_ops->put_sess(sess);
         spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
diff --git a/drivers/scsi/qla2xxx/qla_target.h b/drivers/scsi/qla2xxx/qla_target.h
index 71b2865ba3c8..22a6a767fe07 100644
--- a/drivers/scsi/qla2xxx/qla_target.h
+++ b/drivers/scsi/qla2xxx/qla_target.h
@@ -943,6 +943,36 @@ struct qla_tgt_sess {
         qlt_plogi_ack_t *plogi_link[QLT_PLOGI_LINK_MAX];
 };
 
+typedef enum {
+        /*
+         * BIT_0 - Atio Arrival / schedule to work
+         * BIT_1 - qlt_do_work
+         * BIT_2 - qlt_do work failed
+         * BIT_3 - xfer rdy/tcm_qla2xxx_write_pending
+         * BIT_4 - read respond/tcm_qla2xx_queue_data_in
+         * BIT_5 - status respond / tcm_qla2xx_queue_status
+         * BIT_6 - tcm request to abort/Term exchange.
+         *      pre_xmit_response->qlt_send_term_exchange
+         * BIT_7 - SRR received (qlt_handle_srr->qlt_xmit_response)
+         * BIT_8 - SRR received (qlt_handle_srr->qlt_rdy_to_xfer)
+         * BIT_9 - SRR received (qla_handle_srr->qlt_send_term_exchange)
+         * BIT_10 - Data in - hanlde_data->tcm_qla2xxx_handle_data
+
+         * BIT_12 - good completion - qlt_ctio_do_completion -->free_cmd
+         * BIT_13 - Bad completion -
+         *      qlt_ctio_do_completion --> qlt_term_ctio_exchange
+         * BIT_14 - Back end data received/sent.
+         * BIT_15 - SRR prepare ctio
+         * BIT_16 - complete free
+         * BIT_17 - flush - qlt_abort_cmd_on_host_reset
+         * BIT_18 - completion w/abort status
+         * BIT_19 - completion w/unknown status
+         * BIT_20 - tcm_qla2xxx_free_cmd
+         */
+        CMD_FLAG_DATA_WORK = BIT_11,
+        CMD_FLAG_DATA_WORK_FREE = BIT_21,
+} cmd_flags_t;
+
 struct qla_tgt_cmd {
         struct se_cmd se_cmd;
         struct qla_tgt_sess *sess;
@@ -952,6 +982,7 @@ struct qla_tgt_cmd {
         /* Sense buffer that will be mapped into outgoing status */
         unsigned char sense_buffer[TRANSPORT_SENSE_BUFFER];
 
+        spinlock_t cmd_lock;
         /* to save extra sess dereferences */
         unsigned int conf_compl_supported:1;
         unsigned int sg_mapped:1;
@@ -986,30 +1017,8 @@ struct qla_tgt_cmd {
 
         uint64_t jiffies_at_alloc;
         uint64_t jiffies_at_free;
-        /* BIT_0 - Atio Arrival / schedule to work
-         * BIT_1 - qlt_do_work
-         * BIT_2 - qlt_do work failed
-         * BIT_3 - xfer rdy/tcm_qla2xxx_write_pending
-         * BIT_4 - read respond/tcm_qla2xx_queue_data_in
-         * BIT_5 - status respond / tcm_qla2xx_queue_status
-         * BIT_6 - tcm request to abort/Term exchange.
-         *      pre_xmit_response->qlt_send_term_exchange
-         * BIT_7 - SRR received (qlt_handle_srr->qlt_xmit_response)
-         * BIT_8 - SRR received (qlt_handle_srr->qlt_rdy_to_xfer)
-         * BIT_9 - SRR received (qla_handle_srr->qlt_send_term_exchange)
-         * BIT_10 - Data in - hanlde_data->tcm_qla2xxx_handle_data
-         * BIT_11 - Data actually going to TCM : tcm_qla2xx_handle_data_work
-         * BIT_12 - good completion - qlt_ctio_do_completion -->free_cmd
-         * BIT_13 - Bad completion -
-         *      qlt_ctio_do_completion --> qlt_term_ctio_exchange
-         * BIT_14 - Back end data received/sent.
-         * BIT_15 - SRR prepare ctio
-         * BIT_16 - complete free
-         * BIT_17 - flush - qlt_abort_cmd_on_host_reset
-         * BIT_18 - completion w/abort status
-         * BIT_19 - completion w/unknown status
-         */
-        uint32_t cmd_flags;
+
+        cmd_flags_t cmd_flags;
 };
 
 struct qla_tgt_sess_work_param {
@@ -1148,7 +1157,7 @@ static inline void sid_to_portid(const uint8_t *s_id, port_id_t *p)
 extern void qlt_response_pkt_all_vps(struct scsi_qla_host *, response_t *);
 extern int qlt_rdy_to_xfer(struct qla_tgt_cmd *);
 extern int qlt_xmit_response(struct qla_tgt_cmd *, int, uint8_t);
-extern void qlt_abort_cmd(struct qla_tgt_cmd *);
+extern int qlt_abort_cmd(struct qla_tgt_cmd *);
 extern void qlt_xmit_tm_rsp(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_mcmd(struct qla_tgt_mgmt_cmd *);
 extern void qlt_free_cmd(struct qla_tgt_cmd *cmd);
diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c
index ddbe2e7ac14d..c3e622524604 100644
--- a/drivers/scsi/qla2xxx/qla_tmpl.c
+++ b/drivers/scsi/qla2xxx/qla_tmpl.c
@@ -395,6 +395,10 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
         if (ent->t263.queue_type == T263_QUEUE_TYPE_REQ) {
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
+
+                        if (!test_bit(i, vha->hw->req_qid_map))
+                                continue;
+
                         if (req || !buf) {
                                 length = req ?
                                     req->length : REQUEST_ENTRY_CNT_24XX;
@@ -408,6 +412,10 @@ qla27xx_fwdt_entry_t263(struct scsi_qla_host *vha,
         } else if (ent->t263.queue_type == T263_QUEUE_TYPE_RSP) {
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
+
+                        if (!test_bit(i, vha->hw->rsp_qid_map))
+                                continue;
+
                         if (rsp || !buf) {
                                 length = rsp ?
                                     rsp->length : RESPONSE_ENTRY_CNT_MQ;
@@ -634,6 +642,10 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
         if (ent->t274.queue_type == T274_QUEUE_TYPE_REQ_SHAD) {
                 for (i = 0; i < vha->hw->max_req_queues; i++) {
                         struct req_que *req = vha->hw->req_q_map[i];
+
+                        if (!test_bit(i, vha->hw->req_qid_map))
+                                continue;
+
                         if (req || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
@@ -645,6 +657,10 @@ qla27xx_fwdt_entry_t274(struct scsi_qla_host *vha,
         } else if (ent->t274.queue_type == T274_QUEUE_TYPE_RSP_SHAD) {
                 for (i = 0; i < vha->hw->max_rsp_queues; i++) {
                         struct rsp_que *rsp = vha->hw->rsp_q_map[i];
+
+                        if (!test_bit(i, vha->hw->rsp_qid_map))
+                                continue;
+
                         if (rsp || !buf) {
                                 qla27xx_insert16(i, buf, len);
                                 qla27xx_insert16(1, buf, len);
diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
index faf0a126627f..1808a01cfb7e 100644
--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
@@ -298,6 +298,10 @@ static void tcm_qla2xxx_free_cmd(struct qla_tgt_cmd *cmd)
 {
         cmd->vha->tgt_counters.core_qla_free_cmd++;
         cmd->cmd_in_wq = 1;
+
+        BUG_ON(cmd->cmd_flags & BIT_20);
+        cmd->cmd_flags |= BIT_20;
+
         INIT_WORK(&cmd->work, tcm_qla2xxx_complete_free);
         queue_work_on(smp_processor_id(), tcm_qla2xxx_free_wq, &cmd->work);
 }
@@ -374,6 +378,20 @@ static int tcm_qla2xxx_write_pending(struct se_cmd *se_cmd)
 {
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
+
+        if (cmd->aborted) {
+                /* Cmd can loop during Q-full.  tcm_qla2xxx_aborted_task
+                 * can get ahead of this cmd. tcm_qla2xxx_aborted_task
+                 * already kick start the free.
+                 */
+                pr_debug("write_pending aborted cmd[%p] refcount %d "
+                        "transport_state %x, t_state %x, se_cmd_flags %x\n",
+                        cmd,cmd->se_cmd.cmd_kref.refcount.counter,
+                        cmd->se_cmd.transport_state,
+                        cmd->se_cmd.t_state,
+                        cmd->se_cmd.se_cmd_flags);
+                return 0;
+        }
         cmd->cmd_flags |= BIT_3;
         cmd->bufflen = se_cmd->data_length;
         cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
@@ -405,7 +423,7 @@ static int tcm_qla2xxx_write_pending_status(struct se_cmd *se_cmd)
             se_cmd->t_state == TRANSPORT_COMPLETE_QF_WP) {
                 spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
                 wait_for_completion_timeout(&se_cmd->t_transport_stop_comp,
-                                            3 * HZ);
+                                                50);
                 return 0;
         }
         spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
@@ -444,6 +462,9 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
         if (bidi)
                 flags |= TARGET_SCF_BIDI_OP;
 
+        if (se_cmd->cpuid != WORK_CPU_UNBOUND)
+                flags |= TARGET_SCF_USE_CPUID;
+
         sess = cmd->sess;
         if (!sess) {
                 pr_err("Unable to locate struct qla_tgt_sess from qla_tgt_cmd\n");
@@ -465,13 +486,25 @@ static int tcm_qla2xxx_handle_cmd(scsi_qla_host_t *vha, struct qla_tgt_cmd *cmd,
 static void tcm_qla2xxx_handle_data_work(struct work_struct *work)
 {
         struct qla_tgt_cmd *cmd = container_of(work, struct qla_tgt_cmd, work);
+        unsigned long flags;
 
         /*
          * Ensure that the complete FCP WRITE payload has been received.
          * Otherwise return an exception via CHECK_CONDITION status.
          */
         cmd->cmd_in_wq = 0;
-        cmd->cmd_flags |= BIT_11;
+
+        spin_lock_irqsave(&cmd->cmd_lock, flags);
+        cmd->cmd_flags |= CMD_FLAG_DATA_WORK;
+        if (cmd->aborted) {
+                cmd->cmd_flags |= CMD_FLAG_DATA_WORK_FREE;
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+
+                tcm_qla2xxx_free_cmd(cmd);
+                return;
+        }
+        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+
         cmd->vha->tgt_counters.qla_core_ret_ctio++;
         if (!cmd->write_data_transferred) {
                 /*
@@ -546,6 +579,20 @@ static int tcm_qla2xxx_queue_data_in(struct se_cmd *se_cmd)
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
 
+        if (cmd->aborted) {
+                /* Cmd can loop during Q-full.  tcm_qla2xxx_aborted_task
+                 * can get ahead of this cmd. tcm_qla2xxx_aborted_task
+                 * already kick start the free.
+                 */
+                pr_debug("queue_data_in aborted cmd[%p] refcount %d "
+                        "transport_state %x, t_state %x, se_cmd_flags %x\n",
+                        cmd,cmd->se_cmd.cmd_kref.refcount.counter,
+                        cmd->se_cmd.transport_state,
+                        cmd->se_cmd.t_state,
+                        cmd->se_cmd.se_cmd_flags);
+                return 0;
+        }
+
         cmd->cmd_flags |= BIT_4;
         cmd->bufflen = se_cmd->data_length;
         cmd->dma_data_direction = target_reverse_dma_direction(se_cmd);
@@ -637,11 +684,34 @@ static void tcm_qla2xxx_queue_tm_rsp(struct se_cmd *se_cmd)
         qlt_xmit_tm_rsp(mcmd);
 }
 
+
+#define DATA_WORK_NOT_FREE(_flags) \
+        (( _flags & (CMD_FLAG_DATA_WORK|CMD_FLAG_DATA_WORK_FREE)) == \
+         CMD_FLAG_DATA_WORK)
 static void tcm_qla2xxx_aborted_task(struct se_cmd *se_cmd)
 {
         struct qla_tgt_cmd *cmd = container_of(se_cmd,
                                 struct qla_tgt_cmd, se_cmd);
-        qlt_abort_cmd(cmd);
+        unsigned long flags;
+
+        if (qlt_abort_cmd(cmd))
+                return;
+
+        spin_lock_irqsave(&cmd->cmd_lock, flags);
+        if ((cmd->state == QLA_TGT_STATE_NEW)||
+                ((cmd->state == QLA_TGT_STATE_DATA_IN) &&
+                 DATA_WORK_NOT_FREE(cmd->cmd_flags)) ) {
+
+                cmd->cmd_flags |= CMD_FLAG_DATA_WORK_FREE;
+                spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+                /* Cmd have not reached firmware.
+                 * Use this trigger to free it. */
+                tcm_qla2xxx_free_cmd(cmd);
+                return;
+        }
+        spin_unlock_irqrestore(&cmd->cmd_lock, flags);
+        return;
+
 }
 
 static void tcm_qla2xxx_clear_sess_lookup(struct tcm_qla2xxx_lport *,
diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
index 47b9d13f97b8..da2e068ee47d 100644
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -205,6 +205,7 @@ static struct {
         {"Intel", "Multi-Flex", NULL, BLIST_NO_RSOC},
         {"iRiver", "iFP Mass Driver", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
         {"LASOUND", "CDX7405", "3.10", BLIST_MAX5LUN | BLIST_SINGLELUN},
+        {"Marvell", "Console", NULL, BLIST_SKIP_VPD_PAGES},
         {"MATSHITA", "PD-1", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
         {"MATSHITA", "DMC-LC5", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
         {"MATSHITA", "DMC-LC40", NULL, BLIST_NOT_LOCKABLE | BLIST_INQUIRY_36},
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index bb669d32ccd0..d749da765df1 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -761,7 +761,7 @@ static int sd_setup_discard_cmnd(struct scsi_cmnd *cmd)
                 break;
 
         default:
-                ret = BLKPREP_KILL;
+                ret = BLKPREP_INVALID;
                 goto out;
         }
 
@@ -839,7 +839,7 @@ static int sd_setup_write_same_cmnd(struct scsi_cmnd *cmd)
         int ret;
 
         if (sdkp->device->no_write_same)
-                return BLKPREP_KILL;
+                return BLKPREP_INVALID;
 
         BUG_ON(bio_offset(bio) || bio_iovec(bio).bv_len != sdp->sector_size);
 
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 55627d097873..292c04eec9ad 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -42,6 +42,7 @@
 #include <scsi/scsi_devinfo.h>
 #include <scsi/scsi_dbg.h>
 #include <scsi/scsi_transport_fc.h>
+#include <scsi/scsi_transport.h>
 
 /*
  * All wire protocol details (storage protocol between the guest and the host)
@@ -477,19 +478,18 @@ struct hv_host_device {
 struct storvsc_scan_work {
         struct work_struct work;
         struct Scsi_Host *host;
-        uint lun;
+        u8 lun;
+        u8 tgt_id;
 };
 
 static void storvsc_device_scan(struct work_struct *work)
 {
         struct storvsc_scan_work *wrk;
-        uint lun;
         struct scsi_device *sdev;
 
         wrk = container_of(work, struct storvsc_scan_work, work);
-        lun = wrk->lun;
 
-        sdev = scsi_device_lookup(wrk->host, 0, 0, lun);
+        sdev = scsi_device_lookup(wrk->host, 0, wrk->tgt_id, wrk->lun);
         if (!sdev)
                 goto done;
         scsi_rescan_device(&sdev->sdev_gendev);
@@ -540,7 +540,7 @@ static void storvsc_remove_lun(struct work_struct *work)
         if (!scsi_host_get(wrk->host))
                 goto done;
 
