180 files changed, 6878 insertions, 3351 deletions

diff --git a/Documentation/ABI/testing/configfs-stp-policy-p_sys-t b/Documentation/ABI/testing/configfs-stp-policy-p_sys-t
new file mode 100644
index 000000000000..b290d1c00dcf
--- /dev/null
+++ b/Documentation/ABI/testing/configfs-stp-policy-p_sys-t
@@ -0,0 +1,41 @@
+What:           /config/stp-policy/<device>:p_sys-t.<policy>/<node>/uuid
+Date:           June 2018
+KernelVersion:  4.19
+Description:
+                UUID source identifier string, RW.
+                Default value is randomly generated at the mkdir <node> time.
+                Data coming from trace sources that use this <node> will be
+                tagged with this UUID in the MIPI SyS-T packet stream, to
+                allow the decoder to discern between different sources
+                within the same master/channel range, and identify the
+                higher level decoders that may be needed for each source.
+
+What:           /config/stp-policy/<device>:p_sys-t.<policy>/<node>/do_len
+Date:           June 2018
+KernelVersion:  4.19
+Description:
+                Include payload length in the MIPI SyS-T header, boolean.
+                If enabled, the SyS-T protocol encoder will include payload
+                length in each packet's metadata. This is normally redundant
+                if the underlying transport protocol supports marking message
+                boundaries (which STP does), so this is off by default.
+
+What:           /config/stp-policy/<device>:p_sys-t.<policy>/<node>/ts_interval
+Date:           June 2018
+KernelVersion:  4.19
+Description:
+                Time interval in milliseconds. Include a timestamp in the
+                MIPI SyS-T packet metadata, if this many milliseconds have
+                passed since the previous packet from this source. Zero is
+                the default and stands for "never send the timestamp".
+
+What:           /config/stp-policy/<device>:p_sys-t.<policy>/<node>/clocksync_interval
+Date:           June 2018
+KernelVersion:  4.19
+Description:
+                Time interval in milliseconds. Send a CLOCKSYNC packet if
+                this many milliseconds have passed since the previous
+                CLOCKSYNC packet from this source. Zero is the default and
+                stands for "never send the CLOCKSYNC". It makes sense to
+                use this option with sources that generate constant and/or
+                periodic data, like stm_heartbeat.
diff --git a/Documentation/ABI/testing/sysfs-bus-vmbus b/Documentation/ABI/testing/sysfs-bus-vmbus
new file mode 100644
index 000000000000..91e6c065973c
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-bus-vmbus
@@ -0,0 +1,21 @@
+What:           /sys/bus/vmbus/devices/.../driver_override
+Date:           August 2019
+Contact:        Stephen Hemminger <sthemmin@microsoft.com>
+Description:
+                This file allows the driver for a device to be specified which
+                will override standard static and dynamic ID matching.  When
+                specified, only a driver with a name matching the value written
+                to driver_override will have an opportunity to bind to the
+                device.  The override is specified by writing a string to the
+                driver_override file (echo uio_hv_generic > driver_override) and
+                may be cleared with an empty string (echo > driver_override).
+                This returns the device to standard matching rules binding.
+                Writing to driver_override does not automatically unbind the
+                device from its current driver or make any attempt to
+                automatically load the specified driver.  If no driver with a
+                matching name is currently loaded in the kernel, the device
+                will not bind to any driver.  This also allows devices to
+                opt-out of driver binding using a driver_override name such as
+                "none".  Only a single driver may be specified in the override,
+                there is no support for parsing delimiters.
+
diff --git a/Documentation/admin-guide/security-bugs.rst b/Documentation/admin-guide/security-bugs.rst
index 30491d91e93d..164bf71149fd 100644
--- a/Documentation/admin-guide/security-bugs.rst
+++ b/Documentation/admin-guide/security-bugs.rst
@@ -26,23 +26,34 @@ information is helpful.  Any exploit code is very helpful and will not
 be released without consent from the reporter unless it has already been
 made public.
 
-Disclosure
-----------
-
-The goal of the Linux kernel security team is to work with the bug
-submitter to understand and fix the bug.  We prefer to publish the fix as
-soon as possible, but try to avoid public discussion of the bug itself
-and leave that to others.
-
-Publishing the fix may be delayed when the bug or the fix is not yet
-fully understood, the solution is not well-tested or for vendor
-coordination.  However, we expect these delays to be short, measurable in
-days, not weeks or months.  A release date is negotiated by the security
-team working with the bug submitter as well as vendors.  However, the
-kernel security team holds the final say when setting a timeframe.  The
-timeframe varies from immediate (esp. if it's already publicly known bug)
-to a few weeks.  As a basic default policy, we expect report date to
-release date to be on the order of 7 days.
+Disclosure and embargoed information
+------------------------------------
+
+The security list is not a disclosure channel.  For that, see Coordination
+below.
+
+Once a robust fix has been developed, our preference is to release the
+fix in a timely fashion, treating it no differently than any of the other
+thousands of changes and fixes the Linux kernel project releases every
+month.
+
+However, at the request of the reporter, we will postpone releasing the
+fix for up to 5 business days after the date of the report or after the
+embargo has lifted; whichever comes first.  The only exception to that
+rule is if the bug is publicly known, in which case the preference is to
+release the fix as soon as it's available.
+
+Whilst embargoed information may be shared with trusted individuals in
+order to develop a fix, such information will not be published alongside
+the fix or on any other disclosure channel without the permission of the
+reporter.  This includes but is not limited to the original bug report
+and followup discussions (if any), exploits, CVE information or the
+identity of the reporter.
+
+In other words our only interest is in getting bugs fixed.  All other
+information submitted to the security list and any followup discussions
+of the report are treated confidentially even after the embargo has been
+lifted, in perpetuity.
 
 Coordination
 ------------
@@ -68,7 +79,7 @@ may delay the bug handling. If a reporter wishes to have a CVE identifier
 assigned ahead of public disclosure, they will need to contact the private
 linux-distros list, described above. When such a CVE identifier is known
 before a patch is provided, it is desirable to mention it in the commit
-message, though.
+message if the reporter agrees.
 
 Non-disclosure agreements
 -------------------------
diff --git a/Documentation/devicetree/bindings/arm/coresight.txt b/Documentation/devicetree/bindings/arm/coresight.txt
index 5d1ad09bafb4..f8aff65ab921 100644
--- a/Documentation/devicetree/bindings/arm/coresight.txt
+++ b/Documentation/devicetree/bindings/arm/coresight.txt
@@ -54,9 +54,7 @@ its hardware characteristcs.
           clocks the core of that coresight component. The latter clock
           is optional.
 
-        * port or ports: The representation of the component's port
-          layout using the generic DT graph presentation found in
-          "bindings/graph.txt".
+        * port or ports: see "Graph bindings for Coresight" below.
 
 * Additional required properties for System Trace Macrocells (STM):
         * reg: along with the physical base address and length of the register
@@ -73,7 +71,7 @@ its hardware characteristcs.
           AMBA markee):
                 - "arm,coresight-replicator"
 
-        * port or ports: same as above.
+        * port or ports: see "Graph bindings for Coresight" below.
 
 * Optional properties for ETM/PTMs:
 
@@ -96,6 +94,20 @@ its hardware characteristcs.
         * interrupts : Exactly one SPI may be listed for reporting the address
           error
 
+Graph bindings for Coresight
+-------------------------------
+
+Coresight components are interconnected to create a data path for the flow of
+trace data generated from the "sources" to their collection points "sink".
+Each coresight component must describe the "input" and "output" connections.
+The connections must be described via generic DT graph bindings as described
+by the "bindings/graph.txt", where each "port" along with an "endpoint"
+component represents a hardware port and the connection.
+
+ * All output ports must be listed inside a child node named "out-ports"
+ * All input ports must be listed inside a child node named "in-ports".
+ * Port address must match the hardware port number.
+
 Example:
 
 1. Sinks
@@ -105,10 +117,11 @@ Example:
 
                 clocks = <&oscclk6a>;
                 clock-names = "apb_pclk";
-                port {
-                        etb_in_port: endpoint@0 {
-                                slave-mode;
-                                remote-endpoint = <&replicator_out_port0>;
+                in-ports {
+                        port {
+                                etb_in_port: endpoint@0 {
+                                        remote-endpoint = <&replicator_out_port0>;
+                                };
                         };
                 };
         };
@@ -119,10 +132,11 @@ Example:
 
                 clocks = <&oscclk6a>;
                 clock-names = "apb_pclk";
-                port {
-                        tpiu_in_port: endpoint@0 {
-                                slave-mode;
-                                remote-endpoint = <&replicator_out_port1>;
+                in-ports {
+                        port {
+                                tpiu_in_port: endpoint@0 {
+                                        remote-endpoint = <&replicator_out_port1>;
+                                };
                         };
                 };
         };
@@ -133,22 +147,16 @@ Example:
 
                 clocks = <&oscclk6a>;
                 clock-names = "apb_pclk";
-                ports {
-                        #address-cells = <1>;
-                        #size-cells = <0>;
-
-                        /* input port */
-                        port@0 {
-                                reg =  <0>;
+                in-ports {
+                        port {
                                 etr_in_port: endpoint {
-                                        slave-mode;
                                         remote-endpoint = <&replicator2_out_port0>;
                                 };
                         };
+                };
 
-                        /* CATU link represented by output port */
-                        port@1 {
-                                reg = <1>;
+                out-ports {
+                        port {
                                 etr_out_port: endpoint {
                                         remote-endpoint = <&catu_in_port>;
                                 };
@@ -163,7 +171,7 @@ Example:
                  */
                 compatible = "arm,coresight-replicator";
 
-                ports {
+                out-ports {
                         #address-cells = <1>;
                         #size-cells = <0>;
 
@@ -181,12 +189,11 @@ Example:
                                         remote-endpoint = <&tpiu_in_port>;
                                 };
                         };
+                };
 
-                        /* replicator input port */
-                        port@2 {
-                                reg = <0>;
+                in-ports {
+                        port {
                                 replicator_in_port0: endpoint {
-                                        slave-mode;
                                         remote-endpoint = <&funnel_out_port0>;
                                 };
                         };
@@ -199,40 +206,36 @@ Example:
 
                 clocks = <&oscclk6a>;
                 clock-names = "apb_pclk";
-                ports {
-                        #address-cells = <1>;
-                        #size-cells = <0>;
-
-                        /* funnel output port */
-                        port@0 {
-                                reg = <0>;
+                out-ports {
+                        port {
                                 funnel_out_port0: endpoint {
                                         remote-endpoint =
                                                         <&replicator_in_port0>;
                                 };
                         };
+                };
 
-                        /* funnel input ports */
-                        port@1 {
+                in-ports {
+                        #address-cells = <1>;
+                        #size-cells = <0>;
+
+                        port@0 {
                                 reg = <0>;
                                 funnel_in_port0: endpoint {
-                                        slave-mode;
                                         remote-endpoint = <&ptm0_out_port>;
                                 };
                         };
 
-                        port@2 {
+                        port@1 {
                                 reg = <1>;
                                 funnel_in_port1: endpoint {
-                                        slave-mode;
                                         remote-endpoint = <&ptm1_out_port>;
                                 };
                         };
 
-                        port@3 {
+                        port@2 {
                                 reg = <2>;
                                 funnel_in_port2: endpoint {
-                                        slave-mode;
                                         remote-endpoint = <&etm0_out_port>;
                                 };
                         };
@@ -248,9 +251,11 @@ Example:
                 cpu = <&cpu0>;
                 clocks = <&oscclk6a>;
                 clock-names = "apb_pclk";
-                port {
-                        ptm0_out_port: endpoint {
-                                remote-endpoint = <&funnel_in_port0>;
+                out-ports {
+                        port {
+                                ptm0_out_port: endpoint {
+                                        remote-endpoint = <&funnel_in_port0>;
+                                };
                         };
                 };
         };
@@ -262,9 +267,11 @@ Example:
                 cpu = <&cpu1>;
                 clocks = <&oscclk6a>;
                 clock-names = "apb_pclk";
-                port {
-                        ptm1_out_port: endpoint {
-                                remote-endpoint = <&funnel_in_port1>;
+                out-ports {
+                        port {
+                                ptm1_out_port: endpoint {
+                                        remote-endpoint = <&funnel_in_port1>;
+                                };
                         };
                 };
         };
@@ -278,9 +285,11 @@ Example:
 
                 clocks = <&soc_smc50mhz>;
                 clock-names = "apb_pclk";
-                port {
-                        stm_out_port: endpoint {
-                                remote-endpoint = <&main_funnel_in_port2>;
+                out-ports {
+                        port {
+                                stm_out_port: endpoint {
+                                        remote-endpoint = <&main_funnel_in_port2>;
+                                };
                         };
                 };
         };
@@ -295,10 +304,11 @@ Example:
                 clock-names = "apb_pclk";
 
                 interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
-                port {
-                        catu_in_port: endpoint {
-                                slave-mode;
-                                remote-endpoint = <&etr_out_port>;
+                in-ports {
+                        port {
+                                catu_in_port: endpoint {
+                                        remote-endpoint = <&etr_out_port>;
+                                };
                         };
                 };
         };
diff --git a/Documentation/driver-api/fpga/fpga-bridge.rst b/Documentation/driver-api/fpga/fpga-bridge.rst
index 2c2aaca894bf..71c5a40da320 100644
--- a/Documentation/driver-api/fpga/fpga-bridge.rst
+++ b/Documentation/driver-api/fpga/fpga-bridge.rst
@@ -4,6 +4,12 @@ FPGA Bridge
 API to implement a new FPGA bridge
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
+* struct :c:type:`fpga_bridge` — The FPGA Bridge structure
+* struct :c:type:`fpga_bridge_ops` — Low level Bridge driver ops
+* :c:func:`devm_fpga_bridge_create()` — Allocate and init a bridge struct
+* :c:func:`fpga_bridge_register()` — Register a bridge
+* :c:func:`fpga_bridge_unregister()` — Unregister a bridge
+
 .. kernel-doc:: include/linux/fpga/fpga-bridge.h
    :functions: fpga_bridge
 
@@ -11,39 +17,10 @@ API to implement a new FPGA bridge
    :functions: fpga_bridge_ops
 
 .. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: fpga_bridge_create
-
-.. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: fpga_bridge_free
+   :functions: devm_fpga_bridge_create
 
 .. kernel-doc:: drivers/fpga/fpga-bridge.c
    :functions: fpga_bridge_register
 
 .. kernel-doc:: drivers/fpga/fpga-bridge.c
    :functions: fpga_bridge_unregister
-
-API to control an FPGA bridge
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-
-You probably won't need these directly.  FPGA regions should handle this.
-
-.. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: of_fpga_bridge_get
-
-.. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: fpga_bridge_get
-
-.. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: fpga_bridge_put
-
-.. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: fpga_bridge_get_to_list
-
-.. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: of_fpga_bridge_get_to_list
-
-.. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: fpga_bridge_enable
-
-.. kernel-doc:: drivers/fpga/fpga-bridge.c
-   :functions: fpga_bridge_disable
diff --git a/Documentation/driver-api/fpga/fpga-mgr.rst b/Documentation/driver-api/fpga/fpga-mgr.rst
index 82b6dbbd31cd..576f1945eacd 100644
--- a/Documentation/driver-api/fpga/fpga-mgr.rst
+++ b/Documentation/driver-api/fpga/fpga-mgr.rst
@@ -49,18 +49,14 @@ probe function calls fpga_mgr_register(), such as::
                  * them in priv
                  */
 
-                mgr = fpga_mgr_create(dev, "Altera SOCFPGA FPGA Manager",
-                                      &socfpga_fpga_ops, priv);
+                mgr = devm_fpga_mgr_create(dev, "Altera SOCFPGA FPGA Manager",
+                                           &socfpga_fpga_ops, priv);
                 if (!mgr)
                         return -ENOMEM;
 
                 platform_set_drvdata(pdev, mgr);
 
-                ret = fpga_mgr_register(mgr);
-                if (ret)
-                        fpga_mgr_free(mgr);
-
-                return ret;
+                return fpga_mgr_register(mgr);
         }
 
         static int socfpga_fpga_remove(struct platform_device *pdev)
@@ -102,67 +98,19 @@ The ops include a .state function which will determine the state the FPGA is in
 and return a code of type enum fpga_mgr_states.  It doesn't result in a change
 in state.
 
-How to write an image buffer to a supported FPGA
-------------------------------------------------
-
-Some sample code::
-
-        #include <linux/fpga/fpga-mgr.h>
-
-        struct fpga_manager *mgr;
-        struct fpga_image_info *info;
-        int ret;
-
-        /*
-         * Get a reference to FPGA manager.  The manager is not locked, so you can
-         * hold onto this reference without it preventing programming.
-         *
-         * This example uses the device node of the manager.  Alternatively, use
-         * fpga_mgr_get(dev) instead if you have the device.
-         */
-        mgr = of_fpga_mgr_get(mgr_node);
-
-        /* struct with information about the FPGA image to program. */
-        info = fpga_image_info_alloc(dev);
-
-        /* flags indicates whether to do full or partial reconfiguration */
-        info->flags = FPGA_MGR_PARTIAL_RECONFIG;
-
-        /*
-         * At this point, indicate where the image is. This is pseudo-code; you're
-         * going to use one of these three.
-         */
-        if (image is in a scatter gather table) {
-
-                info->sgt = [your scatter gather table]
-
-        } else if (image is in a buffer) {
-
-                info->buf = [your image buffer]
-                info->count = [image buffer size]
-
-        } else if (image is in a firmware file) {
-
-                info->firmware_name = devm_kstrdup(dev, firmware_name, GFP_KERNEL);
-
-        }
-
-        /* Get exclusive control of FPGA manager */
-        ret = fpga_mgr_lock(mgr);
-
-        /* Load the buffer to the FPGA */
-        ret = fpga_mgr_buf_load(mgr, &info, buf, count);
-
-        /* Release the FPGA manager */
-        fpga_mgr_unlock(mgr);
-        fpga_mgr_put(mgr);
-
-        /* Deallocate the image info if you're done with it */
-        fpga_image_info_free(info);
-
 API for implementing a new FPGA Manager driver
 ----------------------------------------------
 
+* ``fpga_mgr_states`` —  Values for :c:member:`fpga_manager->state`.
+* struct :c:type:`fpga_manager` —  the FPGA manager struct
+* struct :c:type:`fpga_manager_ops` —  Low level FPGA manager driver ops
+* :c:func:`devm_fpga_mgr_create` —  Allocate and init a manager struct
+* :c:func:`fpga_mgr_register` —  Register an FPGA manager
+* :c:func:`fpga_mgr_unregister` —  Unregister an FPGA manager
+
+.. kernel-doc:: include/linux/fpga/fpga-mgr.h
+   :functions: fpga_mgr_states
+
 .. kernel-doc:: include/linux/fpga/fpga-mgr.h
    :functions: fpga_manager
 
@@ -170,56 +118,10 @@ API for implementing a new FPGA Manager driver
    :functions: fpga_manager_ops
 
 .. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_mgr_create
-
-.. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_mgr_free
+   :functions: devm_fpga_mgr_create
 
 .. kernel-doc:: drivers/fpga/fpga-mgr.c
    :functions: fpga_mgr_register
 
 .. kernel-doc:: drivers/fpga/fpga-mgr.c
    :functions: fpga_mgr_unregister
-
-API for programming an FPGA
----------------------------
-
-FPGA Manager flags
-
-.. kernel-doc:: include/linux/fpga/fpga-mgr.h
-   :doc: FPGA Manager flags
-
-.. kernel-doc:: include/linux/fpga/fpga-mgr.h
-   :functions: fpga_image_info
-
-.. kernel-doc:: include/linux/fpga/fpga-mgr.h
-   :functions: fpga_mgr_states
-
-.. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_image_info_alloc
-
-.. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_image_info_free
-
-.. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: of_fpga_mgr_get
-
-.. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_mgr_get
-
-.. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_mgr_put
-
-.. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_mgr_lock
-
-.. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_mgr_unlock
-
-.. kernel-doc:: include/linux/fpga/fpga-mgr.h
-   :functions: fpga_mgr_states
-
-Note - use :c:func:`fpga_region_program_fpga()` instead of :c:func:`fpga_mgr_load()`
-
-.. kernel-doc:: drivers/fpga/fpga-mgr.c
-   :functions: fpga_mgr_load
diff --git a/Documentation/driver-api/fpga/fpga-programming.rst b/Documentation/driver-api/fpga/fpga-programming.rst
new file mode 100644
index 000000000000..b5484df6ff0f
--- /dev/null
+++ b/Documentation/driver-api/fpga/fpga-programming.rst
@@ -0,0 +1,107 @@
+In-kernel API for FPGA Programming
+==================================
+
+Overview
+--------
+
+The in-kernel API for FPGA programming is a combination of APIs from
+FPGA manager, bridge, and regions.  The actual function used to
+trigger FPGA programming is :c:func:`fpga_region_program_fpga()`.
+
+:c:func:`fpga_region_program_fpga()` uses functionality supplied by
+the FPGA manager and bridges.  It will:
+
+ * lock the region's mutex
+ * lock the mutex of the region's FPGA manager
+ * build a list of FPGA bridges if a method has been specified to do so
+ * disable the bridges
+ * program the FPGA using info passed in :c:member:`fpga_region->info`.
+ * re-enable the bridges
+ * release the locks
+
+The struct fpga_image_info specifies what FPGA image to program.  It is
+allocated/freed by :c:func:`fpga_image_info_alloc()` and freed with
+:c:func:`fpga_image_info_free()`
+
+How to program an FPGA using a region
+-------------------------------------
+
+When the FPGA region driver probed, it was given a pointer to an FPGA manager
+driver so it knows which manager to use.  The region also either has a list of
+bridges to control during programming or it has a pointer to a function that
+will generate that list.  Here's some sample code of what to do next::
+
+        #include <linux/fpga/fpga-mgr.h>
+        #include <linux/fpga/fpga-region.h>
+
+        struct fpga_image_info *info;
+        int ret;
+
+        /*
+         * First, alloc the struct with information about the FPGA image to
+         * program.
+         */
+        info = fpga_image_info_alloc(dev);
+        if (!info)
+                return -ENOMEM;
+
+        /* Set flags as needed, such as: */
+        info->flags = FPGA_MGR_PARTIAL_RECONFIG;
+
+        /*
+         * Indicate where the FPGA image is. This is pseudo-code; you're
+         * going to use one of these three.
+         */
+        if (image is in a scatter gather table) {
+
+                info->sgt = [your scatter gather table]
+
+        } else if (image is in a buffer) {
+
+                info->buf = [your image buffer]
+                info->count = [image buffer size]
+
+        } else if (image is in a firmware file) {
+
+                info->firmware_name = devm_kstrdup(dev, firmware_name,
+                                                   GFP_KERNEL);
+
+        }
+
+        /* Add info to region and do the programming */
+        region->info = info;
+        ret = fpga_region_program_fpga(region);
+
+        /* Deallocate the image info if you're done with it */
+        region->info = NULL;
+        fpga_image_info_free(info);
+
+        if (ret)
+                return ret;
+
+        /* Now enumerate whatever hardware has appeared in the FPGA. */
+
+API for programming an FPGA
+---------------------------
+
+* :c:func:`fpga_region_program_fpga` —  Program an FPGA
+* :c:type:`fpga_image_info` —  Specifies what FPGA image to program
+* :c:func:`fpga_image_info_alloc()` —  Allocate an FPGA image info struct
+* :c:func:`fpga_image_info_free()` —  Free an FPGA image info struct
+
+.. kernel-doc:: drivers/fpga/fpga-region.c
+   :functions: fpga_region_program_fpga
+
+FPGA Manager flags
+
+.. kernel-doc:: include/linux/fpga/fpga-mgr.h
+   :doc: FPGA Manager flags
+
+.. kernel-doc:: include/linux/fpga/fpga-mgr.h
+   :functions: fpga_image_info
+
+.. kernel-doc:: drivers/fpga/fpga-mgr.c
+   :functions: fpga_image_info_alloc
+
+.. kernel-doc:: drivers/fpga/fpga-mgr.c
+   :functions: fpga_image_info_free
diff --git a/Documentation/driver-api/fpga/fpga-region.rst b/Documentation/driver-api/fpga/fpga-region.rst
index f30333ce828e..0529b2d2231a 100644
--- a/Documentation/driver-api/fpga/fpga-region.rst
+++ b/Documentation/driver-api/fpga/fpga-region.rst
@@ -34,41 +34,6 @@ fpga_image_info including:
  * flags indicating specifics such as whether the image is for partial
    reconfiguration.
 
-How to program an FPGA using a region
--------------------------------------
-
-First, allocate the info struct::
-
-        info = fpga_image_info_alloc(dev);
-        if (!info)
-                return -ENOMEM;
-
-Set flags as needed, i.e.::
-
-        info->flags |= FPGA_MGR_PARTIAL_RECONFIG;
-
-Point to your FPGA image, such as::
-
-        info->sgt = &sgt;
-
-Add info to region and do the programming::
-
-        region->info = info;
-        ret = fpga_region_program_fpga(region);
-
-:c:func:`fpga_region_program_fpga()` operates on info passed in the
-fpga_image_info (region->info).  This function will attempt to:
-
- * lock the region's mutex
- * lock the region's FPGA manager
- * build a list of FPGA bridges if a method has been specified to do so
- * disable the bridges
- * program the FPGA
- * re-enable the bridges
- * release the locks
-
-Then you will want to enumerate whatever hardware has appeared in the FPGA.
-
 How to add a new FPGA region
 ----------------------------
 
@@ -77,26 +42,62 @@ An example of usage can be seen in the probe function of [#f2]_.
 .. [#f1] ../devicetree/bindings/fpga/fpga-region.txt
 .. [#f2] ../../drivers/fpga/of-fpga-region.c
 
-API to program an FPGA
-----------------------
-
-.. kernel-doc:: drivers/fpga/fpga-region.c
-   :functions: fpga_region_program_fpga
-
 API to add a new FPGA region
 ----------------------------
 
+* struct :c:type:`fpga_region` — The FPGA region struct
+* :c:func:`devm_fpga_region_create` — Allocate and init a region struct
+* :c:func:`fpga_region_register` —  Register an FPGA region
+* :c:func:`fpga_region_unregister` —  Unregister an FPGA region
+
+The FPGA region's probe function will need to get a reference to the FPGA
+Manager it will be using to do the programming.  This usually would happen
+during the region's probe function.
+
+* :c:func:`fpga_mgr_get` — Get a reference to an FPGA manager, raise ref count
+* :c:func:`of_fpga_mgr_get` —  Get a reference to an FPGA manager, raise ref count,
+  given a device node.
+* :c:func:`fpga_mgr_put` — Put an FPGA manager
+
+The FPGA region will need to specify which bridges to control while programming
+the FPGA.  The region driver can build a list of bridges during probe time
+(:c:member:`fpga_region->bridge_list`) or it can have a function that creates
+the list of bridges to program just before programming
+(:c:member:`fpga_region->get_bridges`).  The FPGA bridge framework supplies the
+following APIs to handle building or tearing down that list.
+
+* :c:func:`fpga_bridge_get_to_list` — Get a ref of an FPGA bridge, add it to a
+  list
+* :c:func:`of_fpga_bridge_get_to_list` — Get a ref of an FPGA bridge, add it to a
+  list, given a device node
+* :c:func:`fpga_bridges_put` — Given a list of bridges, put them
+
 .. kernel-doc:: include/linux/fpga/fpga-region.h
    :functions: fpga_region
 
 .. kernel-doc:: drivers/fpga/fpga-region.c
-   :functions: fpga_region_create
-
-.. kernel-doc:: drivers/fpga/fpga-region.c
-   :functions: fpga_region_free
+   :functions: devm_fpga_region_create
 
 .. kernel-doc:: drivers/fpga/fpga-region.c
    :functions: fpga_region_register
 
 .. kernel-doc:: drivers/fpga/fpga-region.c
    :functions: fpga_region_unregister
+
+.. kernel-doc:: drivers/fpga/fpga-mgr.c
+   :functions: fpga_mgr_get
+
+.. kernel-doc:: drivers/fpga/fpga-mgr.c
+   :functions: of_fpga_mgr_get
+
+.. kernel-doc:: drivers/fpga/fpga-mgr.c
+   :functions: fpga_mgr_put
+
+.. kernel-doc:: drivers/fpga/fpga-bridge.c
+   :functions: fpga_bridge_get_to_list
+
+.. kernel-doc:: drivers/fpga/fpga-bridge.c
+   :functions: of_fpga_bridge_get_to_list
+
+.. kernel-doc:: drivers/fpga/fpga-bridge.c
+   :functions: fpga_bridges_put
diff --git a/Documentation/driver-api/fpga/index.rst b/Documentation/driver-api/fpga/index.rst
index c51e5ebd544a..31a4773bd2e6 100644
--- a/Documentation/driver-api/fpga/index.rst
+++ b/Documentation/driver-api/fpga/index.rst
@@ -11,3 +11,5 @@ FPGA Subsystem
    fpga-mgr
    fpga-bridge
    fpga-region
+   fpga-programming
+
diff --git a/Documentation/driver-api/fpga/intro.rst b/Documentation/driver-api/fpga/intro.rst
index 50d1cab84950..f54c7dabcc7d 100644
--- a/Documentation/driver-api/fpga/intro.rst
+++ b/Documentation/driver-api/fpga/intro.rst
@@ -44,7 +44,7 @@ FPGA Region
 -----------
 
 If you are adding a new interface to the FPGA framework, add it on top
-of an FPGA region to allow the most reuse of your interface.
+of an FPGA region.
 