-        sdev = scsi_device_lookup(wrk->host, 0, 0, wrk->lun);
+        sdev = scsi_device_lookup(wrk->host, 0, wrk->tgt_id, wrk->lun);
 
         if (sdev) {
                 scsi_remove_device(sdev);
@@ -940,6 +940,7 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
 
         wrk->host = host;
         wrk->lun = vm_srb->lun;
+        wrk->tgt_id = vm_srb->target_id;
         INIT_WORK(&wrk->work, process_err_fn);
         schedule_work(&wrk->work);
 }
@@ -1770,6 +1771,11 @@ static int __init storvsc_drv_init(void)
         fc_transport_template = fc_attach_transport(&fc_transport_functions);
         if (!fc_transport_template)
                 return -ENODEV;
+
+        /*
+         * Install Hyper-V specific timeout handler.
+         */
+        fc_transport_template->eh_timed_out = storvsc_eh_timed_out;
 #endif
 
         ret = vmbus_driver_register(&storvsc_drv);
diff --git a/drivers/spmi/spmi-pmic-arb.c b/drivers/spmi/spmi-pmic-arb.c
index be822f7a9ce6..aca282d45421 100644
--- a/drivers/spmi/spmi-pmic-arb.c
+++ b/drivers/spmi/spmi-pmic-arb.c
@@ -10,6 +10,7 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  */
+#include <linux/bitmap.h>
 #include <linux/delay.h>
 #include <linux/err.h>
 #include <linux/interrupt.h>
@@ -47,9 +48,9 @@
 #define SPMI_MAPPING_BIT_IS_1_FLAG(X)   (((X) >> 8) & 0x1)
 #define SPMI_MAPPING_BIT_IS_1_RESULT(X) (((X) >> 0) & 0xFF)
 
-#define SPMI_MAPPING_TABLE_LEN          255
 #define SPMI_MAPPING_TABLE_TREE_DEPTH   16      /* Maximum of 16-bits */
-#define PPID_TO_CHAN_TABLE_SZ           BIT(12) /* PPID is 12bit chan is 1byte*/
+#define PMIC_ARB_MAX_PPID               BIT(12) /* PPID is 12bit */
+#define PMIC_ARB_CHAN_VALID             BIT(15)
 
 /* Ownership Table */
 #define SPMI_OWNERSHIP_TABLE_REG(N)     (0x0700 + (4 * (N)))
@@ -85,9 +86,7 @@ enum pmic_arb_cmd_op_code {
 };
 
 /* Maximum number of support PMIC peripherals */
-#define PMIC_ARB_MAX_PERIPHS            256
-#define PMIC_ARB_MAX_CHNL               128
-#define PMIC_ARB_PERIPH_ID_VALID        (1 << 15)
+#define PMIC_ARB_MAX_PERIPHS            512
 #define PMIC_ARB_TIMEOUT_US             100
 #define PMIC_ARB_MAX_TRANS_BYTES        (8)
 
@@ -125,18 +124,22 @@ struct spmi_pmic_arb_dev {
         void __iomem            *wr_base;
         void __iomem            *intr;
         void __iomem            *cnfg;
+        void __iomem            *core;
+        resource_size_t         core_size;
         raw_spinlock_t          lock;
         u8                      channel;
         int                     irq;
         u8                      ee;
-        u8                      min_apid;
-        u8                      max_apid;
-        u32                     mapping_table[SPMI_MAPPING_TABLE_LEN];
+        u16                     min_apid;
+        u16                     max_apid;
+        u32                     *mapping_table;
+        DECLARE_BITMAP(mapping_table_valid, PMIC_ARB_MAX_PERIPHS);
         struct irq_domain       *domain;
         struct spmi_controller  *spmic;
-        u16                     apid_to_ppid[256];
+        u16                     *apid_to_ppid;
         const struct pmic_arb_ver_ops *ver_ops;
-        u8                      *ppid_to_chan;
+        u16                     *ppid_to_chan;
+        u16                     last_channel;
 };
 
 /**
@@ -158,7 +161,8 @@ struct spmi_pmic_arb_dev {
  */
 struct pmic_arb_ver_ops {
         /* spmi commands (read_cmd, write_cmd, cmd) functionality */
-        u32 (*offset)(struct spmi_pmic_arb_dev *dev, u8 sid, u16 addr);
+        int (*offset)(struct spmi_pmic_arb_dev *dev, u8 sid, u16 addr,
+                      u32 *offset);
         u32 (*fmt_cmd)(u8 opc, u8 sid, u16 addr, u8 bc);
         int (*non_data_cmd)(struct spmi_controller *ctrl, u8 opc, u8 sid);
         /* Interrupts controller functionality (offset of PIC registers) */
@@ -212,7 +216,14 @@ static int pmic_arb_wait_for_done(struct spmi_controller *ctrl,
         struct spmi_pmic_arb_dev *dev = spmi_controller_get_drvdata(ctrl);
         u32 status = 0;
         u32 timeout = PMIC_ARB_TIMEOUT_US;
-        u32 offset = dev->ver_ops->offset(dev, sid, addr) + PMIC_ARB_STATUS;
+        u32 offset;
+        int rc;
+
+        rc = dev->ver_ops->offset(dev, sid, addr, &offset);
+        if (rc)
+                return rc;
+
+        offset += PMIC_ARB_STATUS;
 
         while (timeout--) {
                 status = readl_relaxed(base + offset);
@@ -257,7 +268,11 @@ pmic_arb_non_data_cmd_v1(struct spmi_controller *ctrl, u8 opc, u8 sid)
         unsigned long flags;
         u32 cmd;
         int rc;
-        u32 offset = pmic_arb->ver_ops->offset(pmic_arb, sid, 0);
+        u32 offset;
+
+        rc = pmic_arb->ver_ops->offset(pmic_arb, sid, 0, &offset);
+        if (rc)
+                return rc;
 
         cmd = ((opc | 0x40) << 27) | ((sid & 0xf) << 20);
 
@@ -297,7 +312,11 @@ static int pmic_arb_read_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,
         u8 bc = len - 1;
         u32 cmd;
         int rc;
-        u32 offset = pmic_arb->ver_ops->offset(pmic_arb, sid, addr);
+        u32 offset;
+
+        rc = pmic_arb->ver_ops->offset(pmic_arb, sid, addr, &offset);
+        if (rc)
+                return rc;
 
         if (bc >= PMIC_ARB_MAX_TRANS_BYTES) {
                 dev_err(&ctrl->dev,
@@ -344,7 +363,11 @@ static int pmic_arb_write_cmd(struct spmi_controller *ctrl, u8 opc, u8 sid,
         u8 bc = len - 1;
         u32 cmd;
         int rc;
-        u32 offset = pmic_arb->ver_ops->offset(pmic_arb, sid, addr);
+        u32 offset;
+
+        rc = pmic_arb->ver_ops->offset(pmic_arb, sid, addr, &offset);
+        if (rc)
+                return rc;
 
         if (bc >= PMIC_ARB_MAX_TRANS_BYTES) {
                 dev_err(&ctrl->dev,
@@ -614,6 +637,10 @@ static int search_mapping_table(struct spmi_pmic_arb_dev *pa,
         u32 data;
 
         for (i = 0; i < SPMI_MAPPING_TABLE_TREE_DEPTH; ++i) {
+                if (!test_and_set_bit(index, pa->mapping_table_valid))
+                        mapping_table[index] = readl_relaxed(pa->cnfg +
+                                                SPMI_MAPPING_TABLE_REG(index));
+
                 data = mapping_table[index];
 
                 if (ppid & (1 << SPMI_MAPPING_BIT_INDEX(data))) {
@@ -701,18 +728,61 @@ static int qpnpint_irq_domain_map(struct irq_domain *d,
 }
 
 /* v1 offset per ee */
-static u32 pmic_arb_offset_v1(struct spmi_pmic_arb_dev *pa, u8 sid, u16 addr)
+static int
+pmic_arb_offset_v1(struct spmi_pmic_arb_dev *pa, u8 sid, u16 addr, u32 *offset)
 {
-        return 0x800 + 0x80 * pa->channel;
+        *offset = 0x800 + 0x80 * pa->channel;
+        return 0;
 }
 
+static u16 pmic_arb_find_chan(struct spmi_pmic_arb_dev *pa, u16 ppid)
+{
+        u32 regval, offset;
+        u16 chan;
+        u16 id;
+
+        /*
+         * PMIC_ARB_REG_CHNL is a table in HW mapping channel to ppid.
+         * ppid_to_chan is an in-memory invert of that table.
+         */
+        for (chan = pa->last_channel; ; chan++) {
+                offset = PMIC_ARB_REG_CHNL(chan);
+                if (offset >= pa->core_size)
+                        break;
+
+                regval = readl_relaxed(pa->core + offset);
+                if (!regval)
+                        continue;
+
+                id = (regval >> 8) & PMIC_ARB_PPID_MASK;
+                pa->ppid_to_chan[id] = chan | PMIC_ARB_CHAN_VALID;
+                if (id == ppid) {
+                        chan |= PMIC_ARB_CHAN_VALID;
+                        break;
+                }
+        }
+        pa->last_channel = chan & ~PMIC_ARB_CHAN_VALID;
+
+        return chan;
+}
+
+
 /* v2 offset per ppid (chan) and per ee */
-static u32 pmic_arb_offset_v2(struct spmi_pmic_arb_dev *pa, u8 sid, u16 addr)
+static int
+pmic_arb_offset_v2(struct spmi_pmic_arb_dev *pa, u8 sid, u16 addr, u32 *offset)
 {
         u16 ppid = (sid << 8) | (addr >> 8);
-        u8  chan = pa->ppid_to_chan[ppid];
+        u16 chan;
 
-        return 0x1000 * pa->ee + 0x8000 * chan;
+        chan = pa->ppid_to_chan[ppid];
+        if (!(chan & PMIC_ARB_CHAN_VALID))
+                chan = pmic_arb_find_chan(pa, ppid);
+        if (!(chan & PMIC_ARB_CHAN_VALID))
+                return -ENODEV;
+        chan &= ~PMIC_ARB_CHAN_VALID;
+
+        *offset = 0x1000 * pa->ee + 0x8000 * chan;
+        return 0;
 }
 
 static u32 pmic_arb_fmt_cmd_v1(u8 opc, u8 sid, u16 addr, u8 bc)
@@ -797,7 +867,7 @@ static int spmi_pmic_arb_probe(struct platform_device *pdev)
         struct resource *res;
         void __iomem *core;
         u32 channel, ee, hw_ver;
-        int err, i;
+        int err;
         bool is_v1;
 
         ctrl = spmi_controller_alloc(&pdev->dev, sizeof(*pa));
@@ -808,6 +878,7 @@ static int spmi_pmic_arb_probe(struct platform_device *pdev)
         pa->spmic = ctrl;
 
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "core");
+        pa->core_size = resource_size(res);
         core = devm_ioremap_resource(&ctrl->dev, res);
         if (IS_ERR(core)) {
                 err = PTR_ERR(core);
@@ -825,10 +896,7 @@ static int spmi_pmic_arb_probe(struct platform_device *pdev)
                 pa->wr_base = core;
                 pa->rd_base = core;
         } else {
-                u8  chan;
-                u16 ppid;
-                u32 regval;
-
+                pa->core = core;
                 pa->ver_ops = &pmic_arb_v2;
 
                 res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -847,24 +915,14 @@ static int spmi_pmic_arb_probe(struct platform_device *pdev)
                         goto err_put_ctrl;
                 }
 
-                pa->ppid_to_chan = devm_kzalloc(&ctrl->dev,
-                                        PPID_TO_CHAN_TABLE_SZ, GFP_KERNEL);
+                pa->ppid_to_chan = devm_kcalloc(&ctrl->dev,
+                                                PMIC_ARB_MAX_PPID,
+                                                sizeof(*pa->ppid_to_chan),
+                                                GFP_KERNEL);
                 if (!pa->ppid_to_chan) {
                         err = -ENOMEM;
                         goto err_put_ctrl;
                 }
-                /*
-                 * PMIC_ARB_REG_CHNL is a table in HW mapping channel to ppid.
-                 * ppid_to_chan is an in-memory invert of that table.
-                 */
-                for (chan = 0; chan < PMIC_ARB_MAX_CHNL; ++chan) {
-                        regval = readl_relaxed(core + PMIC_ARB_REG_CHNL(chan));
-                        if (!regval)
-                                continue;
-
-                        ppid = (regval >> 8) & 0xFFF;
-                        pa->ppid_to_chan[ppid] = chan;
-                }
         }
 
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "intr");
@@ -915,9 +973,20 @@ static int spmi_pmic_arb_probe(struct platform_device *pdev)
 
         pa->ee = ee;
 
-        for (i = 0; i < ARRAY_SIZE(pa->mapping_table); ++i)
-                pa->mapping_table[i] = readl_relaxed(
-                                pa->cnfg + SPMI_MAPPING_TABLE_REG(i));
+        pa->apid_to_ppid = devm_kcalloc(&ctrl->dev, PMIC_ARB_MAX_PERIPHS,
+                                            sizeof(*pa->apid_to_ppid),
+                                            GFP_KERNEL);
+        if (!pa->apid_to_ppid) {
+                err = -ENOMEM;
+                goto err_put_ctrl;
+        }
+
+        pa->mapping_table = devm_kcalloc(&ctrl->dev, PMIC_ARB_MAX_PERIPHS - 1,
+                                        sizeof(*pa->mapping_table), GFP_KERNEL);
+        if (!pa->mapping_table) {
+                err = -ENOMEM;
+                goto err_put_ctrl;
+        }
 
         /* Initialize max_apid/min_apid to the opposite bounds, during
          * the irq domain translation, we are sure to update these */
diff --git a/drivers/staging/goldfish/goldfish_audio.c b/drivers/staging/goldfish/goldfish_audio.c
index 891dfaaf1593..364fdcdd3a06 100644
--- a/drivers/staging/goldfish/goldfish_audio.c
+++ b/drivers/staging/goldfish/goldfish_audio.c
@@ -63,7 +63,7 @@ struct goldfish_audio {
 #define AUDIO_READ(data, addr)          (readl(data->reg_base + addr))
 #define AUDIO_WRITE(data, addr, x)      (writel(x, data->reg_base + addr))
 #define AUDIO_WRITE64(data, addr, addr2, x)     \
-        (gf_write_dma_addr((x), data->reg_base + addr, data->reg_base+addr2))
+        (gf_write_dma_addr((x), data->reg_base + addr, data->reg_base + addr2))
 
 /*
  *  temporary variable used between goldfish_audio_probe() and
diff --git a/drivers/staging/goldfish/goldfish_nand.c b/drivers/staging/goldfish/goldfish_nand.c
index 5c4f61c006e2..76d60eed1490 100644
--- a/drivers/staging/goldfish/goldfish_nand.c
+++ b/drivers/staging/goldfish/goldfish_nand.c
@@ -27,6 +27,7 @@
 #include <linux/mutex.h>
 #include <linux/goldfish.h>
 #include <asm/div64.h>
+#include <linux/dma-mapping.h>
 
 #include "goldfish_nand_reg.h"
 
@@ -99,11 +100,11 @@ static int goldfish_nand_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
         loff_t ofs = instr->addr;
         u32 len = instr->len;
-        u32 rem;
+        s32 rem;
 
         if (ofs + len > mtd->size)
                 goto invalid_arg;
-        rem = do_div(ofs, mtd->writesize);
+        ofs = div_s64_rem(ofs, mtd->writesize, &rem);
         if (rem)
                 goto invalid_arg;
         ofs *= (mtd->writesize + mtd->oobsize);
@@ -132,7 +133,7 @@ invalid_arg:
 static int goldfish_nand_read_oob(struct mtd_info *mtd, loff_t ofs,
                                   struct mtd_oob_ops *ops)
 {
-        u32 rem;
+        s32 rem;
 
         if (ofs + ops->len > mtd->size)
                 goto invalid_arg;
@@ -141,7 +142,7 @@ static int goldfish_nand_read_oob(struct mtd_info *mtd, loff_t ofs,
         if (ops->ooblen + ops->ooboffs > mtd->oobsize)
                 goto invalid_arg;
 
-        rem = do_div(ofs, mtd->writesize);
+        ofs = div_s64_rem(ofs, mtd->writesize, &rem);
         if (rem)
                 goto invalid_arg;
         ofs *= (mtd->writesize + mtd->oobsize);
@@ -164,7 +165,7 @@ invalid_arg:
 static int goldfish_nand_write_oob(struct mtd_info *mtd, loff_t ofs,
                                    struct mtd_oob_ops *ops)
 {
-        u32 rem;
+        s32 rem;
 
         if (ofs + ops->len > mtd->size)
                 goto invalid_arg;
@@ -173,7 +174,7 @@ static int goldfish_nand_write_oob(struct mtd_info *mtd, loff_t ofs,
         if (ops->ooblen + ops->ooboffs > mtd->oobsize)
                 goto invalid_arg;
 
-        rem = do_div(ofs, mtd->writesize);
+        ofs = div_s64_rem(ofs, mtd->writesize, &rem);
         if (rem)
                 goto invalid_arg;
         ofs *= (mtd->writesize + mtd->oobsize);
@@ -196,12 +197,12 @@ invalid_arg:
 static int goldfish_nand_read(struct mtd_info *mtd, loff_t from, size_t len,
                               size_t *retlen, u_char *buf)
 {
-        u32 rem;
+        s32 rem;
 
         if (from + len > mtd->size)
                 goto invalid_arg;
 
-        rem = do_div(from, mtd->writesize);
+        from = div_s64_rem(from, mtd->writesize, &rem);
         if (rem)
                 goto invalid_arg;
         from *= (mtd->writesize + mtd->oobsize);
@@ -218,12 +219,12 @@ invalid_arg:
 static int goldfish_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
                                size_t *retlen, const u_char *buf)
 {
-        u32 rem;
+        s32 rem;
 
         if (to + len > mtd->size)
                 goto invalid_arg;
 
-        rem = do_div(to, mtd->writesize);
+        to = div_s64_rem(to, mtd->writesize, &rem);
         if (rem)
                 goto invalid_arg;
         to *= (mtd->writesize + mtd->oobsize);
@@ -239,12 +240,12 @@ invalid_arg:
 
 static int goldfish_nand_block_isbad(struct mtd_info *mtd, loff_t ofs)
 {
-        u32 rem;
+        s32 rem;
 
         if (ofs >= mtd->size)
                 goto invalid_arg;
 
-        rem = do_div(ofs, mtd->erasesize);
+        ofs = div_s64_rem(ofs, mtd->writesize, &rem);
         if (rem)
                 goto invalid_arg;
         ofs *= mtd->erasesize / mtd->writesize;
@@ -260,12 +261,12 @@ invalid_arg:
 
 static int goldfish_nand_block_markbad(struct mtd_info *mtd, loff_t ofs)
 {
-        u32 rem;
+        s32 rem;
 
         if (ofs >= mtd->size)
                 goto invalid_arg;
 
-        rem = do_div(ofs, mtd->erasesize);
+        ofs = div_s64_rem(ofs, mtd->writesize, &rem);
         if (rem)
                 goto invalid_arg;
         ofs *= mtd->erasesize / mtd->writesize;
@@ -284,17 +285,18 @@ invalid_arg:
 static int nand_setup_cmd_params(struct platform_device *pdev,
                                  struct goldfish_nand *nand)
 {
-        u64 paddr;
+        dma_addr_t dma_handle;
         unsigned char __iomem  *base = nand->base;
 
-        nand->cmd_params = devm_kzalloc(&pdev->dev,
-                                        sizeof(struct cmd_params), GFP_KERNEL);
-        if (!nand->cmd_params)
+        nand->cmd_params = dmam_alloc_coherent(&pdev->dev,
+                                               sizeof(struct cmd_params),
+                                               &dma_handle, GFP_KERNEL);
+        if (!nand->cmd_params) {
+                dev_err(&pdev->dev, "allocate buffer failed\n");
                 return -ENOMEM;
-
-        paddr = __pa(nand->cmd_params);
-        writel((u32)(paddr >> 32), base + NAND_CMD_PARAMS_ADDR_HIGH);
-        writel((u32)paddr, base + NAND_CMD_PARAMS_ADDR_LOW);
+        }
+        writel((u32)((u64)dma_handle >> 32), base + NAND_CMD_PARAMS_ADDR_HIGH);
+        writel((u32)dma_handle, base + NAND_CMD_PARAMS_ADDR_LOW);
         return 0;
 }
 
@@ -319,7 +321,7 @@ static int goldfish_nand_init_device(struct platform_device *pdev,
         mtd->oobavail = mtd->oobsize;
         mtd->erasesize = readl(base + NAND_DEV_ERASE_SIZE) /
                         (mtd->writesize + mtd->oobsize) * mtd->writesize;
-        do_div(mtd->size, mtd->writesize + mtd->oobsize);
+        mtd->size = div_s64(mtd->size, mtd->writesize + mtd->oobsize);
         mtd->size *= mtd->writesize;
         dev_dbg(&pdev->dev,
                 "goldfish nand dev%d: size %llx, page %d, extra %d, erase %d\n",
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 3327c49674d3..713c63d9681b 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -898,7 +898,7 @@ static ssize_t unmap_zeroes_data_store(struct config_item *item,
         da->unmap_zeroes_data = flag;
         pr_debug("dev[%p]: SE Device Thin Provisioning LBPRZ bit: %d\n",
                  da->da_dev, flag);
-        return 0;
+        return count;
 }
 
 /*
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index cacd97a8cbd0..da457e25717a 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -828,6 +828,50 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name)
         return dev;
 }
 
+/*
+ * Check if the underlying struct block_device request_queue supports
+ * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM
+ * in ATA and we need to set TPE=1
+ */
+bool target_configure_unmap_from_queue(struct se_dev_attrib *attrib,
+                                       struct request_queue *q, int block_size)
+{
+        if (!blk_queue_discard(q))
+                return false;
+
+        attrib->max_unmap_lba_count = (q->limits.max_discard_sectors << 9) /
+                                                                block_size;
+        /*
+         * Currently hardcoded to 1 in Linux/SCSI code..
+         */
+        attrib->max_unmap_block_desc_count = 1;
+        attrib->unmap_granularity = q->limits.discard_granularity / block_size;
+        attrib->unmap_granularity_alignment = q->limits.discard_alignment /
+                                                                block_size;
+        attrib->unmap_zeroes_data = q->limits.discard_zeroes_data;
+        return true;
+}
+EXPORT_SYMBOL(target_configure_unmap_from_queue);
+
+/*
+ * Convert from blocksize advertised to the initiator to the 512 byte
+ * units unconditionally used by the Linux block layer.
+ */
+sector_t target_to_linux_sector(struct se_device *dev, sector_t lb)
+{
+        switch (dev->dev_attrib.block_size) {
+        case 4096:
+                return lb << 3;
+        case 2048:
+                return lb << 2;
+        case 1024:
+                return lb << 1;
+        default:
+                return lb;
+        }
+}
+EXPORT_SYMBOL(target_to_linux_sector);
+
 int target_configure_device(struct se_device *dev)
 {
         struct se_hba *hba = dev->se_hba;
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index e3195700211a..75f0f08b2a34 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -160,25 +160,11 @@ static int fd_configure_device(struct se_device *dev)
                         " block_device blocks: %llu logical_block_size: %d\n",
                         dev_size, div_u64(dev_size, fd_dev->fd_block_size),
                         fd_dev->fd_block_size);
-                /*
-                 * Check if the underlying struct block_device request_queue supports
-                 * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM
-                 * in ATA and we need to set TPE=1
-                 */
-                if (blk_queue_discard(q)) {
-                        dev->dev_attrib.max_unmap_lba_count =
-                                q->limits.max_discard_sectors;
-                        /*
-                         * Currently hardcoded to 1 in Linux/SCSI code..
-                         */
-                        dev->dev_attrib.max_unmap_block_desc_count = 1;
-                        dev->dev_attrib.unmap_granularity =
-                                q->limits.discard_granularity >> 9;
-                        dev->dev_attrib.unmap_granularity_alignment =
-                                q->limits.discard_alignment;
+
+                if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
+                                                      fd_dev->fd_block_size))
                         pr_debug("IFILE: BLOCK Discard support available,"
-                                        " disabled by default\n");
-                }
+                                 " disabled by default\n");
                 /*
                  * Enable write same emulation for IBLOCK and use 0xFFFF as
                  * the smaller WRITE_SAME(10) only has a two-byte block count.
@@ -490,9 +476,12 @@ fd_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb)
         if (S_ISBLK(inode->i_mode)) {
                 /* The backend is block device, use discard */
                 struct block_device *bdev = inode->i_bdev;
+                struct se_device *dev = cmd->se_dev;
 
-                ret = blkdev_issue_discard(bdev, lba,
-                                nolb, GFP_KERNEL, 0);
+                ret = blkdev_issue_discard(bdev,
+                                           target_to_linux_sector(dev, lba),
+                                           target_to_linux_sector(dev,  nolb),
+                                           GFP_KERNEL, 0);
                 if (ret < 0) {
                         pr_warn("FILEIO: blkdev_issue_discard() failed: %d\n",
                                 ret);
diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c
index 5a2899f9f50b..abe4eb997a84 100644
--- a/drivers/target/target_core_iblock.c
+++ b/drivers/target/target_core_iblock.c
@@ -121,29 +121,11 @@ static int iblock_configure_device(struct se_device *dev)
         dev->dev_attrib.hw_max_sectors = queue_max_hw_sectors(q);
         dev->dev_attrib.hw_queue_depth = q->nr_requests;
 
-        /*
-         * Check if the underlying struct block_device request_queue supports
-         * the QUEUE_FLAG_DISCARD bit for UNMAP/WRITE_SAME in SCSI + TRIM
-         * in ATA and we need to set TPE=1
-         */
-        if (blk_queue_discard(q)) {
-                dev->dev_attrib.max_unmap_lba_count =
-                                q->limits.max_discard_sectors;
-
-                /*
-                 * Currently hardcoded to 1 in Linux/SCSI code..
-                 */
-                dev->dev_attrib.max_unmap_block_desc_count = 1;
-                dev->dev_attrib.unmap_granularity =
-                                q->limits.discard_granularity >> 9;
-                dev->dev_attrib.unmap_granularity_alignment =
-                                q->limits.discard_alignment;
-                dev->dev_attrib.unmap_zeroes_data =
-                                q->limits.discard_zeroes_data;
-
+        if (target_configure_unmap_from_queue(&dev->dev_attrib, q,
+                                              dev->dev_attrib.hw_block_size))
                 pr_debug("IBLOCK: BLOCK Discard support available,"
-                                " disabled by default\n");
-        }
+                         " disabled by default\n");
+
         /*
          * Enable write same emulation for IBLOCK and use 0xFFFF as
          * the smaller WRITE_SAME(10) only has a two-byte block count.
@@ -415,9 +397,13 @@ static sense_reason_t
 iblock_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb)
 {
         struct block_device *bdev = IBLOCK_DEV(cmd->se_dev)->ibd_bd;
+        struct se_device *dev = cmd->se_dev;
         int ret;
 
-        ret = blkdev_issue_discard(bdev, lba, nolb, GFP_KERNEL, 0);
+        ret = blkdev_issue_discard(bdev,
+                                   target_to_linux_sector(dev, lba),
+                                   target_to_linux_sector(dev,  nolb),
+                                   GFP_KERNEL, 0);
         if (ret < 0) {
                 pr_err("blkdev_issue_discard() failed: %d\n", ret);
                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
@@ -433,8 +419,10 @@ iblock_execute_write_same(struct se_cmd *cmd)
         struct scatterlist *sg;
         struct bio *bio;
         struct bio_list list;
-        sector_t block_lba = cmd->t_task_lba;
-        sector_t sectors = sbc_get_write_same_sectors(cmd);
+        struct se_device *dev = cmd->se_dev;
+        sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba);
+        sector_t sectors = target_to_linux_sector(dev,
+                                        sbc_get_write_same_sectors(cmd));
 
         if (cmd->prot_op) {
                 pr_err("WRITE_SAME: Protection information with IBLOCK"
@@ -648,12 +636,12 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                   enum dma_data_direction data_direction)
 {
         struct se_device *dev = cmd->se_dev;
+        sector_t block_lba = target_to_linux_sector(dev, cmd->t_task_lba);
         struct iblock_req *ibr;
         struct bio *bio, *bio_start;
         struct bio_list list;
         struct scatterlist *sg;
         u32 sg_num = sgl_nents;
-        sector_t block_lba;
         unsigned bio_cnt;
         int rw = 0;
         int i;
@@ -679,24 +667,6 @@ iblock_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
                 rw = READ;
         }
 
-        /*
-         * Convert the blocksize advertised to the initiator to the 512 byte
-         * units unconditionally used by the Linux block layer.
-         */
-        if (dev->dev_attrib.block_size == 4096)
-                block_lba = (cmd->t_task_lba << 3);
-        else if (dev->dev_attrib.block_size == 2048)
-                block_lba = (cmd->t_task_lba << 2);
-        else if (dev->dev_attrib.block_size == 1024)
-                block_lba = (cmd->t_task_lba << 1);
-        else if (dev->dev_attrib.block_size == 512)
-                block_lba = cmd->t_task_lba;
-        else {
-                pr_err("Unsupported SCSI -> BLOCK LBA conversion:"
-                                " %u\n", dev->dev_attrib.block_size);
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-        }
-
         ibr = kzalloc(sizeof(struct iblock_req), GFP_KERNEL);
         if (!ibr)
                 goto fail;
diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h
index dae0750c2032..db4412fe6b8a 100644
--- a/drivers/target/target_core_internal.h
+++ b/drivers/target/target_core_internal.h
@@ -141,7 +141,6 @@ void	transport_dump_vpd_proto_id(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_assoc(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_ident_type(struct t10_vpd *, unsigned char *, int);
 int     transport_dump_vpd_ident(struct t10_vpd *, unsigned char *, int);
-bool    target_stop_cmd(struct se_cmd *cmd, unsigned long *flags);
 void    transport_clear_lun_ref(struct se_lun *);
 void    transport_send_task_abort(struct se_cmd *);
 sense_reason_t  target_cmd_size_check(struct se_cmd *cmd, unsigned int size);
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index fcdcb117c60d..82a663ba9800 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -68,23 +68,25 @@ void core_tmr_release_req(struct se_tmr_req *tmr)
 
         if (dev) {
                 spin_lock_irqsave(&dev->se_tmr_lock, flags);
-                list_del(&tmr->tmr_list);
+                list_del_init(&tmr->tmr_list);
                 spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
         }
 
         kfree(tmr);
 }
 
-static void core_tmr_handle_tas_abort(
-        struct se_node_acl *tmr_nacl,
-        struct se_cmd *cmd,
-        int tas)
+static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas)
 {
-        bool remove = true;
+        unsigned long flags;
+        bool remove = true, send_tas;
         /*
          * TASK ABORTED status (TAS) bit support
          */
-        if ((tmr_nacl && (tmr_nacl != cmd->se_sess->se_node_acl)) && tas) {
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        send_tas = (cmd->transport_state & CMD_T_TAS);
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
+        if (send_tas) {
                 remove = false;
                 transport_send_task_abort(cmd);
         }
@@ -107,6 +109,46 @@ static int target_check_cdb_and_preempt(struct list_head *list,
         return 1;
 }
 
+static bool __target_check_io_state(struct se_cmd *se_cmd,
+                                    struct se_session *tmr_sess, int tas)
+{
+        struct se_session *sess = se_cmd->se_sess;
+
+        assert_spin_locked(&sess->sess_cmd_lock);
+        WARN_ON_ONCE(!irqs_disabled());
+        /*
+         * If command already reached CMD_T_COMPLETE state within
+         * target_complete_cmd() or CMD_T_FABRIC_STOP due to shutdown,
+         * this se_cmd has been passed to fabric driver and will
+         * not be aborted.
+         *
+         * Otherwise, obtain a local se_cmd->cmd_kref now for TMR
+         * ABORT_TASK + LUN_RESET for CMD_T_ABORTED processing as
+         * long as se_cmd->cmd_kref is still active unless zero.
+         */
+        spin_lock(&se_cmd->t_state_lock);
+        if (se_cmd->transport_state & (CMD_T_COMPLETE | CMD_T_FABRIC_STOP)) {
+                pr_debug("Attempted to abort io tag: %llu already complete or"
+                        " fabric stop, skipping\n", se_cmd->tag);
+                spin_unlock(&se_cmd->t_state_lock);
+                return false;
+        }
+        if (sess->sess_tearing_down || se_cmd->cmd_wait_set) {
+                pr_debug("Attempted to abort io tag: %llu already shutdown,"
+                        " skipping\n", se_cmd->tag);
+                spin_unlock(&se_cmd->t_state_lock);
+                return false;
+        }
+        se_cmd->transport_state |= CMD_T_ABORTED;
+
+        if ((tmr_sess != se_cmd->se_sess) && tas)
+                se_cmd->transport_state |= CMD_T_TAS;
+
+        spin_unlock(&se_cmd->t_state_lock);
+
+        return kref_get_unless_zero(&se_cmd->cmd_kref);
+}
+
 void core_tmr_abort_task(
         struct se_device *dev,
         struct se_tmr_req *tmr,
@@ -130,34 +172,22 @@ void core_tmr_abort_task(
                 if (tmr->ref_task_tag != ref_tag)
                         continue;
 