 The FPGA Region framework (fpga-region.c) associates managers and
 bridges as reconfigurable regions.  A region may refer to the whole
diff --git a/Documentation/driver-api/soundwire/stream.rst b/Documentation/driver-api/soundwire/stream.rst
index 29121aa55fb9..26a6064503fd 100644
--- a/Documentation/driver-api/soundwire/stream.rst
+++ b/Documentation/driver-api/soundwire/stream.rst
@@ -101,6 +101,34 @@ interface. ::
         +--------------------+                             |                |
                                                            +----------------+
 
+Example 5: Stereo Stream with L and R channel is rendered by 2 Masters, each
+rendering one channel, and is received by two different Slaves, each
+receiving one channel. Both Masters and both Slaves are using single port. ::
+
+        +---------------+                    Clock Signal  +---------------+
+        |    Master     +----------------------------------+     Slave     |
+        |   Interface   |                                  |   Interface   |
+        |       1       |                                  |       1       |
+        |               |                     Data Signal  |               |
+        |       L       +----------------------------------+       L       |
+        |     (Data)    |     Data Direction               |     (Data)    |
+        +---------------+  +----------------------->       +---------------+
+
+        +---------------+                    Clock Signal  +---------------+
+        |    Master     +----------------------------------+     Slave     |
+        |   Interface   |                                  |   Interface   |
+        |       2       |                                  |       2       |
+        |               |                     Data Signal  |               |
+        |       R       +----------------------------------+       R       |
+        |     (Data)    |     Data Direction               |     (Data)    |
+        +---------------+  +----------------------->       +---------------+
+
+Note: In multi-link cases like above, to lock, one would acquire a global
+lock and then go on locking bus instances. But, in this case the caller
+framework(ASoC DPCM) guarantees that stream operations on a card are
+always serialized. So, there is no race condition and hence no need for
+global lock.
+
 SoundWire Stream Management flow
 ================================
 
@@ -174,6 +202,7 @@ per stream. From ASoC DPCM framework, this stream state maybe linked to
 .startup() operation.
 
   .. code-block:: c
+
   int sdw_alloc_stream(char * stream_name);
 
 
@@ -200,6 +229,7 @@ only be invoked once by respective Master(s) and Slave(s). From ASoC DPCM
 framework, this stream state is linked to .hw_params() operation.
 
   .. code-block:: c
+
   int sdw_stream_add_master(struct sdw_bus * bus,
                 struct sdw_stream_config * stream_config,
                 struct sdw_ports_config * ports_config,
@@ -245,6 +275,7 @@ stream. From ASoC DPCM framework, this stream state is linked to
 .prepare() operation.
 
   .. code-block:: c
+
   int sdw_prepare_stream(struct sdw_stream_runtime * stream);
 
 
@@ -274,6 +305,7 @@ stream. From ASoC DPCM framework, this stream state is linked to
 .trigger() start operation.
 
   .. code-block:: c
+
   int sdw_enable_stream(struct sdw_stream_runtime * stream);
 
 SDW_STREAM_DISABLED
@@ -301,6 +333,7 @@ per stream. From ASoC DPCM framework, this stream state is linked to
 .trigger() stop operation.
 
   .. code-block:: c
+
   int sdw_disable_stream(struct sdw_stream_runtime * stream);
 
 
@@ -325,6 +358,7 @@ per stream. From ASoC DPCM framework, this stream state is linked to
 .trigger() stop operation.
 
   .. code-block:: c
+
   int sdw_deprepare_stream(struct sdw_stream_runtime * stream);
 
 
@@ -349,6 +383,7 @@ all the Master(s) and Slave(s) associated with stream. From ASoC DPCM
 framework, this stream state is linked to .hw_free() operation.
 
   .. code-block:: c
+
   int sdw_stream_remove_master(struct sdw_bus * bus,
                 struct sdw_stream_runtime * stream);
   int sdw_stream_remove_slave(struct sdw_slave * slave,
@@ -361,6 +396,7 @@ stream assigned as part of ALLOCATED state.
 In .shutdown() the data structure maintaining stream state are freed up.
 
   .. code-block:: c
+
   void sdw_release_stream(struct sdw_stream_runtime * stream);
 
 Not Supported
diff --git a/Documentation/driver-api/uio-howto.rst b/Documentation/driver-api/uio-howto.rst
index fb2eb73be4a3..25f50eace28b 100644
--- a/Documentation/driver-api/uio-howto.rst
+++ b/Documentation/driver-api/uio-howto.rst
@@ -463,8 +463,8 @@ Getting information about your UIO device
 
 Information about all UIO devices is available in sysfs. The first thing
 you should do in your driver is check ``name`` and ``version`` to make
-sure your talking to the right device and that its kernel driver has the
-version you expect.
+sure you're talking to the right device and that its kernel driver has
+the version you expect.
 
 You should also make sure that the memory mapping you need exists and
 has the size you expect.
diff --git a/Documentation/nvmem/nvmem.txt b/Documentation/nvmem/nvmem.txt
index 8d8d8f58f96f..fc2fe4b18655 100644
--- a/Documentation/nvmem/nvmem.txt
+++ b/Documentation/nvmem/nvmem.txt
@@ -58,6 +58,37 @@ static int qfprom_probe(struct platform_device *pdev)
 It is mandatory that the NVMEM provider has a regmap associated with its
 struct device. Failure to do would return error code from nvmem_register().
 
+Users of board files can define and register nvmem cells using the
+nvmem_cell_table struct:
+
+static struct nvmem_cell_info foo_nvmem_cells[] = {
+        {
+                .name           = "macaddr",
+                .offset         = 0x7f00,
+                .bytes          = ETH_ALEN,
+        }
+};
+
+static struct nvmem_cell_table foo_nvmem_cell_table = {
+        .nvmem_name             = "i2c-eeprom",
+        .cells                  = foo_nvmem_cells,
+        .ncells                 = ARRAY_SIZE(foo_nvmem_cells),
+};
+
+nvmem_add_cell_table(&foo_nvmem_cell_table);
+
+Additionally it is possible to create nvmem cell lookup entries and register
+them with the nvmem framework from machine code as shown in the example below:
+
+static struct nvmem_cell_lookup foo_nvmem_lookup = {
+        .nvmem_name             = "i2c-eeprom",
+        .cell_name              = "macaddr",
+        .dev_id                 = "foo_mac.0",
+        .con_id                 = "mac-address",
+};
+
+nvmem_add_cell_lookups(&foo_nvmem_lookup, 1);
+
 NVMEM Consumers
 +++++++++++++++
 
diff --git a/Documentation/trace/stm.rst b/Documentation/trace/stm.rst
index 2c22ddb7fd3e..99f99963e5e7 100644
--- a/Documentation/trace/stm.rst
+++ b/Documentation/trace/stm.rst
@@ -1,3 +1,5 @@
+.. SPDX-License-Identifier: GPL-2.0
+
 ===================
 System Trace Module
 ===================
@@ -53,12 +55,30 @@ under "user" directory from the example above and this new rule will
 be used for trace sources with the id string of "user/dummy".
 
 Trace sources have to open the stm class device's node and write their
-trace data into its file descriptor. In order to identify themselves
-to the policy, they need to do a STP_POLICY_ID_SET ioctl on this file
-descriptor providing their id string. Otherwise, they will be
-automatically allocated a master/channel pair upon first write to this
-file descriptor according to the "default" rule of the policy, if such
-exists.
+trace data into its file descriptor.
+
+In order to find an appropriate policy node for a given trace source,
+several mechanisms can be used. First, a trace source can explicitly
+identify itself by calling an STP_POLICY_ID_SET ioctl on the character
+device's file descriptor, providing their id string, before they write
+any data there. Secondly, if they chose not to perform the explicit
+identification (because you may not want to patch existing software
+to do this), they can just start writing the data, at which point the
+stm core will try to find a policy node with the name matching the
+task's name (e.g., "syslogd") and if one exists, it will be used.
+Thirdly, if the task name can't be found among the policy nodes, the
+catch-all entry "default" will be used, if it exists. This entry also
+needs to be created and configured by the system administrator or
+whatever tools are taking care of the policy configuration. Finally,
+if all the above steps failed, the write() to an stm file descriptor
+will return a error (EINVAL).
+
+Previously, if no policy nodes were found for a trace source, the stm
+class would silently fall back to allocating the first available
+contiguous range of master/channels from the beginning of the device's
+master/channel range. The new requirement for a policy node to exist
+will help programmers and sysadmins identify gaps in configuration
+and have better control over the un-identified sources.
 
 Some STM devices may allow direct mapping of the channel mmio regions
 to userspace for zero-copy writing. One mappable page (in terms of
@@ -92,9 +112,9 @@ allocated for the device according to the policy configuration. If
 there's a node in the root of the policy directory that matches the
 stm_source device's name (for example, "console"), this node will be
 used to allocate master and channel numbers. If there's no such policy
-node, the stm core will pick the first contiguous chunk of channels
-within the first available master. Note that the node must exist
-before the stm_source device is connected to its stm device.
+node, the stm core will use the catch-all entry "default", if one
+exists. If neither policy nodes exist, the write() to stm_source_link
+will return an error.
 
 stm_console
 ===========
diff --git a/Documentation/trace/sys-t.rst b/Documentation/trace/sys-t.rst
new file mode 100644
index 000000000000..3d8eb92735e9
--- /dev/null
+++ b/Documentation/trace/sys-t.rst
@@ -0,0 +1,62 @@
+.. SPDX-License-Identifier: GPL-2.0
+
+===================
+MIPI SyS-T over STP
+===================
+
+The MIPI SyS-T protocol driver can be used with STM class devices to
+generate standardized trace stream. Aside from being a standard, it
+provides better trace source identification and timestamp correlation.
+
+In order to use the MIPI SyS-T protocol driver with your STM device,
+first, you'll need CONFIG_STM_PROTO_SYS_T.
+
+Now, you can select which protocol driver you want to use when you create
+a policy for your STM device, by specifying it in the policy name:
+
+# mkdir /config/stp-policy/dummy_stm.0:p_sys-t.my-policy/
+
+In other words, the policy name format is extended like this:
+
+  <device_name>:<protocol_name>.<policy_name>
+
+With Intel TH, therefore it can look like "0-sth:p_sys-t.my-policy".
+
+If the protocol name is omitted, the STM class will chose whichever
+protocol driver was loaded first.
+
+You can also double check that everything is working as expected by
+
+# cat /config/stp-policy/dummy_stm.0:p_sys-t.my-policy/protocol
+p_sys-t
+
+Now, with the MIPI SyS-T protocol driver, each policy node in the
+configfs gets a few additional attributes, which determine per-source
+parameters specific to the protocol:
+
+# mkdir /config/stp-policy/dummy_stm.0:p_sys-t.my-policy/default
+# ls /config/stp-policy/dummy_stm.0:p_sys-t.my-policy/default
+channels
+clocksync_interval
+do_len
+masters
+ts_interval
+uuid
+
+The most important one here is the "uuid", which determines the UUID
+that will be used to tag all data coming from this source. It is
+automatically generated when a new node is created, but it is likely
+that you would want to change it.
+
+do_len switches on/off the additional "payload length" field in the
+MIPI SyS-T message header. It is off by default as the STP already
+marks message boundaries.
+
+ts_interval and clocksync_interval determine how much time in milliseconds
+can pass before we need to include a protocol (not transport, aka STP)
+timestamp in a message header or send a CLOCKSYNC packet, respectively.
+
+See Documentation/ABI/testing/configfs-stp-policy-p_sys-t for more
+details.
+
+* [1] https://www.mipi.org/specifications/sys-t
diff --git a/MAINTAINERS b/MAINTAINERS
index 554941e05171..fdb6a298c7e7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -932,6 +932,7 @@ M:	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 M:      Arve Hjønnevåg <arve@android.com>
 M:      Todd Kjos <tkjos@android.com>
 M:      Martijn Coenen <maco@android.com>
+M:      Joel Fernandes <joel@joelfernandes.org>
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
 L:      devel@driverdev.osuosl.org
 S:      Supported
@@ -13757,7 +13758,7 @@ F:	sound/soc/
 F:      include/sound/soc*
 
 SOUNDWIRE SUBSYSTEM
-M:      Vinod Koul <vinod.koul@intel.com>
+M:      Vinod Koul <vkoul@kernel.org>
 M:      Sanyog Kale <sanyog.r.kale@intel.com>
 R:      Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
@@ -15523,13 +15524,19 @@ F:	arch/x86/um/
 F:      fs/hostfs/
 F:      fs/hppfs/
 
+USERSPACE COPYIN/COPYOUT (UIOVEC)
+M:      Alexander Viro <viro@zeniv.linux.org.uk>
+S:      Maintained
+F:      lib/iov_iter.c
+F:      include/linux/uio.h
+
 USERSPACE I/O (UIO)
 M:      Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 S:      Maintained
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc.git
 F:      Documentation/driver-api/uio-howto.rst
 F:      drivers/uio/
-F:      include/linux/uio*.h
+F:      include/linux/uio_driver.h
 
 UTIL-LINUX PACKAGE
 M:      Karel Zak <kzak@redhat.com>
diff --git a/drivers/android/Kconfig b/drivers/android/Kconfig
index 432e9ad77070..51e8250d113f 100644
--- a/drivers/android/Kconfig
+++ b/drivers/android/Kconfig
@@ -10,7 +10,7 @@ if ANDROID
 
 config ANDROID_BINDER_IPC
         bool "Android Binder IPC Driver"
-        depends on MMU
+        depends on MMU && !CPU_CACHE_VIVT
         default n
         ---help---
           Binder is used in Android for both communication between processes,
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index d58763b6b009..cb30a524d16d 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -71,6 +71,7 @@
 #include <linux/security.h>
 #include <linux/spinlock.h>
 #include <linux/ratelimit.h>
+#include <linux/syscalls.h>
 
 #include <uapi/linux/android/binder.h>
 
@@ -457,9 +458,8 @@ struct binder_ref {
 };
 
 enum binder_deferred_state {
-        BINDER_DEFERRED_PUT_FILES    = 0x01,
-        BINDER_DEFERRED_FLUSH        = 0x02,
-        BINDER_DEFERRED_RELEASE      = 0x04,
+        BINDER_DEFERRED_FLUSH        = 0x01,
+        BINDER_DEFERRED_RELEASE      = 0x02,
 };
 
 /**
@@ -480,9 +480,6 @@ enum binder_deferred_state {
  *                        (invariant after initialized)
  * @tsk                   task_struct for group_leader of process
  *                        (invariant after initialized)
- * @files                 files_struct for process
- *                        (protected by @files_lock)
- * @files_lock            mutex to protect @files
  * @deferred_work_node:   element for binder_deferred_list
  *                        (protected by binder_deferred_lock)
  * @deferred_work:        bitmap of deferred work to perform
@@ -527,8 +524,6 @@ struct binder_proc {
         struct list_head waiting_threads;
         int pid;
         struct task_struct *tsk;
-        struct files_struct *files;
-        struct mutex files_lock;
         struct hlist_node deferred_work_node;
         int deferred_work;
         bool is_dead;
@@ -611,6 +606,23 @@ struct binder_thread {
         bool is_dead;
 };
 
+/**
+ * struct binder_txn_fd_fixup - transaction fd fixup list element
+ * @fixup_entry:          list entry
+ * @file:                 struct file to be associated with new fd
+ * @offset:               offset in buffer data to this fixup
+ *
+ * List element for fd fixups in a transaction. Since file
+ * descriptors need to be allocated in the context of the
+ * target process, we pass each fd to be processed in this
+ * struct.
+ */
+struct binder_txn_fd_fixup {
+        struct list_head fixup_entry;
+        struct file *file;
+        size_t offset;
+};
+
 struct binder_transaction {
         int debug_id;
         struct binder_work work;
@@ -628,6 +640,7 @@ struct binder_transaction {
         long    priority;
         long    saved_priority;
         kuid_t  sender_euid;
+        struct list_head fd_fixups;
         /**
          * @lock:  protects @from, @to_proc, and @to_thread
          *
@@ -822,6 +835,7 @@ static void
 binder_enqueue_deferred_thread_work_ilocked(struct binder_thread *thread,
                                             struct binder_work *work)
 {
+        WARN_ON(!list_empty(&thread->waiting_thread_node));
         binder_enqueue_work_ilocked(work, &thread->todo);
 }
 