-                if (!kref_get_unless_zero(&se_cmd->cmd_kref))
-                        continue;
-
                 printk("ABORT_TASK: Found referenced %s task_tag: %llu\n",
                         se_cmd->se_tfo->get_fabric_name(), ref_tag);
 
-                spin_lock(&se_cmd->t_state_lock);
-                if (se_cmd->transport_state & CMD_T_COMPLETE) {
-                        printk("ABORT_TASK: ref_tag: %llu already complete,"
-                               " skipping\n", ref_tag);
-                        spin_unlock(&se_cmd->t_state_lock);
+                if (!__target_check_io_state(se_cmd, se_sess, 0)) {
                         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-
                         target_put_sess_cmd(se_cmd);
-
                         goto out;
                 }
-                se_cmd->transport_state |= CMD_T_ABORTED;
-                spin_unlock(&se_cmd->t_state_lock);
-
                 list_del_init(&se_cmd->se_cmd_list);
                 spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 
                 cancel_work_sync(&se_cmd->work);
                 transport_wait_for_tasks(se_cmd);
 
-                target_put_sess_cmd(se_cmd);
                 transport_cmd_finish_abort(se_cmd, true);
+                target_put_sess_cmd(se_cmd);
 
                 printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for"
                                 " ref_tag: %llu\n", ref_tag);
@@ -178,9 +208,11 @@ static void core_tmr_drain_tmr_list(
         struct list_head *preempt_and_abort_list)
 {
         LIST_HEAD(drain_tmr_list);
+        struct se_session *sess;
         struct se_tmr_req *tmr_p, *tmr_pp;
         struct se_cmd *cmd;
         unsigned long flags;
+        bool rc;
         /*
          * Release all pending and outgoing TMRs aside from the received
          * LUN_RESET tmr..
@@ -206,17 +238,39 @@ static void core_tmr_drain_tmr_list(
                 if (target_check_cdb_and_preempt(preempt_and_abort_list, cmd))
                         continue;
 
+                sess = cmd->se_sess;
+                if (WARN_ON_ONCE(!sess))
+                        continue;
+
+                spin_lock(&sess->sess_cmd_lock);
                 spin_lock(&cmd->t_state_lock);
-                if (!(cmd->transport_state & CMD_T_ACTIVE)) {
+                if (!(cmd->transport_state & CMD_T_ACTIVE) ||
+                     (cmd->transport_state & CMD_T_FABRIC_STOP)) {
                         spin_unlock(&cmd->t_state_lock);
+                        spin_unlock(&sess->sess_cmd_lock);
                         continue;
                 }
                 if (cmd->t_state == TRANSPORT_ISTATE_PROCESSING) {
                         spin_unlock(&cmd->t_state_lock);
+                        spin_unlock(&sess->sess_cmd_lock);
                         continue;
                 }
+                if (sess->sess_tearing_down || cmd->cmd_wait_set) {
+                        spin_unlock(&cmd->t_state_lock);
+                        spin_unlock(&sess->sess_cmd_lock);
+                        continue;
+                }
+                cmd->transport_state |= CMD_T_ABORTED;
                 spin_unlock(&cmd->t_state_lock);
 
+                rc = kref_get_unless_zero(&cmd->cmd_kref);
+                if (!rc) {
+                        printk("LUN_RESET TMR: non-zero kref_get_unless_zero\n");
+                        spin_unlock(&sess->sess_cmd_lock);
+                        continue;
+                }
+                spin_unlock(&sess->sess_cmd_lock);
+
                 list_move_tail(&tmr_p->tmr_list, &drain_tmr_list);
         }
         spin_unlock_irqrestore(&dev->se_tmr_lock, flags);
@@ -230,20 +284,26 @@ static void core_tmr_drain_tmr_list(
                         (preempt_and_abort_list) ? "Preempt" : "", tmr_p,
                         tmr_p->function, tmr_p->response, cmd->t_state);
 
+                cancel_work_sync(&cmd->work);
+                transport_wait_for_tasks(cmd);
+
                 transport_cmd_finish_abort(cmd, 1);
+                target_put_sess_cmd(cmd);
         }
 }
 
 static void core_tmr_drain_state_list(
         struct se_device *dev,
         struct se_cmd *prout_cmd,
-        struct se_node_acl *tmr_nacl,
+        struct se_session *tmr_sess,
         int tas,
         struct list_head *preempt_and_abort_list)
 {
         LIST_HEAD(drain_task_list);
+        struct se_session *sess;
         struct se_cmd *cmd, *next;
         unsigned long flags;
+        int rc;
 
         /*
          * Complete outstanding commands with TASK_ABORTED SAM status.
@@ -282,6 +342,16 @@ static void core_tmr_drain_state_list(
                 if (prout_cmd == cmd)
                         continue;
 
+                sess = cmd->se_sess;
+                if (WARN_ON_ONCE(!sess))
+                        continue;
+
+                spin_lock(&sess->sess_cmd_lock);
+                rc = __target_check_io_state(cmd, tmr_sess, tas);
+                spin_unlock(&sess->sess_cmd_lock);
+                if (!rc)
+                        continue;
+
                 list_move_tail(&cmd->state_list, &drain_task_list);
                 cmd->state_active = false;
         }
@@ -289,7 +359,7 @@ static void core_tmr_drain_state_list(
 
         while (!list_empty(&drain_task_list)) {
                 cmd = list_entry(drain_task_list.next, struct se_cmd, state_list);
-                list_del(&cmd->state_list);
+                list_del_init(&cmd->state_list);
 
                 pr_debug("LUN_RESET: %s cmd: %p"
                         " ITT/CmdSN: 0x%08llx/0x%08x, i_state: %d, t_state: %d"
@@ -313,16 +383,11 @@ static void core_tmr_drain_state_list(
                  * loop above, but we do it down here given that
                  * cancel_work_sync may block.
                  */
-                if (cmd->t_state == TRANSPORT_COMPLETE)
-                        cancel_work_sync(&cmd->work);
-
-                spin_lock_irqsave(&cmd->t_state_lock, flags);
-                target_stop_cmd(cmd, &flags);
-
-                cmd->transport_state |= CMD_T_ABORTED;
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                cancel_work_sync(&cmd->work);
+                transport_wait_for_tasks(cmd);
 
-                core_tmr_handle_tas_abort(tmr_nacl, cmd, tas);
+                core_tmr_handle_tas_abort(cmd, tas);
+                target_put_sess_cmd(cmd);
         }
 }
 
@@ -334,6 +399,7 @@ int core_tmr_lun_reset(
 {
         struct se_node_acl *tmr_nacl = NULL;
         struct se_portal_group *tmr_tpg = NULL;
+        struct se_session *tmr_sess = NULL;
         int tas;
         /*
          * TASK_ABORTED status bit, this is configurable via ConfigFS
@@ -352,8 +418,9 @@ int core_tmr_lun_reset(
          * or struct se_device passthrough..
          */
         if (tmr && tmr->task_cmd && tmr->task_cmd->se_sess) {
-                tmr_nacl = tmr->task_cmd->se_sess->se_node_acl;
-                tmr_tpg = tmr->task_cmd->se_sess->se_tpg;
+                tmr_sess = tmr->task_cmd->se_sess;
+                tmr_nacl = tmr_sess->se_node_acl;
+                tmr_tpg = tmr_sess->se_tpg;
                 if (tmr_nacl && tmr_tpg) {
                         pr_debug("LUN_RESET: TMR caller fabric: %s"
                                 " initiator port %s\n",
@@ -366,7 +433,7 @@ int core_tmr_lun_reset(
                 dev->transport->name, tas);
 
         core_tmr_drain_tmr_list(dev, tmr, preempt_and_abort_list);
-        core_tmr_drain_state_list(dev, prout_cmd, tmr_nacl, tas,
+        core_tmr_drain_state_list(dev, prout_cmd, tmr_sess, tas,
                                 preempt_and_abort_list);
 
         /*
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 9f3608e10f25..867bc6d0a68a 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -534,9 +534,6 @@ void transport_deregister_session(struct se_session *se_sess)
 }
 EXPORT_SYMBOL(transport_deregister_session);
 
-/*
- * Called with cmd->t_state_lock held.
- */
 static void target_remove_from_state_list(struct se_cmd *cmd)
 {
         struct se_device *dev = cmd->se_dev;
@@ -561,10 +558,6 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists,
 {
         unsigned long flags;
 
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
-        if (write_pending)
-                cmd->t_state = TRANSPORT_WRITE_PENDING;
-
         if (remove_from_lists) {
                 target_remove_from_state_list(cmd);
 
@@ -574,6 +567,10 @@ static int transport_cmd_check_stop(struct se_cmd *cmd, bool remove_from_lists,
                 cmd->se_lun = NULL;
         }
 
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        if (write_pending)
+                cmd->t_state = TRANSPORT_WRITE_PENDING;
+
         /*
          * Determine if frontend context caller is requesting the stopping of
          * this command for frontend exceptions.
@@ -627,6 +624,8 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd)
 
 void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 {
+        bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF);
+
         if (cmd->se_cmd_flags & SCF_SE_LUN_CMD)
                 transport_lun_remove_cmd(cmd);
         /*
@@ -638,7 +637,7 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 
         if (transport_cmd_check_stop_to_fabric(cmd))
                 return;
-        if (remove)
+        if (remove && ack_kref)
                 transport_put_cmd(cmd);
 }
 
@@ -694,19 +693,10 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
         }
 
         /*
-         * See if we are waiting to complete for an exception condition.
-         */
-        if (cmd->transport_state & CMD_T_REQUEST_STOP) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                complete(&cmd->task_stop_comp);
-                return;
-        }
-
-        /*
          * Check for case where an explicit ABORT_TASK has been received
          * and transport_wait_for_tasks() will be waiting for completion..
          */
-        if (cmd->transport_state & CMD_T_ABORTED &&
+        if (cmd->transport_state & CMD_T_ABORTED ||
             cmd->transport_state & CMD_T_STOP) {
                 spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                 complete_all(&cmd->t_transport_stop_comp);
@@ -721,10 +711,10 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status)
         cmd->transport_state |= (CMD_T_COMPLETE | CMD_T_ACTIVE);
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
-        if (cmd->cpuid == -1)
-                queue_work(target_completion_wq, &cmd->work);
-        else
+        if (cmd->se_cmd_flags & SCF_USE_CPUID)
                 queue_work_on(cmd->cpuid, target_completion_wq, &cmd->work);
+        else
+                queue_work(target_completion_wq, &cmd->work);
 }
 EXPORT_SYMBOL(target_complete_cmd);
 
@@ -1203,7 +1193,6 @@ void transport_init_se_cmd(
         INIT_LIST_HEAD(&cmd->state_list);
         init_completion(&cmd->t_transport_stop_comp);
         init_completion(&cmd->cmd_wait_comp);
-        init_completion(&cmd->task_stop_comp);
         spin_lock_init(&cmd->t_state_lock);
         kref_init(&cmd->cmd_kref);
         cmd->transport_state = CMD_T_DEV_ACTIVE;
@@ -1437,6 +1426,12 @@ int target_submit_cmd_map_sgls(struct se_cmd *se_cmd, struct se_session *se_sess
          */
         transport_init_se_cmd(se_cmd, se_tpg->se_tpg_tfo, se_sess,
                                 data_length, data_dir, task_attr, sense);
+
+        if (flags & TARGET_SCF_USE_CPUID)
+                se_cmd->se_cmd_flags |= SCF_USE_CPUID;
+        else
+                se_cmd->cpuid = WORK_CPU_UNBOUND;
+
         if (flags & TARGET_SCF_UNKNOWN_SIZE)
                 se_cmd->unknown_data_length = 1;
         /*
@@ -1635,33 +1630,6 @@ int target_submit_tmr(struct se_cmd *se_cmd, struct se_session *se_sess,
 EXPORT_SYMBOL(target_submit_tmr);
 
 /*
- * If the cmd is active, request it to be stopped and sleep until it
- * has completed.
- */
-bool target_stop_cmd(struct se_cmd *cmd, unsigned long *flags)
-        __releases(&cmd->t_state_lock)
-        __acquires(&cmd->t_state_lock)
-{
-        bool was_active = false;
-
-        if (cmd->transport_state & CMD_T_BUSY) {
-                cmd->transport_state |= CMD_T_REQUEST_STOP;
-                spin_unlock_irqrestore(&cmd->t_state_lock, *flags);
-
-                pr_debug("cmd %p waiting to complete\n", cmd);
-                wait_for_completion(&cmd->task_stop_comp);
-                pr_debug("cmd %p stopped successfully\n", cmd);
-
-                spin_lock_irqsave(&cmd->t_state_lock, *flags);
-                cmd->transport_state &= ~CMD_T_REQUEST_STOP;
-                cmd->transport_state &= ~CMD_T_BUSY;
-                was_active = true;
-        }
-
-        return was_active;
-}
-
-/*
  * Handle SAM-esque emulation for generic transport request failures.
  */
 void transport_generic_request_failure(struct se_cmd *cmd,
@@ -1859,19 +1827,21 @@ static bool target_handle_task_attr(struct se_cmd *cmd)
         return true;
 }
 
+static int __transport_check_aborted_status(struct se_cmd *, int);
+
 void target_execute_cmd(struct se_cmd *cmd)
 {
         /*
-         * If the received CDB has aleady been aborted stop processing it here.
-         */
-        if (transport_check_aborted_status(cmd, 1))
-                return;
-
-        /*
          * Determine if frontend context caller is requesting the stopping of
          * this command for frontend exceptions.
+         *
+         * If the received CDB has aleady been aborted stop processing it here.
          */
         spin_lock_irq(&cmd->t_state_lock);
+        if (__transport_check_aborted_status(cmd, 1)) {
+                spin_unlock_irq(&cmd->t_state_lock);
+                return;
+        }
         if (cmd->transport_state & CMD_T_STOP) {
                 pr_debug("%s:%d CMD_T_STOP for ITT: 0x%08llx\n",
                         __func__, __LINE__, cmd->tag);
@@ -2222,20 +2192,14 @@ static inline void transport_free_pages(struct se_cmd *cmd)
 }
 
 /**
- * transport_release_cmd - free a command
- * @cmd:       command to free
+ * transport_put_cmd - release a reference to a command
+ * @cmd:       command to release
  *
- * This routine unconditionally frees a command, and reference counting
- * or list removal must be done in the caller.
+ * This routine releases our reference to the command and frees it if possible.
  */
-static int transport_release_cmd(struct se_cmd *cmd)
+static int transport_put_cmd(struct se_cmd *cmd)
 {
         BUG_ON(!cmd->se_tfo);
-
-        if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
-                core_tmr_release_req(cmd->se_tmr_req);
-        if (cmd->t_task_cdb != cmd->__t_task_cdb)
-                kfree(cmd->t_task_cdb);
         /*
          * If this cmd has been setup with target_get_sess_cmd(), drop
          * the kref and call ->release_cmd() in kref callback.
@@ -2243,18 +2207,6 @@ static int transport_release_cmd(struct se_cmd *cmd)
         return target_put_sess_cmd(cmd);
 }
 
-/**
- * transport_put_cmd - release a reference to a command
- * @cmd:       command to release
- *
- * This routine releases our reference to the command and frees it if possible.
- */
-static int transport_put_cmd(struct se_cmd *cmd)
-{
-        transport_free_pages(cmd);
-        return transport_release_cmd(cmd);
-}
-
 void *transport_kmap_data_sg(struct se_cmd *cmd)
 {
         struct scatterlist *sg = cmd->t_data_sg;
@@ -2450,34 +2402,58 @@ static void transport_write_pending_qf(struct se_cmd *cmd)
         }
 }
 
-int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
+static bool
+__transport_wait_for_tasks(struct se_cmd *, bool, bool *, bool *,
+                           unsigned long *flags);
+
+static void target_wait_free_cmd(struct se_cmd *cmd, bool *aborted, bool *tas)
 {
         unsigned long flags;
+
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        __transport_wait_for_tasks(cmd, true, aborted, tas, &flags);
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+}
+
+int transport_generic_free_cmd(struct se_cmd *cmd, int wait_for_tasks)
+{
         int ret = 0;
+        bool aborted = false, tas = false;
 
         if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD)) {
                 if (wait_for_tasks && (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
-                         transport_wait_for_tasks(cmd);
+                        target_wait_free_cmd(cmd, &aborted, &tas);
 
-                ret = transport_release_cmd(cmd);
+                if (!aborted || tas)
+                        ret = transport_put_cmd(cmd);
         } else {
                 if (wait_for_tasks)
-                        transport_wait_for_tasks(cmd);
+                        target_wait_free_cmd(cmd, &aborted, &tas);
                 /*
                  * Handle WRITE failure case where transport_generic_new_cmd()
                  * has already added se_cmd to state_list, but fabric has
                  * failed command before I/O submission.
                  */
-                if (cmd->state_active) {
-                        spin_lock_irqsave(&cmd->t_state_lock, flags);
+                if (cmd->state_active)
                         target_remove_from_state_list(cmd);
-                        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
-                }
 
                 if (cmd->se_lun)
                         transport_lun_remove_cmd(cmd);
 
-                ret = transport_put_cmd(cmd);
+                if (!aborted || tas)
+                        ret = transport_put_cmd(cmd);
+        }
+        /*
+         * If the task has been internally aborted due to TMR ABORT_TASK
+         * or LUN_RESET, target_core_tmr.c is responsible for performing
+         * the remaining calls to target_put_sess_cmd(), and not the
+         * callers of this function.
+         */
+        if (aborted) {
+                pr_debug("Detected CMD_T_ABORTED for ITT: %llu\n", cmd->tag);
+                wait_for_completion(&cmd->cmd_wait_comp);
+                cmd->se_tfo->release_cmd(cmd);
+                ret = 1;
         }
         return ret;
 }
@@ -2517,26 +2493,46 @@ out:
 }
 EXPORT_SYMBOL(target_get_sess_cmd);
 
+static void target_free_cmd_mem(struct se_cmd *cmd)
+{
+        transport_free_pages(cmd);
+
+        if (cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)
+                core_tmr_release_req(cmd->se_tmr_req);
+        if (cmd->t_task_cdb != cmd->__t_task_cdb)
+                kfree(cmd->t_task_cdb);
+}
+
 static void target_release_cmd_kref(struct kref *kref)
 {
         struct se_cmd *se_cmd = container_of(kref, struct se_cmd, cmd_kref);
         struct se_session *se_sess = se_cmd->se_sess;
         unsigned long flags;
+        bool fabric_stop;
 
         spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
         if (list_empty(&se_cmd->se_cmd_list)) {
                 spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+                target_free_cmd_mem(se_cmd);
                 se_cmd->se_tfo->release_cmd(se_cmd);
                 return;
         }
-        if (se_sess->sess_tearing_down && se_cmd->cmd_wait_set) {
+
+        spin_lock(&se_cmd->t_state_lock);
+        fabric_stop = (se_cmd->transport_state & CMD_T_FABRIC_STOP);
+        spin_unlock(&se_cmd->t_state_lock);
+
+        if (se_cmd->cmd_wait_set || fabric_stop) {
+                list_del_init(&se_cmd->se_cmd_list);
                 spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
+                target_free_cmd_mem(se_cmd);
                 complete(&se_cmd->cmd_wait_comp);
                 return;
         }
-        list_del(&se_cmd->se_cmd_list);
+        list_del_init(&se_cmd->se_cmd_list);
         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 
+        target_free_cmd_mem(se_cmd);
         se_cmd->se_tfo->release_cmd(se_cmd);
 }
 
@@ -2548,6 +2544,7 @@ int target_put_sess_cmd(struct se_cmd *se_cmd)
         struct se_session *se_sess = se_cmd->se_sess;
 
         if (!se_sess) {
+                target_free_cmd_mem(se_cmd);
                 se_cmd->se_tfo->release_cmd(se_cmd);
                 return 1;
         }
@@ -2564,6 +2561,7 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
 {
         struct se_cmd *se_cmd;
         unsigned long flags;
+        int rc;
 
         spin_lock_irqsave(&se_sess->sess_cmd_lock, flags);
         if (se_sess->sess_tearing_down) {
@@ -2573,8 +2571,15 @@ void target_sess_cmd_list_set_waiting(struct se_session *se_sess)
         se_sess->sess_tearing_down = 1;
         list_splice_init(&se_sess->sess_cmd_list, &se_sess->sess_wait_list);
 
-        list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list)
-                se_cmd->cmd_wait_set = 1;
+        list_for_each_entry(se_cmd, &se_sess->sess_wait_list, se_cmd_list) {
+                rc = kref_get_unless_zero(&se_cmd->cmd_kref);
+                if (rc) {
+                        se_cmd->cmd_wait_set = 1;
+                        spin_lock(&se_cmd->t_state_lock);
+                        se_cmd->transport_state |= CMD_T_FABRIC_STOP;
+                        spin_unlock(&se_cmd->t_state_lock);
+                }
+        }
 
         spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
 }
@@ -2587,15 +2592,25 @@ void target_wait_for_sess_cmds(struct se_session *se_sess)
 {
         struct se_cmd *se_cmd, *tmp_cmd;
         unsigned long flags;
+        bool tas;
 
         list_for_each_entry_safe(se_cmd, tmp_cmd,
                                 &se_sess->sess_wait_list, se_cmd_list) {
-                list_del(&se_cmd->se_cmd_list);
+                list_del_init(&se_cmd->se_cmd_list);
 
                 pr_debug("Waiting for se_cmd: %p t_state: %d, fabric state:"
                         " %d\n", se_cmd, se_cmd->t_state,
                         se_cmd->se_tfo->get_cmd_state(se_cmd));
 
+                spin_lock_irqsave(&se_cmd->t_state_lock, flags);
+                tas = (se_cmd->transport_state & CMD_T_TAS);
+                spin_unlock_irqrestore(&se_cmd->t_state_lock, flags);
+
+                if (!target_put_sess_cmd(se_cmd)) {
+                        if (tas)
+                                target_put_sess_cmd(se_cmd);
+                }
+
                 wait_for_completion(&se_cmd->cmd_wait_comp);
                 pr_debug("After cmd_wait_comp: se_cmd: %p t_state: %d"
                         " fabric state: %d\n", se_cmd, se_cmd->t_state,
@@ -2617,53 +2632,75 @@ void transport_clear_lun_ref(struct se_lun *lun)
         wait_for_completion(&lun->lun_ref_comp);
 }
 
-/**
- * transport_wait_for_tasks - wait for completion to occur
- * @cmd:        command to wait
- *
- * Called from frontend fabric context to wait for storage engine
- * to pause and/or release frontend generated struct se_cmd.
- */
-bool transport_wait_for_tasks(struct se_cmd *cmd)
+static bool
+__transport_wait_for_tasks(struct se_cmd *cmd, bool fabric_stop,
+                           bool *aborted, bool *tas, unsigned long *flags)
+        __releases(&cmd->t_state_lock)
+        __acquires(&cmd->t_state_lock)
 {
-        unsigned long flags;
 
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        assert_spin_locked(&cmd->t_state_lock);
+        WARN_ON_ONCE(!irqs_disabled());
+
+        if (fabric_stop)
+                cmd->transport_state |= CMD_T_FABRIC_STOP;
+
+        if (cmd->transport_state & CMD_T_ABORTED)
+                *aborted = true;
+
+        if (cmd->transport_state & CMD_T_TAS)
+                *tas = true;
+
         if (!(cmd->se_cmd_flags & SCF_SE_LUN_CMD) &&
-            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
                 return false;
-        }
 
         if (!(cmd->se_cmd_flags & SCF_SUPPORTED_SAM_OPCODE) &&
-            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB)) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+            !(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
                 return false;
-        }
 
-        if (!(cmd->transport_state & CMD_T_ACTIVE)) {
-                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+        if (!(cmd->transport_state & CMD_T_ACTIVE))
+                return false;
+
+        if (fabric_stop && *aborted)
                 return false;
-        }
 
         cmd->transport_state |= CMD_T_STOP;
 
-        pr_debug("wait_for_tasks: Stopping %p ITT: 0x%08llx i_state: %d, t_state: %d, CMD_T_STOP\n",
-                cmd, cmd->tag, cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
+        pr_debug("wait_for_tasks: Stopping %p ITT: 0x%08llx i_state: %d,"
+                 " t_state: %d, CMD_T_STOP\n", cmd, cmd->tag,
+                 cmd->se_tfo->get_cmd_state(cmd), cmd->t_state);
 
-        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+        spin_unlock_irqrestore(&cmd->t_state_lock, *flags);
 
         wait_for_completion(&cmd->t_transport_stop_comp);
 
-        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        spin_lock_irqsave(&cmd->t_state_lock, *flags);
         cmd->transport_state &= ~(CMD_T_ACTIVE | CMD_T_STOP);
 
-        pr_debug("wait_for_tasks: Stopped wait_for_completion(&cmd->t_transport_stop_comp) for ITT: 0x%08llx\n",
-                cmd->tag);
+        pr_debug("wait_for_tasks: Stopped wait_for_completion(&cmd->"
+                 "t_transport_stop_comp) for ITT: 0x%08llx\n", cmd->tag);
 
+        return true;
+}
+
+/**
+ * transport_wait_for_tasks - wait for completion to occur
+ * @cmd:        command to wait
+ *
+ * Called from frontend fabric context to wait for storage engine
+ * to pause and/or release frontend generated struct se_cmd.
+ */
+bool transport_wait_for_tasks(struct se_cmd *cmd)
+{
+        unsigned long flags;
+        bool ret, aborted = false, tas = false;
+
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        ret = __transport_wait_for_tasks(cmd, false, &aborted, &tas, &flags);
         spin_unlock_irqrestore(&cmd->t_state_lock, flags);
 
-        return true;
+        return ret;
 }
 EXPORT_SYMBOL(transport_wait_for_tasks);
 
@@ -2845,28 +2882,49 @@ transport_send_check_condition_and_sense(struct se_cmd *cmd,
 }
 EXPORT_SYMBOL(transport_send_check_condition_and_sense);
 
-int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+static int __transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+        __releases(&cmd->t_state_lock)
+        __acquires(&cmd->t_state_lock)
 {
+        assert_spin_locked(&cmd->t_state_lock);
+        WARN_ON_ONCE(!irqs_disabled());
+
         if (!(cmd->transport_state & CMD_T_ABORTED))
                 return 0;
-
         /*
          * If cmd has been aborted but either no status is to be sent or it has
          * already been sent, just return
          */
-        if (!send_status || !(cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS))
+        if (!send_status || !(cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS)) {
+                if (send_status)
+                        cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS;
                 return 1;
+        }
 
-        pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB: 0x%02x ITT: 0x%08llx\n",
-                 cmd->t_task_cdb[0], cmd->tag);
+        pr_debug("Sending delayed SAM_STAT_TASK_ABORTED status for CDB:"
+                " 0x%02x ITT: 0x%08llx\n", cmd->t_task_cdb[0], cmd->tag);
 
         cmd->se_cmd_flags &= ~SCF_SEND_DELAYED_TAS;
         cmd->scsi_status = SAM_STAT_TASK_ABORTED;
         trace_target_cmd_complete(cmd);
+
+        spin_unlock_irq(&cmd->t_state_lock);
         cmd->se_tfo->queue_status(cmd);
+        spin_lock_irq(&cmd->t_state_lock);
 
         return 1;
 }
+
+int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+{
+        int ret;
+
+        spin_lock_irq(&cmd->t_state_lock);
+        ret = __transport_check_aborted_status(cmd, send_status);
+        spin_unlock_irq(&cmd->t_state_lock);
+
+        return ret;
+}
 EXPORT_SYMBOL(transport_check_aborted_status);
 
 void transport_send_task_abort(struct se_cmd *cmd)
@@ -2888,11 +2946,17 @@ void transport_send_task_abort(struct se_cmd *cmd)
          */
         if (cmd->data_direction == DMA_TO_DEVICE) {
                 if (cmd->se_tfo->write_pending_status(cmd) != 0) {
-                        cmd->transport_state |= CMD_T_ABORTED;
+                        spin_lock_irqsave(&cmd->t_state_lock, flags);
+                        if (cmd->se_cmd_flags & SCF_SEND_DELAYED_TAS) {
+                                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                                goto send_abort;
+                        }
                         cmd->se_cmd_flags |= SCF_SEND_DELAYED_TAS;
+                        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
                         return;
                 }
         }
+send_abort:
         cmd->scsi_status = SAM_STAT_TASK_ABORTED;
 
         transport_lun_remove_cmd(cmd);
@@ -2909,8 +2973,17 @@ static void target_tmr_work(struct work_struct *work)
         struct se_cmd *cmd = container_of(work, struct se_cmd, work);
         struct se_device *dev = cmd->se_dev;
         struct se_tmr_req *tmr = cmd->se_tmr_req;
+        unsigned long flags;
         int ret;
 
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        if (cmd->transport_state & CMD_T_ABORTED) {
+                tmr->response = TMR_FUNCTION_REJECTED;
+                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                goto check_stop;
+        }
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
         switch (tmr->function) {
         case TMR_ABORT_TASK:
                 core_tmr_abort_task(dev, tmr, cmd->se_sess);
@@ -2943,9 +3016,17 @@ static void target_tmr_work(struct work_struct *work)
                 break;
         }
 
+        spin_lock_irqsave(&cmd->t_state_lock, flags);
+        if (cmd->transport_state & CMD_T_ABORTED) {
+                spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+                goto check_stop;
+        }
         cmd->t_state = TRANSPORT_ISTATE_PROCESSING;
+        spin_unlock_irqrestore(&cmd->t_state_lock, flags);
+
         cmd->se_tfo->queue_tm_rsp(cmd);
 
+check_stop:
         transport_cmd_check_stop_to_fabric(cmd);
 }
 
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index dd600e5ead71..94f5154ac788 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -903,7 +903,7 @@ static int tcmu_configure_device(struct se_device *dev)
         info->version = __stringify(TCMU_MAILBOX_VERSION);
 
         info->mem[0].name = "tcm-user command & data buffer";
-        info->mem[0].addr = (phys_addr_t) udev->mb_addr;
+        info->mem[0].addr = (phys_addr_t)(uintptr_t)udev->mb_addr;
         info->mem[0].size = TCMU_RING_SIZE;
         info->mem[0].memtype = UIO_MEM_VIRTUAL;
 
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index 8cc4ac64a91c..7c92c09be213 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -195,7 +195,7 @@ config IMX_THERMAL
           passive trip is crossed.
 
 config SPEAR_THERMAL
-        bool "SPEAr thermal sensor driver"
+        tristate "SPEAr thermal sensor driver"
         depends on PLAT_SPEAR || COMPILE_TEST
         depends on OF
         help
@@ -237,8 +237,8 @@ config DOVE_THERMAL
           framework.
 
 config DB8500_THERMAL
-        bool "DB8500 thermal management"
-        depends on ARCH_U8500
+        tristate "DB8500 thermal management"
+        depends on MFD_DB8500_PRCMU
         default y
         help
           Adds DB8500 thermal management implementation according to the thermal
diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
index e3fbc5a5d88f..6ceac4f2d4b2 100644
--- a/drivers/thermal/cpu_cooling.c
+++ b/drivers/thermal/cpu_cooling.c
@@ -377,26 +377,28 @@ static u32 cpu_power_to_freq(struct cpufreq_cooling_device *cpufreq_device,
  * get_load() - get load for a cpu since last updated
  * @cpufreq_device:     &struct cpufreq_cooling_device for this cpu
  * @cpu:        cpu number
+ * @cpu_idx:    index of the cpu in cpufreq_device->allowed_cpus
  *
  * Return: The average load of cpu @cpu in percentage since this
  * function was last called.
  */
-static u32 get_load(struct cpufreq_cooling_device *cpufreq_device, int cpu)
+static u32 get_load(struct cpufreq_cooling_device *cpufreq_device, int cpu,
+                    int cpu_idx)
 {
         u32 load;
         u64 now, now_idle, delta_time, delta_idle;
 
         now_idle = get_cpu_idle_time(cpu, &now, 0);
-        delta_idle = now_idle - cpufreq_device->time_in_idle[cpu];
-        delta_time = now - cpufreq_device->time_in_idle_timestamp[cpu];
+        delta_idle = now_idle - cpufreq_device->time_in_idle[cpu_idx];
+        delta_time = now - cpufreq_device->time_in_idle_timestamp[cpu_idx];
 
         if (delta_time <= delta_idle)
                 load = 0;
         else
                 load = div64_u64(100 * (delta_time - delta_idle), delta_time);
 