@@ -839,6 +853,7 @@ static void
 binder_enqueue_thread_work_ilocked(struct binder_thread *thread,
                                    struct binder_work *work)
 {
+        WARN_ON(!list_empty(&thread->waiting_thread_node));
         binder_enqueue_work_ilocked(work, &thread->todo);
         thread->process_todo = true;
 }
@@ -920,66 +935,6 @@ static void binder_free_thread(struct binder_thread *thread);
 static void binder_free_proc(struct binder_proc *proc);
 static void binder_inc_node_tmpref_ilocked(struct binder_node *node);
 
-static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
-{
-        unsigned long rlim_cur;
-        unsigned long irqs;
-        int ret;
-
-        mutex_lock(&proc->files_lock);
-        if (proc->files == NULL) {
-                ret = -ESRCH;
-                goto err;
-        }
-        if (!lock_task_sighand(proc->tsk, &irqs)) {
-                ret = -EMFILE;
-                goto err;
-        }
-        rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
-        unlock_task_sighand(proc->tsk, &irqs);
-
-        ret = __alloc_fd(proc->files, 0, rlim_cur, flags);
-err:
-        mutex_unlock(&proc->files_lock);
-        return ret;
-}
-
-/*
- * copied from fd_install
- */
-static void task_fd_install(
-        struct binder_proc *proc, unsigned int fd, struct file *file)
-{
-        mutex_lock(&proc->files_lock);
-        if (proc->files)
-                __fd_install(proc->files, fd, file);
-        mutex_unlock(&proc->files_lock);
-}
-
-/*
- * copied from sys_close
- */
-static long task_close_fd(struct binder_proc *proc, unsigned int fd)
-{
-        int retval;
-
-        mutex_lock(&proc->files_lock);
-        if (proc->files == NULL) {
-                retval = -ESRCH;
-                goto err;
-        }
-        retval = __close_fd(proc->files, fd);
-        /* can't restart close syscall because file table entry was cleared */
-        if (unlikely(retval == -ERESTARTSYS ||
-                     retval == -ERESTARTNOINTR ||
-                     retval == -ERESTARTNOHAND ||
-                     retval == -ERESTART_RESTARTBLOCK))
-                retval = -EINTR;
-err:
-        mutex_unlock(&proc->files_lock);
-        return retval;
-}
-
 static bool binder_has_work_ilocked(struct binder_thread *thread,
                                     bool do_proc_work)
 {
@@ -1270,19 +1225,12 @@ static int binder_inc_node_nilocked(struct binder_node *node, int strong,
                 } else
                         node->local_strong_refs++;
                 if (!node->has_strong_ref && target_list) {
+                        struct binder_thread *thread = container_of(target_list,
+                                                    struct binder_thread, todo);
                         binder_dequeue_work_ilocked(&node->work);
-                        /*
-                         * Note: this function is the only place where we queue
-                         * directly to a thread->todo without using the
-                         * corresponding binder_enqueue_thread_work() helper
-                         * functions; in this case it's ok to not set the
-                         * process_todo flag, since we know this node work will
-                         * always be followed by other work that starts queue
-                         * processing: in case of synchronous transactions, a
-                         * BR_REPLY or BR_ERROR; in case of oneway
-                         * transactions, a BR_TRANSACTION_COMPLETE.
-                         */
-                        binder_enqueue_work_ilocked(&node->work, target_list);
+                        BUG_ON(&thread->todo != target_list);
+                        binder_enqueue_deferred_thread_work_ilocked(thread,
+                                                                   &node->work);
                 }
         } else {
                 if (!internal)
@@ -1958,10 +1906,32 @@ static struct binder_thread *binder_get_txn_from_and_acq_inner(
         return NULL;
 }
 
+/**
+ * binder_free_txn_fixups() - free unprocessed fd fixups
+ * @t:  binder transaction for t->from
+ *
+ * If the transaction is being torn down prior to being
+ * processed by the target process, free all of the
+ * fd fixups and fput the file structs. It is safe to
+ * call this function after the fixups have been
+ * processed -- in that case, the list will be empty.
+ */
+static void binder_free_txn_fixups(struct binder_transaction *t)
+{
+        struct binder_txn_fd_fixup *fixup, *tmp;
+
+        list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
+                fput(fixup->file);
+                list_del(&fixup->fixup_entry);
+                kfree(fixup);
+        }
+}
+
 static void binder_free_transaction(struct binder_transaction *t)
 {
         if (t->buffer)
                 t->buffer->transaction = NULL;
+        binder_free_txn_fixups(t);
         kfree(t);
         binder_stats_deleted(BINDER_STAT_TRANSACTION);
 }
@@ -2262,12 +2232,17 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                 } break;
 
                 case BINDER_TYPE_FD: {
-                        struct binder_fd_object *fp = to_binder_fd_object(hdr);
-
-                        binder_debug(BINDER_DEBUG_TRANSACTION,
-                                     "        fd %d\n", fp->fd);
-                        if (failed_at)
-                                task_close_fd(proc, fp->fd);
+                        /*
+                         * No need to close the file here since user-space
+                         * closes it for for successfully delivered
+                         * transactions. For transactions that weren't
+                         * delivered, the new fd was never allocated so
+                         * there is no need to close and the fput on the
+                         * file is done when the transaction is torn
+                         * down.
+                         */
+                        WARN_ON(failed_at &&
+                                proc->tsk == current->group_leader);
                 } break;
                 case BINDER_TYPE_PTR:
                         /*
@@ -2283,6 +2258,15 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                         size_t fd_index;
                         binder_size_t fd_buf_size;
 
+                        if (proc->tsk != current->group_leader) {
+                                /*
+                                 * Nothing to do if running in sender context
+                                 * The fd fixups have not been applied so no
+                                 * fds need to be closed.
+                                 */
+                                continue;
+                        }
+
                         fda = to_binder_fd_array_object(hdr);
                         parent = binder_validate_ptr(buffer, fda->parent,
                                                      off_start,
@@ -2315,7 +2299,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
                         }
                         fd_array = (u32 *)(parent_buffer + (uintptr_t)fda->parent_offset);
                         for (fd_index = 0; fd_index < fda->num_fds; fd_index++)
-                                task_close_fd(proc, fd_array[fd_index]);
+                                ksys_close(fd_array[fd_index]);
                 } break;
                 default:
                         pr_err("transaction release %d bad object type %x\n",
@@ -2447,17 +2431,18 @@ done:
         return ret;
 }
 
-static int binder_translate_fd(int fd,
+static int binder_translate_fd(u32 *fdp,
                                struct binder_transaction *t,
                                struct binder_thread *thread,
                                struct binder_transaction *in_reply_to)
 {
         struct binder_proc *proc = thread->proc;
         struct binder_proc *target_proc = t->to_proc;
-        int target_fd;
+        struct binder_txn_fd_fixup *fixup;
         struct file *file;
-        int ret;
+        int ret = 0;
         bool target_allows_fd;
+        int fd = *fdp;
 
         if (in_reply_to)
                 target_allows_fd = !!(in_reply_to->flags & TF_ACCEPT_FDS);
@@ -2485,19 +2470,24 @@ static int binder_translate_fd(int fd,
                 goto err_security;
         }
 
-        target_fd = task_get_unused_fd_flags(target_proc, O_CLOEXEC);
-        if (target_fd < 0) {
+        /*
+         * Add fixup record for this transaction. The allocation
+         * of the fd in the target needs to be done from a
+         * target thread.
+         */
+        fixup = kzalloc(sizeof(*fixup), GFP_KERNEL);
+        if (!fixup) {
                 ret = -ENOMEM;
-                goto err_get_unused_fd;
+                goto err_alloc;
         }
-        task_fd_install(target_proc, target_fd, file);
-        trace_binder_transaction_fd(t, fd, target_fd);
-        binder_debug(BINDER_DEBUG_TRANSACTION, "        fd %d -> %d\n",
-                     fd, target_fd);
+        fixup->file = file;
+        fixup->offset = (uintptr_t)fdp - (uintptr_t)t->buffer->data;
+        trace_binder_transaction_fd_send(t, fd, fixup->offset);
+        list_add_tail(&fixup->fixup_entry, &t->fd_fixups);
 
-        return target_fd;
+        return ret;
 
-err_get_unused_fd:
+err_alloc:
 err_security:
         fput(file);
 err_fget:
@@ -2511,8 +2501,7 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,
                                      struct binder_thread *thread,
                                      struct binder_transaction *in_reply_to)
 {
-        binder_size_t fdi, fd_buf_size, num_installed_fds;
-        int target_fd;
+        binder_size_t fdi, fd_buf_size;
         uintptr_t parent_buffer;
         u32 *fd_array;
         struct binder_proc *proc = thread->proc;
@@ -2544,23 +2533,12 @@ static int binder_translate_fd_array(struct binder_fd_array_object *fda,
                 return -EINVAL;
         }
         for (fdi = 0; fdi < fda->num_fds; fdi++) {
-                target_fd = binder_translate_fd(fd_array[fdi], t, thread,
+                int ret = binder_translate_fd(&fd_array[fdi], t, thread,
                                                 in_reply_to);
-                if (target_fd < 0)
-                        goto err_translate_fd_failed;
-                fd_array[fdi] = target_fd;
+                if (ret < 0)
+                        return ret;
         }
         return 0;
-
-err_translate_fd_failed:
-        /*
-         * Failed to allocate fd or security error, free fds
-         * installed so far.
-         */
-        num_installed_fds = fdi;
-        for (fdi = 0; fdi < num_installed_fds; fdi++)
-                task_close_fd(target_proc, fd_array[fdi]);
-        return target_fd;
 }
 
 static int binder_fixup_parent(struct binder_transaction *t,
@@ -2723,6 +2701,7 @@ static void binder_transaction(struct binder_proc *proc,
 {
         int ret;
         struct binder_transaction *t;
+        struct binder_work *w;
         struct binder_work *tcomplete;
         binder_size_t *offp, *off_end, *off_start;
         binder_size_t off_min;
@@ -2864,6 +2843,29 @@ static void binder_transaction(struct binder_proc *proc,
                         goto err_invalid_target_handle;
                 }
                 binder_inner_proc_lock(proc);
+
+                w = list_first_entry_or_null(&thread->todo,
+                                             struct binder_work, entry);
+                if (!(tr->flags & TF_ONE_WAY) && w &&
+                    w->type == BINDER_WORK_TRANSACTION) {
+                        /*
+                         * Do not allow new outgoing transaction from a
+                         * thread that has a transaction at the head of
+                         * its todo list. Only need to check the head
+                         * because binder_select_thread_ilocked picks a
+                         * thread from proc->waiting_threads to enqueue
+                         * the transaction, and nothing is queued to the
+                         * todo list while the thread is on waiting_threads.
+                         */
+                        binder_user_error("%d:%d new transaction not allowed when there is a transaction on thread todo\n",
+                                          proc->pid, thread->pid);
+                        binder_inner_proc_unlock(proc);
+                        return_error = BR_FAILED_REPLY;
+                        return_error_param = -EPROTO;
+                        return_error_line = __LINE__;
+                        goto err_bad_todo_list;
+                }
+
                 if (!(tr->flags & TF_ONE_WAY) && thread->transaction_stack) {
                         struct binder_transaction *tmp;
 
@@ -2911,6 +2913,7 @@ static void binder_transaction(struct binder_proc *proc,
                 return_error_line = __LINE__;
                 goto err_alloc_t_failed;
         }
+        INIT_LIST_HEAD(&t->fd_fixups);
         binder_stats_created(BINDER_STAT_TRANSACTION);
         spin_lock_init(&t->lock);
 
@@ -3066,17 +3069,16 @@ static void binder_transaction(struct binder_proc *proc,
 
                 case BINDER_TYPE_FD: {
                         struct binder_fd_object *fp = to_binder_fd_object(hdr);
-                        int target_fd = binder_translate_fd(fp->fd, t, thread,
-                                                            in_reply_to);
+                        int ret = binder_translate_fd(&fp->fd, t, thread,
+                                                      in_reply_to);
 
-                        if (target_fd < 0) {
+                        if (ret < 0) {
                                 return_error = BR_FAILED_REPLY;
-                                return_error_param = target_fd;
+                                return_error_param = ret;
                                 return_error_line = __LINE__;
                                 goto err_translate_failed;
                         }
                         fp->pad_binder = 0;
-                        fp->fd = target_fd;
                 } break;
                 case BINDER_TYPE_FDA: {
                         struct binder_fd_array_object *fda =
@@ -3233,6 +3235,7 @@ err_bad_object_type:
 err_bad_offset:
 err_bad_parent:
 err_copy_data_failed:
+        binder_free_txn_fixups(t);
         trace_binder_transaction_failed_buffer_release(t->buffer);
         binder_transaction_buffer_release(target_proc, t->buffer, offp);
         if (target_node)
@@ -3247,6 +3250,7 @@ err_alloc_tcomplete_failed:
         kfree(t);
         binder_stats_deleted(BINDER_STAT_TRANSACTION);
 err_alloc_t_failed:
+err_bad_todo_list:
 err_bad_call_stack:
 err_empty_call_stack:
 err_dead_binder:
@@ -3294,6 +3298,47 @@ err_invalid_target_handle:
         }
 }
 
+/**
+ * binder_free_buf() - free the specified buffer
+ * @proc:       binder proc that owns buffer
+ * @buffer:     buffer to be freed
+ *
+ * If buffer for an async transaction, enqueue the next async
+ * transaction from the node.
+ *
+ * Cleanup buffer and free it.
+ */
+static void
+binder_free_buf(struct binder_proc *proc, struct binder_buffer *buffer)
+{
+        if (buffer->transaction) {
+                buffer->transaction->buffer = NULL;
+                buffer->transaction = NULL;
+        }
+        if (buffer->async_transaction && buffer->target_node) {
+                struct binder_node *buf_node;
+                struct binder_work *w;
+
+                buf_node = buffer->target_node;
+                binder_node_inner_lock(buf_node);
+                BUG_ON(!buf_node->has_async_transaction);
+                BUG_ON(buf_node->proc != proc);
+                w = binder_dequeue_work_head_ilocked(
+                                &buf_node->async_todo);
+                if (!w) {
+                        buf_node->has_async_transaction = false;
+                } else {
+                        binder_enqueue_work_ilocked(
+                                        w, &proc->todo);
+                        binder_wakeup_proc_ilocked(proc);
+                }
+                binder_node_inner_unlock(buf_node);
+        }
+        trace_binder_transaction_buffer_release(buffer);
+        binder_transaction_buffer_release(proc, buffer, NULL);
+        binder_alloc_free_buf(&proc->alloc, buffer);
+}
+
 static int binder_thread_write(struct binder_proc *proc,
                         struct binder_thread *thread,
                         binder_uintptr_t binder_buffer, size_t size,
@@ -3480,33 +3525,7 @@ static int binder_thread_write(struct binder_proc *proc,
                                      proc->pid, thread->pid, (u64)data_ptr,
                                      buffer->debug_id,
                                      buffer->transaction ? "active" : "finished");
-
-                        if (buffer->transaction) {
-                                buffer->transaction->buffer = NULL;
-                                buffer->transaction = NULL;
-                        }
-                        if (buffer->async_transaction && buffer->target_node) {
-                                struct binder_node *buf_node;
-                                struct binder_work *w;
-
-                                buf_node = buffer->target_node;
-                                binder_node_inner_lock(buf_node);
-                                BUG_ON(!buf_node->has_async_transaction);
-                                BUG_ON(buf_node->proc != proc);
-                                w = binder_dequeue_work_head_ilocked(
-                                                &buf_node->async_todo);
-                                if (!w) {
-                                        buf_node->has_async_transaction = false;
-                                } else {
-                                        binder_enqueue_work_ilocked(
-                                                        w, &proc->todo);
-                                        binder_wakeup_proc_ilocked(proc);
-                                }
-                                binder_node_inner_unlock(buf_node);
-                        }
-                        trace_binder_transaction_buffer_release(buffer);
-                        binder_transaction_buffer_release(proc, buffer, NULL);
-                        binder_alloc_free_buf(&proc->alloc, buffer);
+                        binder_free_buf(proc, buffer);
                         break;
                 }
 