-        cpufreq_device->time_in_idle[cpu] = now_idle;
-        cpufreq_device->time_in_idle_timestamp[cpu] = now;
+        cpufreq_device->time_in_idle[cpu_idx] = now_idle;
+        cpufreq_device->time_in_idle_timestamp[cpu_idx] = now;
 
         return load;
 }
@@ -598,7 +600,7 @@ static int cpufreq_get_requested_power(struct thermal_cooling_device *cdev,
                 u32 load;
 
                 if (cpu_online(cpu))
-                        load = get_load(cpufreq_device, cpu);
+                        load = get_load(cpufreq_device, cpu, i);
                 else
                         load = 0;
 
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index be4eedcb839a..9043f8f91852 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -475,14 +475,10 @@ thermal_zone_of_sensor_register(struct device *dev, int sensor_id, void *data,
 
         sensor_np = of_node_get(dev->of_node);
 
-        for_each_child_of_node(np, child) {
+        for_each_available_child_of_node(np, child) {
                 struct of_phandle_args sensor_specs;
                 int ret, id;
 
-                /* Check whether child is enabled or not */
-                if (!of_device_is_available(child))
-                        continue;
-
                 /* For now, thermal framework supports only 1 sensor per zone */
                 ret = of_parse_phandle_with_args(child, "thermal-sensors",
                                                  "#thermal-sensor-cells",
@@ -881,16 +877,12 @@ int __init of_parse_thermal_zones(void)
                 return 0; /* Run successfully on systems without thermal DT */
         }
 
-        for_each_child_of_node(np, child) {
+        for_each_available_child_of_node(np, child) {
                 struct thermal_zone_device *zone;
                 struct thermal_zone_params *tzp;
                 int i, mask = 0;
                 u32 prop;
 
-                /* Check whether child is enabled or not */
-                if (!of_device_is_available(child))
-                        continue;
-
                 tz = thermal_of_build_thermal_zone(child);
                 if (IS_ERR(tz)) {
                         pr_err("failed to build thermal zone %s: %ld\n",
@@ -968,13 +960,9 @@ void of_thermal_destroy_zones(void)
                 return;
         }
 
-        for_each_child_of_node(np, child) {
+        for_each_available_child_of_node(np, child) {
                 struct thermal_zone_device *zone;
 
-                /* Check whether child is enabled or not */
-                if (!of_device_is_available(child))
-                        continue;
-
                 zone = thermal_zone_get_zone_by_name(child->name);
                 if (IS_ERR(zone))
                         continue;
diff --git a/drivers/thermal/rcar_thermal.c b/drivers/thermal/rcar_thermal.c
index 44b9c485157d..0e735acea33a 100644
--- a/drivers/thermal/rcar_thermal.c
+++ b/drivers/thermal/rcar_thermal.c
@@ -23,6 +23,7 @@
 #include <linux/interrupt.h>
 #include <linux/io.h>
 #include <linux/module.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/pm_runtime.h>
 #include <linux/reboot.h>
@@ -75,8 +76,10 @@ struct rcar_thermal_priv {
 #define rcar_has_irq_support(priv)      ((priv)->common->base)
 #define rcar_id_to_shift(priv)          ((priv)->id * 8)
 
+#define USE_OF_THERMAL  1
 static const struct of_device_id rcar_thermal_dt_ids[] = {
         { .compatible = "renesas,rcar-thermal", },
+        { .compatible = "renesas,rcar-gen2-thermal", .data = (void *)USE_OF_THERMAL },
         {},
 };
 MODULE_DEVICE_TABLE(of, rcar_thermal_dt_ids);
@@ -200,9 +203,9 @@ err_out_unlock:
         return ret;
 }
 
-static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
+static int rcar_thermal_get_current_temp(struct rcar_thermal_priv *priv,
+                                         int *temp)
 {
-        struct rcar_thermal_priv *priv = rcar_zone_to_priv(zone);
         int tmp;
         int ret;
 
@@ -226,6 +229,20 @@ static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
         return 0;
 }
 
+static int rcar_thermal_of_get_temp(void *data, int *temp)
+{
+        struct rcar_thermal_priv *priv = data;
+
+        return rcar_thermal_get_current_temp(priv, temp);
+}
+
+static int rcar_thermal_get_temp(struct thermal_zone_device *zone, int *temp)
+{
+        struct rcar_thermal_priv *priv = rcar_zone_to_priv(zone);
+
+        return rcar_thermal_get_current_temp(priv, temp);
+}
+
 static int rcar_thermal_get_trip_type(struct thermal_zone_device *zone,
                                       int trip, enum thermal_trip_type *type)
 {
@@ -282,6 +299,10 @@ static int rcar_thermal_notify(struct thermal_zone_device *zone,
         return 0;
 }
 
+static const struct thermal_zone_of_device_ops rcar_thermal_zone_of_ops = {
+        .get_temp       = rcar_thermal_of_get_temp,
+};
+
 static struct thermal_zone_device_ops rcar_thermal_zone_ops = {
         .get_temp       = rcar_thermal_get_temp,
         .get_trip_type  = rcar_thermal_get_trip_type,
@@ -318,14 +339,20 @@ static void rcar_thermal_work(struct work_struct *work)
 
         priv = container_of(work, struct rcar_thermal_priv, work.work);
 
-        rcar_thermal_get_temp(priv->zone, &cctemp);
+        ret = rcar_thermal_get_current_temp(priv, &cctemp);
+        if (ret < 0)
+                return;
+
         ret = rcar_thermal_update_temp(priv);
         if (ret < 0)
                 return;
 
         rcar_thermal_irq_enable(priv);
 
-        rcar_thermal_get_temp(priv->zone, &nctemp);
+        ret = rcar_thermal_get_current_temp(priv, &nctemp);
+        if (ret < 0)
+                return;
+
         if (nctemp != cctemp)
                 thermal_zone_device_update(priv->zone);
 }
@@ -403,6 +430,8 @@ static int rcar_thermal_probe(struct platform_device *pdev)
         struct rcar_thermal_priv *priv;
         struct device *dev = &pdev->dev;
         struct resource *res, *irq;
+        const struct of_device_id *of_id = of_match_device(rcar_thermal_dt_ids, dev);
+        unsigned long of_data = (unsigned long)of_id->data;
         int mres = 0;
         int i;
         int ret = -ENODEV;
@@ -463,7 +492,13 @@ static int rcar_thermal_probe(struct platform_device *pdev)
                 if (ret < 0)
                         goto error_unregister;
 
-                priv->zone = thermal_zone_device_register("rcar_thermal",
+                if (of_data == USE_OF_THERMAL)
+                        priv->zone = thermal_zone_of_sensor_register(
+                                                dev, i, priv,
+                                                &rcar_thermal_zone_of_ops);
+                else
+                        priv->zone = thermal_zone_device_register(
+                                                "rcar_thermal",
                                                 1, 0, priv,
                                                 &rcar_thermal_zone_ops, NULL, 0,
                                                 idle);
diff --git a/drivers/thermal/spear_thermal.c b/drivers/thermal/spear_thermal.c
index 534dd9136662..81b35aace9de 100644
--- a/drivers/thermal/spear_thermal.c
+++ b/drivers/thermal/spear_thermal.c
@@ -54,8 +54,7 @@ static struct thermal_zone_device_ops ops = {
         .get_temp = thermal_get_temp,
 };
 
-#ifdef CONFIG_PM
-static int spear_thermal_suspend(struct device *dev)
+static int __maybe_unused spear_thermal_suspend(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev);
@@ -72,7 +71,7 @@ static int spear_thermal_suspend(struct device *dev)
         return 0;
 }
 
-static int spear_thermal_resume(struct device *dev)
+static int __maybe_unused spear_thermal_resume(struct device *dev)
 {
         struct platform_device *pdev = to_platform_device(dev);
         struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev);
@@ -94,7 +93,6 @@ static int spear_thermal_resume(struct device *dev)
 
         return 0;
 }
-#endif
 
 static SIMPLE_DEV_PM_OPS(spear_thermal_pm_ops, spear_thermal_suspend,
                 spear_thermal_resume);
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index b3110040164a..2348fa613707 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -681,7 +681,14 @@ static void pty_unix98_remove(struct tty_driver *driver, struct tty_struct *tty)
 /* this is called once with whichever end is closed last */
 static void pty_unix98_shutdown(struct tty_struct *tty)
 {
-        devpts_kill_index(tty->driver_data, tty->index);
+        struct inode *ptmx_inode;
+
+        if (tty->driver->subtype == PTY_TYPE_MASTER)
+                ptmx_inode = tty->driver_data;
+        else
+                ptmx_inode = tty->link->driver_data;
+        devpts_kill_index(ptmx_inode, tty->index);
+        devpts_del_ref(ptmx_inode);
 }
 
 static const struct tty_operations ptm_unix98_ops = {
@@ -773,6 +780,18 @@ static int ptmx_open(struct inode *inode, struct file *filp)
         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
         tty->driver_data = inode;
 
+        /*
+         * In the case where all references to ptmx inode are dropped and we
+         * still have /dev/tty opened pointing to the master/slave pair (ptmx
+         * is closed/released before /dev/tty), we must make sure that the inode
+         * is still valid when we call the final pty_unix98_shutdown, thus we
+         * hold an additional reference to the ptmx inode. For the same /dev/tty
+         * last close case, we also need to make sure the super_block isn't
+         * destroyed (devpts instance unmounted), before /dev/tty is closed and
+         * on its release devpts_kill_index is called.
+         */
+        devpts_add_ref(inode);
+
         tty_add_file(tty, filp);
 
         slave_inode = devpts_pty_new(inode,
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index e71ec78fc11e..7cd6f9a90542 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1941,6 +1941,7 @@ pci_wch_ch38x_setup(struct serial_private *priv,
 #define PCIE_VENDOR_ID_WCH              0x1c00
 #define PCIE_DEVICE_ID_WCH_CH382_2S1P   0x3250
 #define PCIE_DEVICE_ID_WCH_CH384_4S     0x3470
+#define PCIE_DEVICE_ID_WCH_CH382_2S     0x3253
 
 #define PCI_VENDOR_ID_PERICOM                   0x12D8
 #define PCI_DEVICE_ID_PERICOM_PI7C9X7951        0x7951
@@ -2637,6 +2638,14 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                 .subdevice      = PCI_ANY_ID,
                 .setup          = pci_wch_ch353_setup,
         },
+        /* WCH CH382 2S card (16850 clone) */
+        {
+                .vendor         = PCIE_VENDOR_ID_WCH,
+                .device         = PCIE_DEVICE_ID_WCH_CH382_2S,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .setup          = pci_wch_ch38x_setup,
+        },
         /* WCH CH382 2S1P card (16850 clone) */
         {
                 .vendor         = PCIE_VENDOR_ID_WCH,
@@ -2955,6 +2964,7 @@ enum pci_board_num_t {
         pbn_fintek_4,
         pbn_fintek_8,
         pbn_fintek_12,
+        pbn_wch382_2,
         pbn_wch384_4,
         pbn_pericom_PI7C9X7951,
         pbn_pericom_PI7C9X7952,
@@ -3775,6 +3785,13 @@ static struct pciserial_board pci_boards[] = {
                 .base_baud      = 115200,
                 .first_offset   = 0x40,
         },
+        [pbn_wch382_2] = {
+                .flags          = FL_BASE0,
+                .num_ports      = 2,
+                .base_baud      = 115200,
+                .uart_offset    = 8,
+                .first_offset   = 0xC0,
+        },
         [pbn_wch384_4] = {
                 .flags          = FL_BASE0,
                 .num_ports      = 4,
@@ -5574,6 +5591,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_b0_bt_2_115200 },
 
+        {       PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH382_2S,
+                PCI_ANY_ID, PCI_ANY_ID,
+                0, 0, pbn_wch382_2 },
+
         {       PCIE_VENDOR_ID_WCH, PCIE_DEVICE_ID_WCH_CH384_4S,
                 PCI_ANY_ID, PCI_ANY_ID,
                 0, 0, pbn_wch384_4 },
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index b645f9228ed7..fa49eb1e2fa2 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -1165,7 +1165,7 @@ serial_omap_type(struct uart_port *port)
 
 #define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
 
-static void wait_for_xmitr(struct uart_omap_port *up)
+static void __maybe_unused wait_for_xmitr(struct uart_omap_port *up)
 {
         unsigned int status, tmout = 10000;
 
@@ -1343,7 +1343,7 @@ static inline void serial_omap_add_console_port(struct uart_omap_port *up)
 
 /* Enable or disable the rs485 support */
 static int
-serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485)
 {
         struct uart_omap_port *up = to_uart_omap_port(port);
         unsigned int mode;
@@ -1356,8 +1356,12 @@ serial_omap_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
         up->ier = 0;
         serial_out(up, UART_IER, 0);
 
+        /* Clamp the delays to [0, 100ms] */
+        rs485->delay_rts_before_send = min(rs485->delay_rts_before_send, 100U);
+        rs485->delay_rts_after_send  = min(rs485->delay_rts_after_send, 100U);
+
         /* store new config */
-        port->rs485 = *rs485conf;
+        port->rs485 = *rs485;
 
         /*
          * Just as a precaution, only allow rs485
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 5cec01c75691..a7eacef1bd22 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2066,13 +2066,12 @@ retry_open:
                 if (tty) {
                         mutex_unlock(&tty_mutex);
                         retval = tty_lock_interruptible(tty);
+                        tty_kref_put(tty);  /* drop kref from tty_driver_lookup_tty() */
                         if (retval) {
                                 if (retval == -EINTR)
                                         retval = -ERESTARTSYS;
                                 goto err_unref;
                         }
-                        /* safe to drop the kref from tty_driver_lookup_tty() */
-                        tty_kref_put(tty);
                         retval = tty_reopen(tty);
                         if (retval < 0) {
                                 tty_unlock(tty);
diff --git a/drivers/tty/tty_mutex.c b/drivers/tty/tty_mutex.c
index d2f3c4cd697f..dfa9ec03fa8e 100644
--- a/drivers/tty/tty_mutex.c
+++ b/drivers/tty/tty_mutex.c
@@ -21,10 +21,15 @@ EXPORT_SYMBOL(tty_lock);
 
 int tty_lock_interruptible(struct tty_struct *tty)
 {
+        int ret;
+
         if (WARN(tty->magic != TTY_MAGIC, "L Bad %p\n", tty))
                 return -EIO;
         tty_kref_get(tty);
-        return mutex_lock_interruptible(&tty->legacy_mutex);
+        ret = mutex_lock_interruptible(&tty->legacy_mutex);
+        if (ret)
+                tty_kref_put(tty);
+        return ret;
 }
 
 void __lockfunc tty_unlock(struct tty_struct *tty)
diff --git a/drivers/video/fbdev/da8xx-fb.c b/drivers/video/fbdev/da8xx-fb.c
index 0081725c6b5b..6b2a06d09f2b 100644
--- a/drivers/video/fbdev/da8xx-fb.c
+++ b/drivers/video/fbdev/da8xx-fb.c
@@ -152,7 +152,7 @@ static void lcdc_write(unsigned int val, unsigned int addr)
 
 struct da8xx_fb_par {
         struct device           *dev;
-        resource_size_t p_palette_base;
+        dma_addr_t              p_palette_base;
         unsigned char *v_palette_base;
         dma_addr_t              vram_phys;
         unsigned long           vram_size;
@@ -1428,7 +1428,7 @@ static int fb_probe(struct platform_device *device)
 
         par->vram_virt = dma_alloc_coherent(NULL,
                                             par->vram_size,
-                                            (resource_size_t *) &par->vram_phys,
+                                            &par->vram_phys,
                                             GFP_KERNEL | GFP_DMA);
         if (!par->vram_virt) {
                 dev_err(&device->dev,
@@ -1448,7 +1448,7 @@ static int fb_probe(struct platform_device *device)
 