@@ -3829,6 +3848,76 @@ static int binder_wait_for_work(struct binder_thread *thread,
         return ret;
 }
 
+/**
+ * binder_apply_fd_fixups() - finish fd translation
+ * @t:  binder transaction with list of fd fixups
+ *
+ * Now that we are in the context of the transaction target
+ * process, we can allocate and install fds. Process the
+ * list of fds to translate and fixup the buffer with the
+ * new fds.
+ *
+ * If we fail to allocate an fd, then free the resources by
+ * fput'ing files that have not been processed and ksys_close'ing
+ * any fds that have already been allocated.
+ */
+static int binder_apply_fd_fixups(struct binder_transaction *t)
+{
+        struct binder_txn_fd_fixup *fixup, *tmp;
+        int ret = 0;
+
+        list_for_each_entry(fixup, &t->fd_fixups, fixup_entry) {
+                int fd = get_unused_fd_flags(O_CLOEXEC);
+                u32 *fdp;
+
+                if (fd < 0) {
+                        binder_debug(BINDER_DEBUG_TRANSACTION,
+                                     "failed fd fixup txn %d fd %d\n",
+                                     t->debug_id, fd);
+                        ret = -ENOMEM;
+                        break;
+                }
+                binder_debug(BINDER_DEBUG_TRANSACTION,
+                             "fd fixup txn %d fd %d\n",
+                             t->debug_id, fd);
+                trace_binder_transaction_fd_recv(t, fd, fixup->offset);
+                fd_install(fd, fixup->file);
+                fixup->file = NULL;
+                fdp = (u32 *)(t->buffer->data + fixup->offset);
+                /*
+                 * This store can cause problems for CPUs with a
+                 * VIVT cache (eg ARMv5) since the cache cannot
+                 * detect virtual aliases to the same physical cacheline.
+                 * To support VIVT, this address and the user-space VA
+                 * would both need to be flushed. Since this kernel
+                 * VA is not constructed via page_to_virt(), we can't
+                 * use flush_dcache_page() on it, so we'd have to use
+                 * an internal function. If devices with VIVT ever
+                 * need to run Android, we'll either need to go back
+                 * to patching the translated fd from the sender side
+                 * (using the non-standard kernel functions), or rework
+                 * how the kernel uses the buffer to use page_to_virt()
+                 * addresses instead of allocating in our own vm area.
+                 *
+                 * For now, we disable compilation if CONFIG_CPU_CACHE_VIVT.
+                 */
+                *fdp = fd;
+        }
+        list_for_each_entry_safe(fixup, tmp, &t->fd_fixups, fixup_entry) {
+                if (fixup->file) {
+                        fput(fixup->file);
+                } else if (ret) {
+                        u32 *fdp = (u32 *)(t->buffer->data + fixup->offset);
+
+                        ksys_close(*fdp);
+                }
+                list_del(&fixup->fixup_entry);
+                kfree(fixup);
+        }
+
+        return ret;
+}
+
 static int binder_thread_read(struct binder_proc *proc,
                               struct binder_thread *thread,
                               binder_uintptr_t binder_buffer, size_t size,
@@ -4110,6 +4199,34 @@ retry:
                         tr.sender_pid = 0;
                 }
 
+                ret = binder_apply_fd_fixups(t);
+                if (ret) {
+                        struct binder_buffer *buffer = t->buffer;
+                        bool oneway = !!(t->flags & TF_ONE_WAY);
+                        int tid = t->debug_id;
+
+                        if (t_from)
+                                binder_thread_dec_tmpref(t_from);
+                        buffer->transaction = NULL;
+                        binder_cleanup_transaction(t, "fd fixups failed",
+                                                   BR_FAILED_REPLY);
+                        binder_free_buf(proc, buffer);
+                        binder_debug(BINDER_DEBUG_FAILED_TRANSACTION,
+                                     "%d:%d %stransaction %d fd fixups failed %d/%d, line %d\n",
+                                     proc->pid, thread->pid,
+                                     oneway ? "async " :
+                                        (cmd == BR_REPLY ? "reply " : ""),
+                                     tid, BR_FAILED_REPLY, ret, __LINE__);
+                        if (cmd == BR_REPLY) {
+                                cmd = BR_FAILED_REPLY;
+                                if (put_user(cmd, (uint32_t __user *)ptr))
+                                        return -EFAULT;
+                                ptr += sizeof(uint32_t);
+                                binder_stat_br(proc, thread, cmd);
+                                break;
+                        }
+                        continue;
+                }
                 tr.data_size = t->buffer->data_size;
                 tr.offsets_size = t->buffer->offsets_size;
                 tr.data.ptr.buffer = (binder_uintptr_t)
@@ -4544,6 +4661,42 @@ out:
         return ret;
 }
 
+static int binder_ioctl_get_node_info_for_ref(struct binder_proc *proc,
+                struct binder_node_info_for_ref *info)
+{
+        struct binder_node *node;
+        struct binder_context *context = proc->context;
+        __u32 handle = info->handle;
+
+        if (info->strong_count || info->weak_count || info->reserved1 ||
+            info->reserved2 || info->reserved3) {
+                binder_user_error("%d BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero.",
+                                  proc->pid);
+                return -EINVAL;
+        }
+
+        /* This ioctl may only be used by the context manager */
+        mutex_lock(&context->context_mgr_node_lock);
+        if (!context->binder_context_mgr_node ||
+                context->binder_context_mgr_node->proc != proc) {
+                mutex_unlock(&context->context_mgr_node_lock);
+                return -EPERM;
+        }
+        mutex_unlock(&context->context_mgr_node_lock);
+
+        node = binder_get_node_from_ref(proc, handle, true, NULL);
+        if (!node)
+                return -EINVAL;
+
+        info->strong_count = node->local_strong_refs +
+                node->internal_strong_refs;
+        info->weak_count = node->local_weak_refs;
+
+        binder_put_node(node);
+
+        return 0;
+}
+
 static int binder_ioctl_get_node_debug_info(struct binder_proc *proc,
                                 struct binder_node_debug_info *info)
 {
@@ -4638,6 +4791,25 @@ static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
                 }
                 break;
         }
+        case BINDER_GET_NODE_INFO_FOR_REF: {
+                struct binder_node_info_for_ref info;
+
+                if (copy_from_user(&info, ubuf, sizeof(info))) {
+                        ret = -EFAULT;
+                        goto err;
+                }
+
+                ret = binder_ioctl_get_node_info_for_ref(proc, &info);
+                if (ret < 0)
+                        goto err;
+
+                if (copy_to_user(ubuf, &info, sizeof(info))) {
+                        ret = -EFAULT;
+                        goto err;
+                }
+
+                break;
+        }
         case BINDER_GET_NODE_DEBUG_INFO: {
                 struct binder_node_debug_info info;
 
@@ -4693,7 +4865,6 @@ static void binder_vma_close(struct vm_area_struct *vma)
                      (vma->vm_end - vma->vm_start) / SZ_1K, vma->vm_flags,
                      (unsigned long)pgprot_val(vma->vm_page_prot));
         binder_alloc_vma_close(&proc->alloc);
-        binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
 }
 
 static vm_fault_t binder_vm_fault(struct vm_fault *vmf)
@@ -4739,9 +4910,6 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
         ret = binder_alloc_mmap_handler(&proc->alloc, vma);
         if (ret)
                 return ret;
-        mutex_lock(&proc->files_lock);
-        proc->files = get_files_struct(current);
-        mutex_unlock(&proc->files_lock);
         return 0;
 
 err_bad_arg:
@@ -4765,7 +4933,6 @@ static int binder_open(struct inode *nodp, struct file *filp)
         spin_lock_init(&proc->outer_lock);
         get_task_struct(current->group_leader);
         proc->tsk = current->group_leader;
-        mutex_init(&proc->files_lock);
         INIT_LIST_HEAD(&proc->todo);
         proc->default_priority = task_nice(current);
         binder_dev = container_of(filp->private_data, struct binder_device,
@@ -4915,8 +5082,6 @@ static void binder_deferred_release(struct binder_proc *proc)
         struct rb_node *n;
         int threads, nodes, incoming_refs, outgoing_refs, active_transactions;
 
-        BUG_ON(proc->files);
-
         mutex_lock(&binder_procs_lock);
         hlist_del(&proc->proc_node);
         mutex_unlock(&binder_procs_lock);
@@ -4998,7 +5163,6 @@ static void binder_deferred_release(struct binder_proc *proc)
 static void binder_deferred_func(struct work_struct *work)
 {
         struct binder_proc *proc;
-        struct files_struct *files;
 
         int defer;
 
@@ -5016,23 +5180,11 @@ static void binder_deferred_func(struct work_struct *work)
                 }
                 mutex_unlock(&binder_deferred_lock);
 
-                files = NULL;
-                if (defer & BINDER_DEFERRED_PUT_FILES) {
-                        mutex_lock(&proc->files_lock);
-                        files = proc->files;
-                        if (files)
-                                proc->files = NULL;
-                        mutex_unlock(&proc->files_lock);
-                }
-
                 if (defer & BINDER_DEFERRED_FLUSH)
                         binder_deferred_flush(proc);
 
                 if (defer & BINDER_DEFERRED_RELEASE)
                         binder_deferred_release(proc); /* frees proc */
-
-                if (files)
-                        put_files_struct(files);
         } while (proc);
 }
 static DECLARE_WORK(binder_deferred_work, binder_deferred_func);
@@ -5667,12 +5819,11 @@ static int __init binder_init(void)
          * Copy the module_parameter string, because we don't want to
          * tokenize it in-place.
          */
-        device_names = kzalloc(strlen(binder_devices_param) + 1, GFP_KERNEL);
+        device_names = kstrdup(binder_devices_param, GFP_KERNEL);
         if (!device_names) {
                 ret = -ENOMEM;
                 goto err_alloc_device_names_failed;
         }
-        strcpy(device_names, binder_devices_param);
 
         device_tmp = device_names;
         while ((device_name = strsep(&device_tmp, ","))) {
diff --git a/drivers/android/binder_trace.h b/drivers/android/binder_trace.h
index 588eb3ec3507..14de7ac57a34 100644
--- a/drivers/android/binder_trace.h
+++ b/drivers/android/binder_trace.h
@@ -223,22 +223,40 @@ TRACE_EVENT(binder_transaction_ref_to_ref,
                   __entry->dest_ref_debug_id, __entry->dest_ref_desc)
 );
 
-TRACE_EVENT(binder_transaction_fd,
-        TP_PROTO(struct binder_transaction *t, int src_fd, int dest_fd),
-        TP_ARGS(t, src_fd, dest_fd),
+TRACE_EVENT(binder_transaction_fd_send,
+        TP_PROTO(struct binder_transaction *t, int fd, size_t offset),
+        TP_ARGS(t, fd, offset),
 
         TP_STRUCT__entry(
                 __field(int, debug_id)
-                __field(int, src_fd)
-                __field(int, dest_fd)
+                __field(int, fd)
+                __field(size_t, offset)
+        ),
+        TP_fast_assign(
+                __entry->debug_id = t->debug_id;
+                __entry->fd = fd;
+                __entry->offset = offset;
+        ),
+        TP_printk("transaction=%d src_fd=%d offset=%zu",
+                  __entry->debug_id, __entry->fd, __entry->offset)
+);
+
+TRACE_EVENT(binder_transaction_fd_recv,
+        TP_PROTO(struct binder_transaction *t, int fd, size_t offset),
+        TP_ARGS(t, fd, offset),
+
+        TP_STRUCT__entry(
+                __field(int, debug_id)
+                __field(int, fd)
+                __field(size_t, offset)
         ),
         TP_fast_assign(
                 __entry->debug_id = t->debug_id;
-                __entry->src_fd = src_fd;
-                __entry->dest_fd = dest_fd;
+                __entry->fd = fd;
+                __entry->offset = offset;
         ),
-        TP_printk("transaction=%d src_fd=%d ==> dest_fd=%d",
-                  __entry->debug_id, __entry->src_fd, __entry->dest_fd)
+        TP_printk("transaction=%d dest_fd=%d offset=%zu",
+                  __entry->debug_id, __entry->fd, __entry->offset)
 );
 
 DECLARE_EVENT_CLASS(binder_buffer_class,
diff --git a/drivers/extcon/extcon-intel-cht-wc.c b/drivers/extcon/extcon-intel-cht-wc.c
index 5e1dd2772278..5ef215297101 100644
--- a/drivers/extcon/extcon-intel-cht-wc.c
+++ b/drivers/extcon/extcon-intel-cht-wc.c
@@ -1,18 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Extcon charger detection driver for Intel Cherrytrail Whiskey Cove PMIC
  * Copyright (C) 2017 Hans de Goede <hdegoede@redhat.com>
  *
  * Based on various non upstream patches to support the CHT Whiskey Cove PMIC:
  * Copyright (C) 2013-2015 Intel Corporation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms and conditions of the GNU General Public License,
- * version 2, as published by the Free Software Foundation.
- *
- * This program is distributed in the hope it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
- * more details.
  */
 
 #include <linux/extcon-provider.h>
@@ -32,10 +24,10 @@
 #define CHT_WC_CHGRCTRL0_EMRGCHREN      BIT(1)
 #define CHT_WC_CHGRCTRL0_EXTCHRDIS      BIT(2)
 #define CHT_WC_CHGRCTRL0_SWCONTROL      BIT(3)
-#define CHT_WC_CHGRCTRL0_TTLCK_MASK     BIT(4)
-#define CHT_WC_CHGRCTRL0_CCSM_OFF_MASK  BIT(5)
-#define CHT_WC_CHGRCTRL0_DBPOFF_MASK    BIT(6)
-#define CHT_WC_CHGRCTRL0_WDT_NOKICK     BIT(7)
+#define CHT_WC_CHGRCTRL0_TTLCK          BIT(4)
+#define CHT_WC_CHGRCTRL0_CCSM_OFF       BIT(5)
+#define CHT_WC_CHGRCTRL0_DBPOFF         BIT(6)
+#define CHT_WC_CHGRCTRL0_CHR_WDT_NOKICK BIT(7)
 
 #define CHT_WC_CHGRCTRL1                0x5e17
 
@@ -52,7 +44,7 @@
 #define CHT_WC_USBSRC_TYPE_ACA          4
 #define CHT_WC_USBSRC_TYPE_SE1          5
 #define CHT_WC_USBSRC_TYPE_MHL          6
-#define CHT_WC_USBSRC_TYPE_FLOAT_DP_DN  7
+#define CHT_WC_USBSRC_TYPE_FLOATING     7
 #define CHT_WC_USBSRC_TYPE_OTHER        8
 #define CHT_WC_USBSRC_TYPE_DCP_EXTPHY   9
 