         /* allocate palette buffer */
         par->v_palette_base = dma_zalloc_coherent(NULL, PALETTE_SIZE,
-                                                  (resource_size_t *)&par->p_palette_base,
+                                                  &par->p_palette_base,
                                                   GFP_KERNEL | GFP_DMA);
         if (!par->v_palette_base) {
                 dev_err(&device->dev,
diff --git a/drivers/video/fbdev/exynos/s6e8ax0.c b/drivers/video/fbdev/exynos/s6e8ax0.c
index 95873f26e39c..de2f3e793786 100644
--- a/drivers/video/fbdev/exynos/s6e8ax0.c
+++ b/drivers/video/fbdev/exynos/s6e8ax0.c
@@ -829,8 +829,7 @@ static int s6e8ax0_probe(struct mipi_dsim_lcd_device *dsim_dev)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev)
+static int __maybe_unused s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev)
 {
         struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev);
 
@@ -843,7 +842,7 @@ static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev)
         return 0;
 }
 
-static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev)
+static int __maybe_unused s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev)
 {
         struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev);
 
@@ -855,10 +854,6 @@ static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev)
 
         return 0;
 }
-#else
-#define s6e8ax0_suspend         NULL
-#define s6e8ax0_resume          NULL
-#endif
 
 static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = {
         .name = "s6e8ax0",
@@ -867,8 +862,8 @@ static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = {
         .power_on = s6e8ax0_power_on,
         .set_sequence = s6e8ax0_set_sequence,
         .probe = s6e8ax0_probe,
-        .suspend = s6e8ax0_suspend,
-        .resume = s6e8ax0_resume,
+        .suspend = IS_ENABLED(CONFIG_PM) ? s6e8ax0_suspend : NULL,
+        .resume = IS_ENABLED(CONFIG_PM) ? s6e8ax0_resume : NULL,
 };
 
 static int s6e8ax0_init(void)
diff --git a/drivers/video/fbdev/imxfb.c b/drivers/video/fbdev/imxfb.c
index cee88603efc9..bb2f1e866020 100644
--- a/drivers/video/fbdev/imxfb.c
+++ b/drivers/video/fbdev/imxfb.c
@@ -902,6 +902,21 @@ static int imxfb_probe(struct platform_device *pdev)
                 goto failed_getclock;
         }
 
+        /*
+         * The LCDC controller does not have an enable bit. The
+         * controller starts directly when the clocks are enabled.
+         * If the clocks are enabled when the controller is not yet
+         * programmed with proper register values (enabled at the
+         * bootloader, for example) then it just goes into some undefined
+         * state.
+         * To avoid this issue, let's enable and disable LCDC IPG clock
+         * so that we force some kind of 'reset' to the LCDC block.
+         */
+        ret = clk_prepare_enable(fbi->clk_ipg);
+        if (ret)
+                goto failed_getclock;
+        clk_disable_unprepare(fbi->clk_ipg);
+
         fbi->clk_ahb = devm_clk_get(&pdev->dev, "ahb");
         if (IS_ERR(fbi->clk_ahb)) {
                 ret = PTR_ERR(fbi->clk_ahb);
diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
index de54a4748065..b6f83d5df9fd 100644
--- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
+++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c
@@ -503,8 +503,7 @@ static int mmphw_probe(struct platform_device *pdev)
         ctrl->reg_base = devm_ioremap_nocache(ctrl->dev,
                         res->start, resource_size(res));
         if (ctrl->reg_base == NULL) {
-                dev_err(ctrl->dev, "%s: res %x - %x map failed\n", __func__,
-                        res->start, res->end);
+                dev_err(ctrl->dev, "%s: res %pR map failed\n", __func__, res);
                 ret = -ENOMEM;
                 goto failed;
         }
diff --git a/drivers/video/fbdev/ocfb.c b/drivers/video/fbdev/ocfb.c
index c9293aea8ec3..a970edc2a6f8 100644
--- a/drivers/video/fbdev/ocfb.c
+++ b/drivers/video/fbdev/ocfb.c
@@ -123,11 +123,11 @@ static int ocfb_setupfb(struct ocfb_dev *fbdev)
 
         /* Horizontal timings */
         ocfb_writereg(fbdev, OCFB_HTIM, (var->hsync_len - 1) << 24 |
-                      (var->right_margin - 1) << 16 | (var->xres - 1));
+                      (var->left_margin - 1) << 16 | (var->xres - 1));
 
         /* Vertical timings */
         ocfb_writereg(fbdev, OCFB_VTIM, (var->vsync_len - 1) << 24 |
-                      (var->lower_margin - 1) << 16 | (var->yres - 1));
+                      (var->upper_margin - 1) << 16 | (var->yres - 1));
 
         /* Total length of frame */
         hlen = var->left_margin + var->right_margin + var->hsync_len +
diff --git a/drivers/vme/bridges/vme_ca91cx42.c b/drivers/vme/bridges/vme_ca91cx42.c
index b79a74a98a23..5fbeab38889e 100644
--- a/drivers/vme/bridges/vme_ca91cx42.c
+++ b/drivers/vme/bridges/vme_ca91cx42.c
@@ -202,7 +202,7 @@ static int ca91cx42_irq_init(struct vme_bridge *ca91cx42_bridge)
         bridge = ca91cx42_bridge->driver_priv;
 
         /* Need pdev */
-        pdev = container_of(ca91cx42_bridge->parent, struct pci_dev, dev);
+        pdev = to_pci_dev(ca91cx42_bridge->parent);
 
         INIT_LIST_HEAD(&ca91cx42_bridge->vme_error_handlers);
 
@@ -293,8 +293,7 @@ static void ca91cx42_irq_set(struct vme_bridge *ca91cx42_bridge, int level,
         iowrite32(tmp, bridge->base + LINT_EN);
 
         if ((state == 0) && (sync != 0)) {
-                pdev = container_of(ca91cx42_bridge->parent, struct pci_dev,
-                        dev);
+                pdev = to_pci_dev(ca91cx42_bridge->parent);
 
                 synchronize_irq(pdev->irq);
         }
@@ -518,7 +517,7 @@ static int ca91cx42_alloc_resource(struct vme_master_resource *image,
                 dev_err(ca91cx42_bridge->parent, "Dev entry NULL\n");
                 return -EINVAL;
         }
-        pdev = container_of(ca91cx42_bridge->parent, struct pci_dev, dev);
+        pdev = to_pci_dev(ca91cx42_bridge->parent);
 
         existing_size = (unsigned long long)(image->bus_resource.end -
                 image->bus_resource.start);
@@ -1519,7 +1518,7 @@ static void *ca91cx42_alloc_consistent(struct device *parent, size_t size,
         struct pci_dev *pdev;
 
         /* Find pci_dev container of dev */
-        pdev = container_of(parent, struct pci_dev, dev);
+        pdev = to_pci_dev(parent);
 
         return pci_alloc_consistent(pdev, size, dma);
 }
@@ -1530,7 +1529,7 @@ static void ca91cx42_free_consistent(struct device *parent, size_t size,
         struct pci_dev *pdev;
 
         /* Find pci_dev container of dev */
-        pdev = container_of(parent, struct pci_dev, dev);
+        pdev = to_pci_dev(parent);
 
         pci_free_consistent(pdev, size, vaddr, dma);
 }
diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
index 0e2f43bccf1f..a2eec97d5064 100644
--- a/drivers/w1/masters/omap_hdq.c
+++ b/drivers/w1/masters/omap_hdq.c
@@ -618,7 +618,6 @@ static u8 omap_w1_read_byte(void *_hdq)
 
         hdq_disable_interrupt(hdq_data, OMAP_HDQ_CTRL_STATUS,
                               ~OMAP_HDQ_CTRL_STATUS_INTERRUPTMASK);
-        hdq_data->hdq_usecount = 0;
 
         /* Write followed by a read, release the module */
         if (hdq_data->init_trans) {
diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c
index c9a7ff67d395..89a784751738 100644
--- a/drivers/w1/w1.c
+++ b/drivers/w1/w1.c
@@ -1147,7 +1147,6 @@ int w1_process(void *data)
                         jremain = 1;
                 }
 
-                try_to_freeze();
                 __set_current_state(TASK_INTERRUPTIBLE);
 
                 /* hold list_mutex until after interruptible to prevent loosing
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 0f6d8515ba4f..86c2392bd968 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -1214,6 +1214,21 @@ config SBC_EPX_C3_WATCHDOG
           To compile this driver as a module, choose M here: the
           module will be called sbc_epx_c3.
 
+config INTEL_MEI_WDT
+        tristate "Intel MEI iAMT Watchdog"
+        depends on INTEL_MEI && X86
+        select WATCHDOG_CORE
+        ---help---
+          A device driver for the Intel MEI iAMT watchdog.
+
+          The Intel AMT Watchdog is an OS Health (Hang/Crash) watchdog.
+          Whenever the OS hangs or crashes, iAMT will send an event
+          to any subscriber to this event. The watchdog doesn't reset the
+          the platform.
+
+          To compile this driver as a module, choose M here:
+          the module will be called mei_wdt.
+
 # M32R Architecture
 
 # M68K Architecture
diff --git a/drivers/watchdog/Makefile b/drivers/watchdog/Makefile
index f566753256ab..efc4f788e0f2 100644
--- a/drivers/watchdog/Makefile
+++ b/drivers/watchdog/Makefile
@@ -126,6 +126,7 @@ obj-$(CONFIG_MACHZ_WDT) += machzwd.o
 obj-$(CONFIG_SBC_EPX_C3_WATCHDOG) += sbc_epx_c3.o
 obj-$(CONFIG_INTEL_SCU_WATCHDOG) += intel_scu_watchdog.o
 obj-$(CONFIG_INTEL_MID_WATCHDOG) += intel-mid_wdt.o
+obj-$(CONFIG_INTEL_MEI_WDT) += mei_wdt.o
 