@@ -61,9 +53,12 @@
 #define CHT_WC_PWRSRC_STS               0x6e1e
 #define CHT_WC_PWRSRC_VBUS              BIT(0)
 #define CHT_WC_PWRSRC_DC                BIT(1)
-#define CHT_WC_PWRSRC_BAT               BIT(2)
-#define CHT_WC_PWRSRC_ID_GND            BIT(3)
-#define CHT_WC_PWRSRC_ID_FLOAT          BIT(4)
+#define CHT_WC_PWRSRC_BATT              BIT(2)
+#define CHT_WC_PWRSRC_USBID_MASK        GENMASK(4, 3)
+#define CHT_WC_PWRSRC_USBID_SHIFT       3
+#define CHT_WC_PWRSRC_RID_ACA           0
+#define CHT_WC_PWRSRC_RID_GND           1
+#define CHT_WC_PWRSRC_RID_FLOAT         2
 
 #define CHT_WC_VBUS_GPIO_CTLO           0x6e2d
 #define CHT_WC_VBUS_GPIO_CTLO_OUTPUT    BIT(0)
@@ -104,16 +99,20 @@ struct cht_wc_extcon_data {
 
 static int cht_wc_extcon_get_id(struct cht_wc_extcon_data *ext, int pwrsrc_sts)
 {
-        if (pwrsrc_sts & CHT_WC_PWRSRC_ID_GND)
+        switch ((pwrsrc_sts & CHT_WC_PWRSRC_USBID_MASK) >> CHT_WC_PWRSRC_USBID_SHIFT) {
+        case CHT_WC_PWRSRC_RID_GND:
                 return USB_ID_GND;
-        if (pwrsrc_sts & CHT_WC_PWRSRC_ID_FLOAT)
+        case CHT_WC_PWRSRC_RID_FLOAT:
                 return USB_ID_FLOAT;
-
-        /*
-         * Once we have iio support for the gpadc we should read the USBID
-         * gpadc channel here and determine ACA role based on that.
-         */
-        return USB_ID_FLOAT;
+        case CHT_WC_PWRSRC_RID_ACA:
+        default:
+                /*
+                 * Once we have IIO support for the GPADC we should read
+                 * the USBID GPADC channel here and determine ACA role
+                 * based on that.
+                 */
+                return USB_ID_FLOAT;
+        }
 }
 
 static int cht_wc_extcon_get_charger(struct cht_wc_extcon_data *ext,
@@ -156,9 +155,9 @@ static int cht_wc_extcon_get_charger(struct cht_wc_extcon_data *ext,
                 dev_warn(ext->dev,
                         "Unhandled charger type %d, defaulting to SDP\n",
                          ret);
-                /* Fall through, treat as SDP */
+                return EXTCON_CHG_USB_SDP;
         case CHT_WC_USBSRC_TYPE_SDP:
-        case CHT_WC_USBSRC_TYPE_FLOAT_DP_DN:
+        case CHT_WC_USBSRC_TYPE_FLOATING:
         case CHT_WC_USBSRC_TYPE_OTHER:
                 return EXTCON_CHG_USB_SDP;
         case CHT_WC_USBSRC_TYPE_CDP:
@@ -279,7 +278,7 @@ static int cht_wc_extcon_sw_control(struct cht_wc_extcon_data *ext, bool enable)
 {
         int ret, mask, val;
 
-        mask = CHT_WC_CHGRCTRL0_SWCONTROL | CHT_WC_CHGRCTRL0_CCSM_OFF_MASK;
+        mask = CHT_WC_CHGRCTRL0_SWCONTROL | CHT_WC_CHGRCTRL0_CCSM_OFF;
         val = enable ? mask : 0;
         ret = regmap_update_bits(ext->regmap, CHT_WC_CHGRCTRL0, mask, val);
         if (ret)
@@ -292,6 +291,7 @@ static int cht_wc_extcon_probe(struct platform_device *pdev)
 {
         struct intel_soc_pmic *pmic = dev_get_drvdata(pdev->dev.parent);
         struct cht_wc_extcon_data *ext;
+        unsigned long mask = ~(CHT_WC_PWRSRC_VBUS | CHT_WC_PWRSRC_USBID_MASK);
         int irq, ret;
 
         irq = platform_get_irq(pdev, 0);
@@ -352,9 +352,7 @@ static int cht_wc_extcon_probe(struct platform_device *pdev)
         }
 
         /* Unmask irqs */
-        ret = regmap_write(ext->regmap, CHT_WC_PWRSRC_IRQ_MASK,
-                           (int)~(CHT_WC_PWRSRC_VBUS | CHT_WC_PWRSRC_ID_GND |
-                                  CHT_WC_PWRSRC_ID_FLOAT));
+        ret = regmap_write(ext->regmap, CHT_WC_PWRSRC_IRQ_MASK, mask);
         if (ret) {
                 dev_err(ext->dev, "Error writing irq-mask: %d\n", ret);
                 goto disable_sw_control;
diff --git a/drivers/extcon/extcon-intel-int3496.c b/drivers/extcon/extcon-intel-int3496.c
index fd24debe58a3..80c9abcc3f97 100644
--- a/drivers/extcon/extcon-intel-int3496.c
+++ b/drivers/extcon/extcon-intel-int3496.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Intel INT3496 ACPI device extcon driver
  *
@@ -7,15 +8,6 @@
  *
  * Copyright (c) 2014, Intel Corporation.
  * Author: David Cohen <david.a.cohen@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <linux/acpi.h>
@@ -192,4 +184,4 @@ module_platform_driver(int3496_driver);
 
 MODULE_AUTHOR("Hans de Goede <hdegoede@redhat.com>");
 MODULE_DESCRIPTION("Intel INT3496 ACPI device extcon driver");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/extcon/extcon-max14577.c b/drivers/extcon/extcon-max14577.c
index b871836da8a4..22d2feb1f8bc 100644
--- a/drivers/extcon/extcon-max14577.c
+++ b/drivers/extcon/extcon-max14577.c
@@ -1,20 +1,10 @@
-/*
- * extcon-max14577.c - MAX14577/77836 extcon driver to support MUIC
- *
- * Copyright (C) 2013,2014 Samsung Electronics
- * Chanwoo Choi <cw00.choi@samsung.com>
- * Krzysztof Kozlowski <krzk@kernel.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
+// SPDX-License-Identifier: GPL-2.0+
+//
+// extcon-max14577.c - MAX14577/77836 extcon driver to support MUIC
+//
+// Copyright (C) 2013,2014 Samsung Electronics
+// Chanwoo Choi <cw00.choi@samsung.com>
+// Krzysztof Kozlowski <krzk@kernel.org>
 
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
index 227651ff9666..a79537ebb671 100644
--- a/drivers/extcon/extcon-max77693.c
+++ b/drivers/extcon/extcon-max77693.c
@@ -1,19 +1,9 @@
-/*
- * extcon-max77693.c - MAX77693 extcon driver to support MAX77693 MUIC
- *
- * Copyright (C) 2012 Samsung Electrnoics
- * Chanwoo Choi <cw00.choi@samsung.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
+// SPDX-License-Identifier: GPL-2.0+
+//
+// extcon-max77693.c - MAX77693 extcon driver to support MAX77693 MUIC
+//
+// Copyright (C) 2012 Samsung Electrnoics
+// Chanwoo Choi <cw00.choi@samsung.com>
 
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/drivers/extcon/extcon-max77843.c b/drivers/extcon/extcon-max77843.c
index c9fcd6cd41cb..b98cbd0362f5 100644
--- a/drivers/extcon/extcon-max77843.c
+++ b/drivers/extcon/extcon-max77843.c
@@ -1,15 +1,10 @@
-/*
- * extcon-max77843.c - Maxim MAX77843 extcon driver to support
- *                      MUIC(Micro USB Interface Controller)
- *
- * Copyright (C) 2015 Samsung Electronics
- * Author: Jaewon Kim <jaewon02.kim@samsung.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- */
+// SPDX-License-Identifier: GPL-2.0+
+//
+// extcon-max77843.c - Maxim MAX77843 extcon driver to support
+//                      MUIC(Micro USB Interface Controller)
+//
+// Copyright (C) 2015 Samsung Electronics
+// Author: Jaewon Kim <jaewon02.kim@samsung.com>
 
 #include <linux/extcon-provider.h>
 #include <linux/i2c.h>
diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c
index 9f30f4929b72..bdabb2479e0d 100644
--- a/drivers/extcon/extcon-max8997.c
+++ b/drivers/extcon/extcon-max8997.c
@@ -1,19 +1,9 @@
-/*
- * extcon-max8997.c - MAX8997 extcon driver to support MAX8997 MUIC
- *
- *  Copyright (C) 2012 Samsung Electronics
- *  Donggeun Kim <dg77.kim@samsung.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
+// SPDX-License-Identifier: GPL-2.0+
+//
+// extcon-max8997.c - MAX8997 extcon driver to support MAX8997 MUIC
+//
+//  Copyright (C) 2012 Samsung Electronics
+//  Donggeun Kim <dg77.kim@samsung.com>
 
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
index b9d27c8fe57e..5ab0498be652 100644
--- a/drivers/extcon/extcon.c
+++ b/drivers/extcon/extcon.c
@@ -628,7 +628,7 @@ int extcon_get_property(struct extcon_dev *edev, unsigned int id,
         unsigned long flags;
         int index, ret = 0;
 
-        *prop_val = (union extcon_property_value)(0);
+        *prop_val = (union extcon_property_value){0};
 
         if (!edev)
                 return -EINVAL;
@@ -1123,7 +1123,6 @@ int extcon_dev_register(struct extcon_dev *edev)
                         (unsigned long)atomic_inc_return(&edev_no));
 
         if (edev->max_supported) {
-                char buf[10];
                 char *str;
                 struct extcon_cable *cable;
 
@@ -1137,9 +1136,7 @@ int extcon_dev_register(struct extcon_dev *edev)
                 for (index = 0; index < edev->max_supported; index++) {
                         cable = &edev->cables[index];
 
-                        snprintf(buf, 10, "cable.%d", index);
-                        str = kzalloc(strlen(buf) + 1,
-                                      GFP_KERNEL);
+                        str = kasprintf(GFP_KERNEL, "cable.%d", index);
                         if (!str) {
                                 for (index--; index >= 0; index--) {
                                         cable = &edev->cables[index];
@@ -1149,7 +1146,6 @@ int extcon_dev_register(struct extcon_dev *edev)
 
                                 goto err_alloc_cables;
                         }
-                        strcpy(str, buf);
 
                         cable->edev = edev;
                         cable->cable_index = index;
@@ -1172,7 +1168,6 @@ int extcon_dev_register(struct extcon_dev *edev)
         }
 
         if (edev->max_supported && edev->mutually_exclusive) {
-                char buf[80];
                 char *name;
 
                 /* Count the size of mutually_exclusive array */
@@ -1197,9 +1192,8 @@ int extcon_dev_register(struct extcon_dev *edev)
                 }
 
                 for (index = 0; edev->mutually_exclusive[index]; index++) {
-                        sprintf(buf, "0x%x", edev->mutually_exclusive[index]);
-                        name = kzalloc(strlen(buf) + 1,
-                                       GFP_KERNEL);
+                        name = kasprintf(GFP_KERNEL, "0x%x",
+                                         edev->mutually_exclusive[index]);
                         if (!name) {
                                 for (index--; index >= 0; index--) {
                                         kfree(edev->d_attrs_muex[index].attr.
@@ -1210,7 +1204,6 @@ int extcon_dev_register(struct extcon_dev *edev)
                                 ret = -ENOMEM;
                                 goto err_muex;
                         }
-                        strcpy(name, buf);
                         sysfs_attr_init(&edev->d_attrs_muex[index].attr);
                         edev->d_attrs_muex[index].attr.name = name;
                         edev->d_attrs_muex[index].attr.mode = 0000;
diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig
index a456a000048b..91a0404affe2 100644
--- a/drivers/firmware/google/Kconfig
+++ b/drivers/firmware/google/Kconfig
@@ -10,37 +10,31 @@ if GOOGLE_FIRMWARE
 
 config GOOGLE_SMI
         tristate "SMI interface for Google platforms"
-        depends on X86 && ACPI && DMI && EFI
-        select EFI_VARS
+        depends on X86 && ACPI && DMI
         help
           Say Y here if you want to enable SMI callbacks for Google
           platforms.  This provides an interface for writing to and
-          clearing the EFI event log and reading and writing NVRAM
+          clearing the event log.  If EFI_VARS is also enabled this
+          driver provides an interface for reading and writing NVRAM
           variables.
 
 config GOOGLE_COREBOOT_TABLE
-        tristate
-        depends on GOOGLE_COREBOOT_TABLE_ACPI || GOOGLE_COREBOOT_TABLE_OF
-
-config GOOGLE_COREBOOT_TABLE_ACPI
-        tristate "Coreboot Table Access - ACPI"
-        depends on ACPI
-        select GOOGLE_COREBOOT_TABLE
+        tristate "Coreboot Table Access"
+        depends on ACPI || OF
         help
           This option enables the coreboot_table module, which provides other
-          firmware modules to access to the coreboot table. The coreboot table
-          pointer is accessed through the ACPI "GOOGCB00" object.
+          firmware modules access to the coreboot table. The coreboot table
+          pointer is accessed through the ACPI "GOOGCB00" object or the
+          device tree node /firmware/coreboot.
           If unsure say N.
 
+config GOOGLE_COREBOOT_TABLE_ACPI
+        tristate
+        select GOOGLE_COREBOOT_TABLE
+
 config GOOGLE_COREBOOT_TABLE_OF
-        tristate "Coreboot Table Access - Device Tree"
-        depends on OF
+        tristate
         select GOOGLE_COREBOOT_TABLE
-        help
-          This option enable the coreboot_table module, which provide other
-          firmware modules to access coreboot table. The coreboot table pointer
-          is accessed through the device tree node /firmware/coreboot.
-          If unsure say N.
 
 config GOOGLE_MEMCONSOLE
         tristate
diff --git a/drivers/firmware/google/Makefile b/drivers/firmware/google/Makefile
index d0b3fba96194..d17caded5d88 100644
--- a/drivers/firmware/google/Makefile
+++ b/drivers/firmware/google/Makefile
@@ -2,8 +2,6 @@
 
 obj-$(CONFIG_GOOGLE_SMI)                += gsmi.o
 obj-$(CONFIG_GOOGLE_COREBOOT_TABLE)        += coreboot_table.o
-obj-$(CONFIG_GOOGLE_COREBOOT_TABLE_ACPI)   += coreboot_table-acpi.o
-obj-$(CONFIG_GOOGLE_COREBOOT_TABLE_OF)     += coreboot_table-of.o
 obj-$(CONFIG_GOOGLE_FRAMEBUFFER_COREBOOT)  += framebuffer-coreboot.o
 obj-$(CONFIG_GOOGLE_MEMCONSOLE)            += memconsole.o
 obj-$(CONFIG_GOOGLE_MEMCONSOLE_COREBOOT)   += memconsole-coreboot.o
diff --git a/drivers/firmware/google/coreboot_table-acpi.c b/drivers/firmware/google/coreboot_table-acpi.c
deleted file mode 100644
index 77197fe3d42f..000000000000
--- a/drivers/firmware/google/coreboot_table-acpi.c
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * coreboot_table-acpi.c
- *
- * Using ACPI to locate Coreboot table and provide coreboot table access.
- *
- * Copyright 2017 Google Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License v2.0 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/acpi.h>
-#include <linux/device.h>
-#include <linux/err.h>
-#include <linux/init.h>
-#include <linux/io.h>
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/platform_device.h>
-
-#include "coreboot_table.h"
-
-static int coreboot_table_acpi_probe(struct platform_device *pdev)
-{
-        phys_addr_t phyaddr;
-        resource_size_t len;
-        struct coreboot_table_header __iomem *header = NULL;
-        struct resource *res;
-        void __iomem *ptr = NULL;
-
-        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (!res)
-                return -EINVAL;
-
-        len = resource_size(res);
-        if (!res->start || !len)
-                return -EINVAL;
-
-        phyaddr = res->start;
-        header = ioremap_cache(phyaddr, sizeof(*header));
-        if (header == NULL)
-                return -ENOMEM;
-
-        ptr = ioremap_cache(phyaddr,
-                            header->header_bytes + header->table_bytes);
-        iounmap(header);
-        if (!ptr)
-                return -ENOMEM;
-
-        return coreboot_table_init(&pdev->dev, ptr);
-}
-
-static int coreboot_table_acpi_remove(struct platform_device *pdev)
-{
-        return coreboot_table_exit();
-}
-
-static const struct acpi_device_id cros_coreboot_acpi_match[] = {
-        { "GOOGCB00", 0 },
-        { "BOOT0000", 0 },
-        { }
-};
-MODULE_DEVICE_TABLE(acpi, cros_coreboot_acpi_match);
-
-static struct platform_driver coreboot_table_acpi_driver = {
-        .probe = coreboot_table_acpi_probe,
-        .remove = coreboot_table_acpi_remove,
-        .driver = {
-                .name = "coreboot_table_acpi",
-                .acpi_match_table = ACPI_PTR(cros_coreboot_acpi_match),
-        },
-};
-
-static int __init coreboot_table_acpi_init(void)
-{
-        return platform_driver_register(&coreboot_table_acpi_driver);
-}
-
-module_init(coreboot_table_acpi_init);
-
-MODULE_AUTHOR("Google, Inc.");
-MODULE_LICENSE("GPL");
diff --git a/drivers/firmware/google/coreboot_table-of.c b/drivers/firmware/google/coreboot_table-of.c
deleted file mode 100644
index f15bf404c579..000000000000
--- a/drivers/firmware/google/coreboot_table-of.c
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * coreboot_table-of.c
- *
- * Coreboot table access through open firmware.
- *
- * Copyright 2017 Google Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License v2.0 as published by
- * the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- */
-
-#include <linux/device.h>
-#include <linux/io.h>
-#include <linux/module.h>
-#include <linux/of_address.h>
-#include <linux/of_platform.h>
-#include <linux/platform_device.h>
-
-#include "coreboot_table.h"
-
-static int coreboot_table_of_probe(struct platform_device *pdev)
-{
-        struct device_node *fw_dn = pdev->dev.of_node;
-        void __iomem *ptr;
-
-        ptr = of_iomap(fw_dn, 0);
-        of_node_put(fw_dn);
-        if (!ptr)
-                return -ENOMEM;
-
-        return coreboot_table_init(&pdev->dev, ptr);
-}
-
-static int coreboot_table_of_remove(struct platform_device *pdev)
-{
-        return coreboot_table_exit();
-}
-
-static const struct of_device_id coreboot_of_match[] = {
-        { .compatible = "coreboot" },
-        {},
-};
-
-static struct platform_driver coreboot_table_of_driver = {
-        .probe = coreboot_table_of_probe,
-        .remove = coreboot_table_of_remove,
-        .driver = {
-                .name = "coreboot_table_of",
-                .of_match_table = coreboot_of_match,
-        },
-};
-
-static int __init platform_coreboot_table_of_init(void)
-{
-        struct platform_device *pdev;
-        struct device_node *of_node;
-
-        /* Limit device creation to the presence of /firmware/coreboot node */
-        of_node = of_find_node_by_path("/firmware/coreboot");
-        if (!of_node)
-                return -ENODEV;
-
-        if (!of_match_node(coreboot_of_match, of_node))
-                return -ENODEV;
-
-        pdev = of_platform_device_create(of_node, "coreboot_table_of", NULL);
-        if (!pdev)
-                return -ENODEV;
-
-        return platform_driver_register(&coreboot_table_of_driver);
-}
-
-module_init(platform_coreboot_table_of_init);
-
-MODULE_AUTHOR("Google, Inc.");
-MODULE_LICENSE("GPL");
diff --git a/drivers/firmware/google/coreboot_table.c b/drivers/firmware/google/coreboot_table.c
index 19db5709ae28..078d3bbe632f 100644
--- a/drivers/firmware/google/coreboot_table.c
+++ b/drivers/firmware/google/coreboot_table.c
@@ -16,12 +16,15 @@
  * GNU General Public License for more details.
  */
 
+#include <linux/acpi.h>
 #include <linux/device.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/io.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/of.h>
+#include <linux/platform_device.h>
 #include <linux/slab.h>
 
 #include "coreboot_table.h"
@@ -29,8 +32,6 @@
 #define CB_DEV(d) container_of(d, struct coreboot_device, dev)
 #define CB_DRV(d) container_of(d, struct coreboot_driver, drv)
 
-static struct coreboot_table_header __iomem *ptr_header;
-
 static int coreboot_bus_match(struct device *dev, struct device_driver *drv)
 {
         struct coreboot_device *device = CB_DEV(dev);
@@ -70,12 +71,6 @@ static struct bus_type coreboot_bus_type = {
         .remove         = coreboot_bus_remove,
 };
 
-static int __init coreboot_bus_init(void)
-{
-        return bus_register(&coreboot_bus_type);
-}
-module_init(coreboot_bus_init);
-
 static void coreboot_device_release(struct device *dev)
 {
         struct coreboot_device *device = CB_DEV(dev);
@@ -97,62 +92,117 @@ void coreboot_driver_unregister(struct coreboot_driver *driver)
 }
 EXPORT_SYMBOL(coreboot_driver_unregister);
 
-int coreboot_table_init(struct device *dev, void __iomem *ptr)
+static int coreboot_table_populate(struct device *dev, void *ptr)
 {
         int i, ret;
         void *ptr_entry;
         struct coreboot_device *device;
-        struct coreboot_table_entry entry;
-        struct coreboot_table_header header;
-
-        ptr_header = ptr;
-        memcpy_fromio(&header, ptr_header, sizeof(header));
-
-        if (strncmp(header.signature, "LBIO", sizeof(header.signature))) {
-                pr_warn("coreboot_table: coreboot table missing or corrupt!\n");
-                return -ENODEV;
-        }
+        struct coreboot_table_entry *entry;
+        struct coreboot_table_header *header = ptr;
 
-        ptr_entry = (void *)ptr_header + header.header_bytes;
-        for (i = 0; i < header.table_entries; i++) {
-                memcpy_fromio(&entry, ptr_entry, sizeof(entry));
+        ptr_entry = ptr + header->header_bytes;
+        for (i = 0; i < header->table_entries; i++) {
+                entry = ptr_entry;
 
-                device = kzalloc(sizeof(struct device) + entry.size, GFP_KERNEL);
-                if (!device) {
-                        ret = -ENOMEM;
-                        break;
-                }
+                device = kzalloc(sizeof(struct device) + entry->size, GFP_KERNEL);
+                if (!device)
+                        return -ENOMEM;
 
                 dev_set_name(&device->dev, "coreboot%d", i);
                 device->dev.parent = dev;
                 device->dev.bus = &coreboot_bus_type;
                 device->dev.release = coreboot_device_release;
-                memcpy_fromio(&device->entry, ptr_entry, entry.size);
+                memcpy(&device->entry, ptr_entry, entry->size);
 
                 ret = device_register(&device->dev);
                 if (ret) {
                         put_device(&device->dev);
-                        break;
+                        return ret;
                 }
 
-                ptr_entry += entry.size;
+                ptr_entry += entry->size;
         }
 
-        return ret;
+        return 0;
 }
-EXPORT_SYMBOL(coreboot_table_init);
 
-int coreboot_table_exit(void)
+static int coreboot_table_probe(struct platform_device *pdev)
 {
-        if (ptr_header) {
-                bus_unregister(&coreboot_bus_type);
-                iounmap(ptr_header);
-                ptr_header = NULL;
+        resource_size_t len;
+        struct coreboot_table_header *header;
+        struct resource *res;
+        struct device *dev = &pdev->dev;
+        void *ptr;
+        int ret;
+
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -EINVAL;
+
+        len = resource_size(res);
+        if (!res->start || !len)
+                return -EINVAL;
+
+        /* Check just the header first to make sure things are sane */
+        header = memremap(res->start, sizeof(*header), MEMREMAP_WB);
+        if (!header)
+                return -ENOMEM;
+
+        len = header->header_bytes + header->table_bytes;
+        ret = strncmp(header->signature, "LBIO", sizeof(header->signature));
+        memunmap(header);
+        if (ret) {
+                dev_warn(dev, "coreboot table missing or corrupt!\n");
+                return -ENODEV;
         }
 
+        ptr = memremap(res->start, len, MEMREMAP_WB);
+        if (!ptr)
+                return -ENOMEM;
+
+        ret = bus_register(&coreboot_bus_type);
+        if (!ret) {
+                ret = coreboot_table_populate(dev, ptr);
+                if (ret)
+                        bus_unregister(&coreboot_bus_type);
+        }
+        memunmap(ptr);
+
+        return ret;
+}
+
+static int coreboot_table_remove(struct platform_device *pdev)
+{
+        bus_unregister(&coreboot_bus_type);
         return 0;
 }
-EXPORT_SYMBOL(coreboot_table_exit);
 
+#ifdef CONFIG_ACPI
+static const struct acpi_device_id cros_coreboot_acpi_match[] = {
+        { "GOOGCB00", 0 },
+        { "BOOT0000", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(acpi, cros_coreboot_acpi_match);
+#endif
+
+#ifdef CONFIG_OF
+static const struct of_device_id coreboot_of_match[] = {
+        { .compatible = "coreboot" },
+        {}
+};
+MODULE_DEVICE_TABLE(of, coreboot_of_match);
+#endif
+
+static struct platform_driver coreboot_table_driver = {
+        .probe = coreboot_table_probe,
+        .remove = coreboot_table_remove,
+        .driver = {
+                .name = "coreboot_table",
+                .acpi_match_table = ACPI_PTR(cros_coreboot_acpi_match),
+                .of_match_table = of_match_ptr(coreboot_of_match),
+        },
+};
+module_platform_driver(coreboot_table_driver);
 MODULE_AUTHOR("Google, Inc.");
 MODULE_LICENSE("GPL");
diff --git a/drivers/firmware/google/coreboot_table.h b/drivers/firmware/google/coreboot_table.h
index 8ad95a94481b..71a9de6b15fa 100644
--- a/drivers/firmware/google/coreboot_table.h
+++ b/drivers/firmware/google/coreboot_table.h
@@ -91,10 +91,4 @@ int coreboot_driver_register(struct coreboot_driver *driver);
 /* Unregister a driver that uses the data from a coreboot table. */
 void coreboot_driver_unregister(struct coreboot_driver *driver);
 
-/* Initialize coreboot table module given a pointer to iomem */
-int coreboot_table_init(struct device *dev, void __iomem *ptr);
-
-/* Cleanup coreboot table module */
-int coreboot_table_exit(void);
-
 #endif /* __COREBOOT_TABLE_H */
diff --git a/drivers/firmware/google/gsmi.c b/drivers/firmware/google/gsmi.c
index c8f169bf2e27..82ce1e6d261e 100644
--- a/drivers/firmware/google/gsmi.c
+++ b/drivers/firmware/google/gsmi.c
@@ -29,6 +29,7 @@
 #include <linux/efi.h>
 #include <linux/module.h>
 #include <linux/ucs2_string.h>
+#include <linux/suspend.h>
 
 #define GSMI_SHUTDOWN_CLEAN     0       /* Clean Shutdown */
 /* TODO(mikew@google.com): Tie in HARDLOCKUP_DETECTOR with NMIWDT */
@@ -70,6 +71,8 @@
 #define GSMI_CMD_SET_NVRAM_VAR          0x03
 #define GSMI_CMD_SET_EVENT_LOG          0x08
 #define GSMI_CMD_CLEAR_EVENT_LOG        0x09
+#define GSMI_CMD_LOG_S0IX_SUSPEND       0x0a
+#define GSMI_CMD_LOG_S0IX_RESUME        0x0b
 #define GSMI_CMD_CLEAR_CONFIG           0x20
 #define GSMI_CMD_HANDSHAKE_TYPE         0xC1
 
@@ -84,7 +87,7 @@ struct gsmi_buf {
         u32 address;                    /* physical address of buffer */
 };
 
-struct gsmi_device {
+static struct gsmi_device {
         struct platform_device *pdev;   /* platform device */
         struct gsmi_buf *name_buf;      /* variable name buffer */
         struct gsmi_buf *data_buf;      /* generic data buffer */
@@ -122,7 +125,6 @@ struct gsmi_log_entry_type_1 {
         u32     instance;
 } __packed;
 
-
 /*
  * Some platforms don't have explicit SMI handshake
  * and need to wait for SMI to complete.
@@ -133,6 +135,15 @@ module_param(spincount, uint, 0600);
 MODULE_PARM_DESC(spincount,
         "The number of loop iterations to use when using the spin handshake.");
 
+/*
+ * Platforms might not support S0ix logging in their GSMI handlers. In order to
+ * avoid any side-effects of generating an SMI for S0ix logging, use the S0ix
+ * related GSMI commands only for those platforms that explicitly enable this
+ * option.
+ */
+static bool s0ix_logging_enable;
+module_param(s0ix_logging_enable, bool, 0600);
+
 static struct gsmi_buf *gsmi_buf_alloc(void)
 {
         struct gsmi_buf *smibuf;
@@ -289,6 +300,10 @@ static int gsmi_exec(u8 func, u8 sub)
         return rc;
 }
 
+#ifdef CONFIG_EFI_VARS
+
+static struct efivars efivars;
+
 static efi_status_t gsmi_get_variable(efi_char16_t *name,
                                       efi_guid_t *vendor, u32 *attr,
                                       unsigned long *data_size,
@@ -466,6 +481,8 @@ static const struct efivar_operations efivar_ops = {
         .get_next_variable = gsmi_get_next_variable,
 };
 
+#endif /* CONFIG_EFI_VARS */
+
 static ssize_t eventlog_write(struct file *filp, struct kobject *kobj,
                                struct bin_attribute *bin_attr,
                                char *buf, loff_t pos, size_t count)
@@ -480,11 +497,10 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj,
         if (count < sizeof(u32))
                 return -EINVAL;
         param.type = *(u32 *)buf;
-        count -= sizeof(u32);
         buf += sizeof(u32);
 
         /* The remaining buffer is the data payload */
-        if (count > gsmi_dev.data_buf->length)
+        if ((count - sizeof(u32)) > gsmi_dev.data_buf->length)
                 return -EINVAL;
         param.data_len = count - sizeof(u32);
 
@@ -504,7 +520,7 @@ static ssize_t eventlog_write(struct file *filp, struct kobject *kobj,
 
         spin_unlock_irqrestore(&gsmi_dev.lock, flags);
 