 # M32R Architecture
 
diff --git a/drivers/watchdog/mei_wdt.c b/drivers/watchdog/mei_wdt.c
new file mode 100644
index 000000000000..630bd189f167
--- /dev/null
+++ b/drivers/watchdog/mei_wdt.c
@@ -0,0 +1,724 @@
+/*
+ * Intel Management Engine Interface (Intel MEI) Linux driver
+ * Copyright (c) 2015, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/interrupt.h>
+#include <linux/debugfs.h>
+#include <linux/completion.h>
+#include <linux/watchdog.h>
+
+#include <linux/uuid.h>
+#include <linux/mei_cl_bus.h>
+
+/*
+ * iAMT Watchdog Device
+ */
+#define INTEL_AMT_WATCHDOG_ID "iamt_wdt"
+
+#define MEI_WDT_DEFAULT_TIMEOUT   120  /* seconds */
+#define MEI_WDT_MIN_TIMEOUT       120  /* seconds */
+#define MEI_WDT_MAX_TIMEOUT     65535  /* seconds */
+
+/* Commands */
+#define MEI_MANAGEMENT_CONTROL 0x02
+
+/* MEI Management Control version number */
+#define MEI_MC_VERSION_NUMBER  0x10
+
+/* Sub Commands */
+#define MEI_MC_START_WD_TIMER_REQ  0x13
+#define MEI_MC_START_WD_TIMER_RES  0x83
+#define   MEI_WDT_STATUS_SUCCESS 0
+#define   MEI_WDT_WDSTATE_NOT_REQUIRED 0x1
+#define MEI_MC_STOP_WD_TIMER_REQ   0x14
+
+/**
+ * enum mei_wdt_state - internal watchdog state
+ *
+ * @MEI_WDT_PROBE: wd in probing stage
+ * @MEI_WDT_IDLE: wd is idle and not opened
+ * @MEI_WDT_START: wd was opened, start was called
+ * @MEI_WDT_RUNNING: wd is expecting keep alive pings
+ * @MEI_WDT_STOPPING: wd is stopping and will move to IDLE
+ * @MEI_WDT_NOT_REQUIRED: wd device is not required
+ */
+enum mei_wdt_state {
+        MEI_WDT_PROBE,
+        MEI_WDT_IDLE,
+        MEI_WDT_START,
+        MEI_WDT_RUNNING,
+        MEI_WDT_STOPPING,
+        MEI_WDT_NOT_REQUIRED,
+};
+
+static const char *mei_wdt_state_str(enum mei_wdt_state state)
+{
+        switch (state) {
+        case MEI_WDT_PROBE:
+                return "PROBE";
+        case MEI_WDT_IDLE:
+                return "IDLE";
+        case MEI_WDT_START:
+                return "START";
+        case MEI_WDT_RUNNING:
+                return "RUNNING";
+        case MEI_WDT_STOPPING:
+                return "STOPPING";
+        case MEI_WDT_NOT_REQUIRED:
+                return "NOT_REQUIRED";
+        default:
+                return "unknown";
+        }
+}
+
+/**
+ * struct mei_wdt - mei watchdog driver
+ * @wdd: watchdog device
+ *
+ * @cldev: mei watchdog client device
+ * @state: watchdog internal state
+ * @resp_required: ping required response
+ * @response: ping response completion
+ * @unregister: unregister worker
+ * @reg_lock: watchdog device registration lock
+ * @timeout: watchdog current timeout
+ *
+ * @dbgfs_dir: debugfs dir entry
+ */
+struct mei_wdt {
+        struct watchdog_device wdd;
+
+        struct mei_cl_device *cldev;
+        enum mei_wdt_state state;
+        bool resp_required;
+        struct completion response;
+        struct work_struct unregister;
+        struct mutex reg_lock;
+        u16 timeout;
+
+#if IS_ENABLED(CONFIG_DEBUG_FS)
+        struct dentry *dbgfs_dir;
+#endif /* CONFIG_DEBUG_FS */
+};
+
+/*
+ * struct mei_mc_hdr - Management Control Command Header
+ *
+ * @command: Management Control (0x2)
+ * @bytecount: Number of bytes in the message beyond this byte
+ * @subcommand: Management Control Subcommand
+ * @versionnumber: Management Control Version (0x10)
+ */
+struct mei_mc_hdr {
+        u8 command;
+        u8 bytecount;
+        u8 subcommand;
+        u8 versionnumber;
+};
+
+/**
+ * struct mei_wdt_start_request watchdog start/ping
+ *
+ * @hdr: Management Control Command Header
+ * @timeout: timeout value
+ * @reserved: reserved (legacy)
+ */
+struct mei_wdt_start_request {
+        struct mei_mc_hdr hdr;
+        u16 timeout;
+        u8 reserved[17];
+} __packed;
+
+/**
+ * struct mei_wdt_start_response watchdog start/ping response
+ *
+ * @hdr: Management Control Command Header
+ * @status: operation status
+ * @wdstate: watchdog status bit mask
+ */
+struct mei_wdt_start_response {
+        struct mei_mc_hdr hdr;
+        u8 status;
+        u8 wdstate;
+} __packed;
+
+/**
+ * struct mei_wdt_stop_request - watchdog stop
+ *
+ * @hdr: Management Control Command Header
+ */
+struct mei_wdt_stop_request {
+        struct mei_mc_hdr hdr;
+} __packed;
+
+/**
+ * mei_wdt_ping - send wd start/ping command
+ *
+ * @wdt: mei watchdog device
+ *
+ * Return: 0 on success,
+ *         negative errno code on failure
+ */
+static int mei_wdt_ping(struct mei_wdt *wdt)
+{
+        struct mei_wdt_start_request req;
+        const size_t req_len = sizeof(req);
+        int ret;
+
+        memset(&req, 0, req_len);
+        req.hdr.command = MEI_MANAGEMENT_CONTROL;
+        req.hdr.bytecount = req_len - offsetof(struct mei_mc_hdr, subcommand);
+        req.hdr.subcommand = MEI_MC_START_WD_TIMER_REQ;
+        req.hdr.versionnumber = MEI_MC_VERSION_NUMBER;
+        req.timeout = wdt->timeout;
+
+        ret = mei_cldev_send(wdt->cldev, (u8 *)&req, req_len);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+/**
+ * mei_wdt_stop - send wd stop command
+ *
+ * @wdt: mei watchdog device
+ *
+ * Return: 0 on success,
+ *         negative errno code on failure
+ */
+static int mei_wdt_stop(struct mei_wdt *wdt)
+{
+        struct mei_wdt_stop_request req;
+        const size_t req_len = sizeof(req);
+        int ret;
+
+        memset(&req, 0, req_len);
+        req.hdr.command = MEI_MANAGEMENT_CONTROL;
+        req.hdr.bytecount = req_len - offsetof(struct mei_mc_hdr, subcommand);
+        req.hdr.subcommand = MEI_MC_STOP_WD_TIMER_REQ;
+        req.hdr.versionnumber = MEI_MC_VERSION_NUMBER;
+
+        ret = mei_cldev_send(wdt->cldev, (u8 *)&req, req_len);
+        if (ret < 0)
+                return ret;
+
+        return 0;
+}
+
+/**
+ * mei_wdt_ops_start - wd start command from the watchdog core.
+ *
+ * @wdd: watchdog device
+ *
+ * Return: 0 on success or -ENODEV;
+ */
+static int mei_wdt_ops_start(struct watchdog_device *wdd)
+{
+        struct mei_wdt *wdt = watchdog_get_drvdata(wdd);
+
+        wdt->state = MEI_WDT_START;
+        wdd->timeout = wdt->timeout;
+        return 0;
+}
+
+/**
+ * mei_wdt_ops_stop - wd stop command from the watchdog core.
+ *
+ * @wdd: watchdog device
+ *
+ * Return: 0 if success, negative errno code for failure
+ */
+static int mei_wdt_ops_stop(struct watchdog_device *wdd)
+{
+        struct mei_wdt *wdt = watchdog_get_drvdata(wdd);
+        int ret;
+
+        if (wdt->state != MEI_WDT_RUNNING)
+                return 0;
+
+        wdt->state = MEI_WDT_STOPPING;
+
+        ret = mei_wdt_stop(wdt);
+        if (ret)
+                return ret;
+
+        wdt->state = MEI_WDT_IDLE;
+
+        return 0;
+}
+
+/**
+ * mei_wdt_ops_ping - wd ping command from the watchdog core.
+ *
+ * @wdd: watchdog device
+ *
+ * Return: 0 if success, negative errno code on failure
+ */
+static int mei_wdt_ops_ping(struct watchdog_device *wdd)
+{
+        struct mei_wdt *wdt = watchdog_get_drvdata(wdd);
+        int ret;
+
+        if (wdt->state != MEI_WDT_START && wdt->state != MEI_WDT_RUNNING)
+                return 0;
+
+        if (wdt->resp_required)
+                init_completion(&wdt->response);
+
+        wdt->state = MEI_WDT_RUNNING;
+        ret = mei_wdt_ping(wdt);
+        if (ret)
+                return ret;
+
+        if (wdt->resp_required)
+                ret = wait_for_completion_killable(&wdt->response);
+
+        return ret;
+}
+
+/**
+ * mei_wdt_ops_set_timeout - wd set timeout command from the watchdog core.
+ *
+ * @wdd: watchdog device
+ * @timeout: timeout value to set
+ *
+ * Return: 0 if success, negative errno code for failure
+ */
+static int mei_wdt_ops_set_timeout(struct watchdog_device *wdd,
+                                   unsigned int timeout)
+{
+
+        struct mei_wdt *wdt = watchdog_get_drvdata(wdd);
+
+        /* valid value is already checked by the caller */
+        wdt->timeout = timeout;
+        wdd->timeout = timeout;
+
+        return 0;
+}
+
+static const struct watchdog_ops wd_ops = {
+        .owner       = THIS_MODULE,
+        .start       = mei_wdt_ops_start,
+        .stop        = mei_wdt_ops_stop,
+        .ping        = mei_wdt_ops_ping,
+        .set_timeout = mei_wdt_ops_set_timeout,
+};
+
+/* not const as the firmware_version field need to be retrieved */
+static struct watchdog_info wd_info = {
+        .identity = INTEL_AMT_WATCHDOG_ID,
+        .options  = WDIOF_KEEPALIVEPING |
+                    WDIOF_SETTIMEOUT |
+                    WDIOF_ALARMONLY,
+};
+
+/**
+ * __mei_wdt_is_registered - check if wdt is registered
+ *
+ * @wdt: mei watchdog device
+ *
+ * Return: true if the wdt is registered with the watchdog subsystem
+ * Locking: should be called under wdt->reg_lock
+ */
+static inline bool __mei_wdt_is_registered(struct mei_wdt *wdt)
+{
+        return !!watchdog_get_drvdata(&wdt->wdd);
+}
+
+/**
+ * mei_wdt_unregister - unregister from the watchdog subsystem
+ *
+ * @wdt: mei watchdog device
+ */
+static void mei_wdt_unregister(struct mei_wdt *wdt)
+{
+        mutex_lock(&wdt->reg_lock);
+
+        if (__mei_wdt_is_registered(wdt)) {
+                watchdog_unregister_device(&wdt->wdd);
+                watchdog_set_drvdata(&wdt->wdd, NULL);
+                memset(&wdt->wdd, 0, sizeof(wdt->wdd));
+        }
+
+        mutex_unlock(&wdt->reg_lock);
+}
+
+/**
+ * mei_wdt_register - register with the watchdog subsystem
+ *
+ * @wdt: mei watchdog device
+ *
+ * Return: 0 if success, negative errno code for failure
+ */
+static int mei_wdt_register(struct mei_wdt *wdt)
+{
+        struct device *dev;
+        int ret;
+
+        if (!wdt || !wdt->cldev)
+                return -EINVAL;
+
+        dev = &wdt->cldev->dev;
+
+        mutex_lock(&wdt->reg_lock);
+
+        if (__mei_wdt_is_registered(wdt)) {
+                ret = 0;
+                goto out;
+        }
+
+        wdt->wdd.info = &wd_info;
+        wdt->wdd.ops = &wd_ops;
+        wdt->wdd.parent = dev;
+        wdt->wdd.timeout = MEI_WDT_DEFAULT_TIMEOUT;
+        wdt->wdd.min_timeout = MEI_WDT_MIN_TIMEOUT;
+        wdt->wdd.max_timeout = MEI_WDT_MAX_TIMEOUT;
+
+        watchdog_set_drvdata(&wdt->wdd, wdt);
+        ret = watchdog_register_device(&wdt->wdd);
+        if (ret) {
+                dev_err(dev, "unable to register watchdog device = %d.\n", ret);
+                watchdog_set_drvdata(&wdt->wdd, NULL);
+        }
+
+        wdt->state = MEI_WDT_IDLE;
+
+out:
+        mutex_unlock(&wdt->reg_lock);
+        return ret;
+}
+
+static void mei_wdt_unregister_work(struct work_struct *work)
+{
+        struct mei_wdt *wdt = container_of(work, struct mei_wdt, unregister);
+
+        mei_wdt_unregister(wdt);
+}
+
+/**
+ * mei_wdt_event_rx - callback for data receive
+ *
+ * @cldev: bus device
+ */
+static void mei_wdt_event_rx(struct mei_cl_device *cldev)
+{
+        struct mei_wdt *wdt = mei_cldev_get_drvdata(cldev);
+        struct mei_wdt_start_response res;
+        const size_t res_len = sizeof(res);
+        int ret;
+
+        ret = mei_cldev_recv(wdt->cldev, (u8 *)&res, res_len);
+        if (ret < 0) {
+                dev_err(&cldev->dev, "failure in recv %d\n", ret);
+                return;
+        }
+
+        /* Empty response can be sent on stop */
+        if (ret == 0)
+                return;
+
+        if (ret < sizeof(struct mei_mc_hdr)) {
+                dev_err(&cldev->dev, "recv small data %d\n", ret);
+                return;
+        }
+
+        if (res.hdr.command != MEI_MANAGEMENT_CONTROL ||
+            res.hdr.versionnumber != MEI_MC_VERSION_NUMBER) {
+                dev_err(&cldev->dev, "wrong command received\n");
+                return;
+        }
+
+        if (res.hdr.subcommand != MEI_MC_START_WD_TIMER_RES) {
+                dev_warn(&cldev->dev, "unsupported command %d :%s[%d]\n",
+                         res.hdr.subcommand,
+                         mei_wdt_state_str(wdt->state),
+                         wdt->state);
+                return;
+        }
+
+        /* Run the unregistration in a worker as this can be
+         * run only after ping completion, otherwise the flow will
+         * deadlock on watchdog core mutex.
+         */
+        if (wdt->state == MEI_WDT_RUNNING) {
+                if (res.wdstate & MEI_WDT_WDSTATE_NOT_REQUIRED) {
+                        wdt->state = MEI_WDT_NOT_REQUIRED;
+                        schedule_work(&wdt->unregister);
+                }
+                goto out;
+        }
+
+        if (wdt->state == MEI_WDT_PROBE) {
+                if (res.wdstate & MEI_WDT_WDSTATE_NOT_REQUIRED) {
+                        wdt->state = MEI_WDT_NOT_REQUIRED;
+                } else {
+                        /* stop the watchdog and register watchdog device */
+                        mei_wdt_stop(wdt);
+                        mei_wdt_register(wdt);
+                }
+                return;
+        }
+
+        dev_warn(&cldev->dev, "not in correct state %s[%d]\n",
+                         mei_wdt_state_str(wdt->state), wdt->state);
+
+out:
+        if (!completion_done(&wdt->response))
+                complete(&wdt->response);
+}
+
+/*
+ * mei_wdt_notify_event - callback for event notification
+ *
+ * @cldev: bus device
+ */
+static void mei_wdt_notify_event(struct mei_cl_device *cldev)
+{
+        struct mei_wdt *wdt = mei_cldev_get_drvdata(cldev);
+
+        if (wdt->state != MEI_WDT_NOT_REQUIRED)
+                return;
+
+        mei_wdt_register(wdt);
+}
+
+/**
+ * mei_wdt_event - callback for event receive
+ *
+ * @cldev: bus device
+ * @events: event mask
+ * @context: callback context
+ */
+static void mei_wdt_event(struct mei_cl_device *cldev,
+                          u32 events, void *context)
+{
+        if (events & BIT(MEI_CL_EVENT_RX))
+                mei_wdt_event_rx(cldev);
+
+        if (events & BIT(MEI_CL_EVENT_NOTIF))
+                mei_wdt_notify_event(cldev);
+}
+
+#if IS_ENABLED(CONFIG_DEBUG_FS)
+
+static ssize_t mei_dbgfs_read_activation(struct file *file, char __user *ubuf,
+                                        size_t cnt, loff_t *ppos)
+{
+        struct mei_wdt *wdt = file->private_data;
+        const size_t bufsz = 32;
+        char buf[32];
+        ssize_t pos;
+
+        mutex_lock(&wdt->reg_lock);
+        pos = scnprintf(buf, bufsz, "%s\n",
+                __mei_wdt_is_registered(wdt) ? "activated" : "deactivated");
+        mutex_unlock(&wdt->reg_lock);
+
+        return simple_read_from_buffer(ubuf, cnt, ppos, buf, pos);
+}
+
+static const struct file_operations dbgfs_fops_activation = {
+        .open    = simple_open,
+        .read    = mei_dbgfs_read_activation,
+        .llseek  = generic_file_llseek,
+};
+
+static ssize_t mei_dbgfs_read_state(struct file *file, char __user *ubuf,
+                                    size_t cnt, loff_t *ppos)
+{
+        struct mei_wdt *wdt = file->private_data;
+        const size_t bufsz = 32;
+        char buf[bufsz];
+        ssize_t pos;
+
+        pos = scnprintf(buf, bufsz, "state: %s\n",
+                         mei_wdt_state_str(wdt->state));
+
+        return simple_read_from_buffer(ubuf, cnt, ppos, buf, pos);
+}
+
+static const struct file_operations dbgfs_fops_state = {
+        .open = simple_open,
+        .read = mei_dbgfs_read_state,
+        .llseek = generic_file_llseek,
+};
+
+static void dbgfs_unregister(struct mei_wdt *wdt)
+{
+        debugfs_remove_recursive(wdt->dbgfs_dir);
+        wdt->dbgfs_dir = NULL;
+}
+
+static int dbgfs_register(struct mei_wdt *wdt)
+{
+        struct dentry *dir, *f;
+
+        dir = debugfs_create_dir(KBUILD_MODNAME, NULL);
+        if (!dir)
+                return -ENOMEM;
+
+        wdt->dbgfs_dir = dir;
+        f = debugfs_create_file("state", S_IRUSR, dir, wdt, &dbgfs_fops_state);
+        if (!f)
+                goto err;
+
+        f = debugfs_create_file("activation",  S_IRUSR,
+                                dir, wdt, &dbgfs_fops_activation);
+        if (!f)
+                goto err;
+
+        return 0;
+err:
+        dbgfs_unregister(wdt);
+        return -ENODEV;
+}
+
+#else
+
+static inline void dbgfs_unregister(struct mei_wdt *wdt) {}
+
+static inline int dbgfs_register(struct mei_wdt *wdt)
+{
+        return 0;
+}
+#endif /* CONFIG_DEBUG_FS */
+
+static int mei_wdt_probe(struct mei_cl_device *cldev,
+                         const struct mei_cl_device_id *id)
+{
+        struct mei_wdt *wdt;
+        int ret;
+
+        wdt = kzalloc(sizeof(struct mei_wdt), GFP_KERNEL);
+        if (!wdt)
+                return -ENOMEM;
+
+        wdt->timeout = MEI_WDT_DEFAULT_TIMEOUT;
+        wdt->state = MEI_WDT_PROBE;
+        wdt->cldev = cldev;
+        wdt->resp_required = mei_cldev_ver(cldev) > 0x1;
+        mutex_init(&wdt->reg_lock);
+        init_completion(&wdt->response);
+        INIT_WORK(&wdt->unregister, mei_wdt_unregister_work);
+
+        mei_cldev_set_drvdata(cldev, wdt);
+
+        ret = mei_cldev_enable(cldev);
+        if (ret < 0) {
+                dev_err(&cldev->dev, "Could not enable cl device\n");
+                goto err_out;
+        }
+
+        ret = mei_cldev_register_event_cb(wdt->cldev,
+                                          BIT(MEI_CL_EVENT_RX) |
+                                          BIT(MEI_CL_EVENT_NOTIF),
+                                          mei_wdt_event, NULL);
+
+        /* on legacy devices notification is not supported
+         * this doesn't fail the registration for RX event
+         */
+        if (ret && ret != -EOPNOTSUPP) {
+                dev_err(&cldev->dev, "Could not register event ret=%d\n", ret);
+                goto err_disable;
+        }
+
+        wd_info.firmware_version = mei_cldev_ver(cldev);
+
+        if (wdt->resp_required)
+                ret = mei_wdt_ping(wdt);
+        else
+                ret = mei_wdt_register(wdt);
+
+        if (ret)
+                goto err_disable;
+
+        if (dbgfs_register(wdt))
+                dev_warn(&cldev->dev, "cannot register debugfs\n");
+
+        return 0;
+
+err_disable:
+        mei_cldev_disable(cldev);
+
+err_out:
+        kfree(wdt);
+
+        return ret;
+}
+
+static int mei_wdt_remove(struct mei_cl_device *cldev)
+{
+        struct mei_wdt *wdt = mei_cldev_get_drvdata(cldev);
+
+        /* Free the caller in case of fw initiated or unexpected reset */
+        if (!completion_done(&wdt->response))
+                complete(&wdt->response);
+
+        cancel_work_sync(&wdt->unregister);
+
+        mei_wdt_unregister(wdt);
+
+        mei_cldev_disable(cldev);
+
+        dbgfs_unregister(wdt);
+
+        kfree(wdt);
+
+        return 0;
+}
+
+#define MEI_UUID_WD UUID_LE(0x05B79A6F, 0x4628, 0x4D7F, \
+                            0x89, 0x9D, 0xA9, 0x15, 0x14, 0xCB, 0x32, 0xAB)
+
+static struct mei_cl_device_id mei_wdt_tbl[] = {
+        { .uuid = MEI_UUID_WD, .version = MEI_CL_VERSION_ANY },
+        /* required last entry */
+        { }
+};
+MODULE_DEVICE_TABLE(mei, mei_wdt_tbl);
+
+static struct mei_cl_driver mei_wdt_driver = {
+        .id_table = mei_wdt_tbl,
+        .name = KBUILD_MODNAME,
+
+        .probe = mei_wdt_probe,
+        .remove = mei_wdt_remove,
+};
+
+static int __init mei_wdt_init(void)
+{
+        int ret;
+
+        ret = mei_cldev_driver_register(&mei_wdt_driver);
+        if (ret) {
+                pr_err(KBUILD_MODNAME ": module registration failed\n");
+                return ret;
+        }
+        return 0;
+}
+
+static void __exit mei_wdt_exit(void)
+{
+        mei_cldev_driver_unregister(&mei_wdt_driver);
+}
+
+module_init(mei_wdt_init);
+module_exit(mei_wdt_exit);
+
+MODULE_AUTHOR("Intel Corporation");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Device driver for Intel MEI iAMT watchdog");