-        return rc;
+        return (rc == 0) ? count : rc;
 
 }
 
@@ -716,6 +732,12 @@ static const struct dmi_system_id gsmi_dmi_table[] __initconst = {
                         DMI_MATCH(DMI_BOARD_VENDOR, "Google, Inc."),
                 },
         },
+        {
+                .ident = "Coreboot Firmware",
+                .matches = {
+                        DMI_MATCH(DMI_BIOS_VENDOR, "coreboot"),
+                },
+        },
         {}
 };
 MODULE_DEVICE_TABLE(dmi, gsmi_dmi_table);
@@ -762,7 +784,6 @@ static __init int gsmi_system_valid(void)
 }
 
 static struct kobject *gsmi_kobj;
-static struct efivars efivars;
 
 static const struct platform_device_info gsmi_dev_info = {
         .name           = "gsmi",
@@ -771,6 +792,78 @@ static const struct platform_device_info gsmi_dev_info = {
         .dma_mask       = DMA_BIT_MASK(32),
 };
 
+#ifdef CONFIG_PM
+static void gsmi_log_s0ix_info(u8 cmd)
+{
+        unsigned long flags;
+
+        /*
+         * If platform has not enabled S0ix logging, then no action is
+         * necessary.
+         */
+        if (!s0ix_logging_enable)
+                return;
+
+        spin_lock_irqsave(&gsmi_dev.lock, flags);
+
+        memset(gsmi_dev.param_buf->start, 0, gsmi_dev.param_buf->length);
+
+        gsmi_exec(GSMI_CALLBACK, cmd);
+
+        spin_unlock_irqrestore(&gsmi_dev.lock, flags);
+}
+
+static int gsmi_log_s0ix_suspend(struct device *dev)
+{
+        /*
+         * If system is not suspending via firmware using the standard ACPI Sx
+         * types, then make a GSMI call to log the suspend info.
+         */
+        if (!pm_suspend_via_firmware())
+                gsmi_log_s0ix_info(GSMI_CMD_LOG_S0IX_SUSPEND);
+
+        /*
+         * Always return success, since we do not want suspend
+         * to fail just because of logging failure.
+         */
+        return 0;
+}
+
+static int gsmi_log_s0ix_resume(struct device *dev)
+{
+        /*
+         * If system did not resume via firmware, then make a GSMI call to log
+         * the resume info and wake source.
+         */
+        if (!pm_resume_via_firmware())
+                gsmi_log_s0ix_info(GSMI_CMD_LOG_S0IX_RESUME);
+
+        /*
+         * Always return success, since we do not want resume
+         * to fail just because of logging failure.
+         */
+        return 0;
+}
+
+static const struct dev_pm_ops gsmi_pm_ops = {
+        .suspend_noirq = gsmi_log_s0ix_suspend,
+        .resume_noirq = gsmi_log_s0ix_resume,
+};
+
+static int gsmi_platform_driver_probe(struct platform_device *dev)
+{
+        return 0;
+}
+
+static struct platform_driver gsmi_driver_info = {
+        .driver = {
+                .name = "gsmi",
+                .pm = &gsmi_pm_ops,
+        },
+        .probe = gsmi_platform_driver_probe,
+};
+#endif
+
 static __init int gsmi_init(void)
 {
         unsigned long flags;
@@ -782,6 +875,14 @@ static __init int gsmi_init(void)
 
         gsmi_dev.smi_cmd = acpi_gbl_FADT.smi_command;
 
+#ifdef CONFIG_PM
+        ret = platform_driver_register(&gsmi_driver_info);
+        if (unlikely(ret)) {
+                printk(KERN_ERR "gsmi: unable to register platform driver\n");
+                return ret;
+        }
+#endif
+
         /* register device */
         gsmi_dev.pdev = platform_device_register_full(&gsmi_dev_info);
         if (IS_ERR(gsmi_dev.pdev)) {
@@ -886,11 +987,14 @@ static __init int gsmi_init(void)
                 goto out_remove_bin_file;
         }
 
+#ifdef CONFIG_EFI_VARS
         ret = efivars_register(&efivars, &efivar_ops, gsmi_kobj);
         if (ret) {
                 printk(KERN_INFO "gsmi: Failed to register efivars\n");
-                goto out_remove_sysfs_files;
+                sysfs_remove_files(gsmi_kobj, gsmi_attrs);
+                goto out_remove_bin_file;
         }
+#endif
 
         register_reboot_notifier(&gsmi_reboot_notifier);
         register_die_notifier(&gsmi_die_notifier);
@@ -901,8 +1005,6 @@ static __init int gsmi_init(void)
 
         return 0;
 
-out_remove_sysfs_files:
-        sysfs_remove_files(gsmi_kobj, gsmi_attrs);
 out_remove_bin_file:
         sysfs_remove_bin_file(gsmi_kobj, &eventlog_bin_attr);
 out_err:
@@ -922,7 +1024,9 @@ static void __exit gsmi_exit(void)
         unregister_die_notifier(&gsmi_die_notifier);
         atomic_notifier_chain_unregister(&panic_notifier_list,
                                          &gsmi_panic_notifier);
+#ifdef CONFIG_EFI_VARS
         efivars_unregister(&efivars);
+#endif
 
         sysfs_remove_files(gsmi_kobj, gsmi_attrs);
         sysfs_remove_bin_file(gsmi_kobj, &eventlog_bin_attr);
diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 1aa67bb5d8c0..c0c0b4e4e281 100644
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -198,7 +198,7 @@ static int vpd_section_init(const char *name, struct vpd_section *sec,
 
         sec->name = name;
 
-        /* We want to export the raw partion with name ${name}_raw */
+        /* We want to export the raw partition with name ${name}_raw */
         sec->raw_name = kasprintf(GFP_KERNEL, "%s_raw", name);
         if (!sec->raw_name) {
                 err = -ENOMEM;
diff --git a/drivers/fpga/altera-cvp.c b/drivers/fpga/altera-cvp.c
index 7fa793672a7a..610a1558e0ed 100644
--- a/drivers/fpga/altera-cvp.c
+++ b/drivers/fpga/altera-cvp.c
@@ -453,8 +453,8 @@ static int altera_cvp_probe(struct pci_dev *pdev,
         snprintf(conf->mgr_name, sizeof(conf->mgr_name), "%s @%s",
                  ALTERA_CVP_MGR_NAME, pci_name(pdev));
 
-        mgr = fpga_mgr_create(&pdev->dev, conf->mgr_name,
-                              &altera_cvp_ops, conf);
+        mgr = devm_fpga_mgr_create(&pdev->dev, conf->mgr_name,
+                                   &altera_cvp_ops, conf);
         if (!mgr) {
                 ret = -ENOMEM;
                 goto err_unmap;
@@ -463,10 +463,8 @@ static int altera_cvp_probe(struct pci_dev *pdev,
         pci_set_drvdata(pdev, mgr);
 
         ret = fpga_mgr_register(mgr);
-        if (ret) {
-                fpga_mgr_free(mgr);
+        if (ret)
                 goto err_unmap;
-        }
 
         ret = driver_create_file(&altera_cvp_driver.driver,
                                  &driver_attr_chkcfg);
diff --git a/drivers/fpga/altera-fpga2sdram.c b/drivers/fpga/altera-fpga2sdram.c
index 23660ccd634b..a78e49c63c64 100644
--- a/drivers/fpga/altera-fpga2sdram.c
+++ b/drivers/fpga/altera-fpga2sdram.c
@@ -121,18 +121,16 @@ static int alt_fpga_bridge_probe(struct platform_device *pdev)
         /* Get f2s bridge configuration saved in handoff register */
         regmap_read(sysmgr, SYSMGR_ISWGRP_HANDOFF3, &priv->mask);
 
-        br = fpga_bridge_create(dev, F2S_BRIDGE_NAME,
-                                &altera_fpga2sdram_br_ops, priv);
+        br = devm_fpga_bridge_create(dev, F2S_BRIDGE_NAME,
+                                     &altera_fpga2sdram_br_ops, priv);
         if (!br)
                 return -ENOMEM;
 
         platform_set_drvdata(pdev, br);
 
         ret = fpga_bridge_register(br);
-        if (ret) {
-                fpga_bridge_free(br);
+        if (ret)
                 return ret;
-        }
 
         dev_info(dev, "driver initialized with handoff %08x\n", priv->mask);
 
diff --git a/drivers/fpga/altera-freeze-bridge.c b/drivers/fpga/altera-freeze-bridge.c
index ffd586c48ecf..dd58c4aea92e 100644
--- a/drivers/fpga/altera-freeze-bridge.c
+++ b/drivers/fpga/altera-freeze-bridge.c
@@ -213,7 +213,6 @@ static int altera_freeze_br_probe(struct platform_device *pdev)
         struct fpga_bridge *br;
         struct resource *res;
         u32 status, revision;
-        int ret;
 
         if (!np)
                 return -ENODEV;
@@ -245,20 +244,14 @@ static int altera_freeze_br_probe(struct platform_device *pdev)
 
         priv->base_addr = base_addr;
 
-        br = fpga_bridge_create(dev, FREEZE_BRIDGE_NAME,
-                                &altera_freeze_br_br_ops, priv);
+        br = devm_fpga_bridge_create(dev, FREEZE_BRIDGE_NAME,
+                                     &altera_freeze_br_br_ops, priv);
         if (!br)
                 return -ENOMEM;
 
         platform_set_drvdata(pdev, br);
 
-        ret = fpga_bridge_register(br);
-        if (ret) {
-                fpga_bridge_free(br);
-                return ret;
-        }
-
-        return 0;
+        return fpga_bridge_register(br);
 }
 
 static int altera_freeze_br_remove(struct platform_device *pdev)
diff --git a/drivers/fpga/altera-hps2fpga.c b/drivers/fpga/altera-hps2fpga.c
index a974d3f60321..77b95f251821 100644
--- a/drivers/fpga/altera-hps2fpga.c
+++ b/drivers/fpga/altera-hps2fpga.c
@@ -180,7 +180,8 @@ static int alt_fpga_bridge_probe(struct platform_device *pdev)
                 }
         }
 
-        br = fpga_bridge_create(dev, priv->name, &altera_hps2fpga_br_ops, priv);
+        br = devm_fpga_bridge_create(dev, priv->name,
+                                     &altera_hps2fpga_br_ops, priv);
         if (!br) {
                 ret = -ENOMEM;
                 goto err;
@@ -190,12 +191,10 @@ static int alt_fpga_bridge_probe(struct platform_device *pdev)
 
         ret = fpga_bridge_register(br);
         if (ret)
-                goto err_free;
+                goto err;
 
         return 0;
 
-err_free:
-        fpga_bridge_free(br);
 err:
         clk_disable_unprepare(priv->clk);
 
diff --git a/drivers/fpga/altera-pr-ip-core.c b/drivers/fpga/altera-pr-ip-core.c
index 65e0b6a2c031..a7a3bf0b5202 100644
--- a/drivers/fpga/altera-pr-ip-core.c
+++ b/drivers/fpga/altera-pr-ip-core.c
@@ -177,7 +177,6 @@ int alt_pr_register(struct device *dev, void __iomem *reg_base)
 {
         struct alt_pr_priv *priv;
         struct fpga_manager *mgr;
-        int ret;
         u32 val;
 
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -192,17 +191,13 @@ int alt_pr_register(struct device *dev, void __iomem *reg_base)
                 (val & ALT_PR_CSR_STATUS_MSK) >> ALT_PR_CSR_STATUS_SFT,
                 (int)(val & ALT_PR_CSR_PR_START));
 
-        mgr = fpga_mgr_create(dev, dev_name(dev), &alt_pr_ops, priv);
+        mgr = devm_fpga_mgr_create(dev, dev_name(dev), &alt_pr_ops, priv);
         if (!mgr)
                 return -ENOMEM;
 
         dev_set_drvdata(dev, mgr);
 
-        ret = fpga_mgr_register(mgr);
-        if (ret)
-                fpga_mgr_free(mgr);
-
-        return ret;
+        return fpga_mgr_register(mgr);
 }
 EXPORT_SYMBOL_GPL(alt_pr_register);
 
diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c
index 24b25c626036..33aafda50af5 100644
--- a/drivers/fpga/altera-ps-spi.c
+++ b/drivers/fpga/altera-ps-spi.c
@@ -239,7 +239,6 @@ static int altera_ps_probe(struct spi_device *spi)
         struct altera_ps_conf *conf;
         const struct of_device_id *of_id;
         struct fpga_manager *mgr;
-        int ret;
 
         conf = devm_kzalloc(&spi->dev, sizeof(*conf), GFP_KERNEL);
         if (!conf)
@@ -275,18 +274,14 @@ static int altera_ps_probe(struct spi_device *spi)
         snprintf(conf->mgr_name, sizeof(conf->mgr_name), "%s %s",
                  dev_driver_string(&spi->dev), dev_name(&spi->dev));
 
-        mgr = fpga_mgr_create(&spi->dev, conf->mgr_name,
-                              &altera_ps_ops, conf);
+        mgr = devm_fpga_mgr_create(&spi->dev, conf->mgr_name,
+                                   &altera_ps_ops, conf);
         if (!mgr)
                 return -ENOMEM;
 
         spi_set_drvdata(spi, mgr);
 
-        ret = fpga_mgr_register(mgr);
-        if (ret)
-                fpga_mgr_free(mgr);
-
-        return ret;
+        return fpga_mgr_register(mgr);
 }
 
 static int altera_ps_remove(struct spi_device *spi)
diff --git a/drivers/fpga/dfl-afu-dma-region.c b/drivers/fpga/dfl-afu-dma-region.c
index 0e81d33af856..025aba3ea76c 100644
--- a/drivers/fpga/dfl-afu-dma-region.c
+++ b/drivers/fpga/dfl-afu-dma-region.c
@@ -70,7 +70,7 @@ static int afu_dma_adjust_locked_vm(struct device *dev, long npages, bool incr)
         dev_dbg(dev, "[%d] RLIMIT_MEMLOCK %c%ld %ld/%ld%s\n", current->pid,
                 incr ? '+' : '-', npages << PAGE_SHIFT,
                 current->mm->locked_vm << PAGE_SHIFT, rlimit(RLIMIT_MEMLOCK),
-                ret ? "- execeeded" : "");
+                ret ? "- exceeded" : "");
 
         up_write(&current->mm->mmap_sem);
 
diff --git a/drivers/fpga/dfl-fme-br.c b/drivers/fpga/dfl-fme-br.c
index 7cc041def8b3..3ff9f3a687ce 100644
--- a/drivers/fpga/dfl-fme-br.c
+++ b/drivers/fpga/dfl-fme-br.c
@@ -61,7 +61,6 @@ static int fme_br_probe(struct platform_device *pdev)
         struct device *dev = &pdev->dev;
         struct fme_br_priv *priv;
         struct fpga_bridge *br;
-        int ret;
 
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
@@ -69,18 +68,14 @@ static int fme_br_probe(struct platform_device *pdev)
 
         priv->pdata = dev_get_platdata(dev);
 
-        br = fpga_bridge_create(dev, "DFL FPGA FME Bridge",
-                                &fme_bridge_ops, priv);
+        br = devm_fpga_bridge_create(dev, "DFL FPGA FME Bridge",
+                                     &fme_bridge_ops, priv);
         if (!br)
                 return -ENOMEM;
 
         platform_set_drvdata(pdev, br);
 
-        ret = fpga_bridge_register(br);
-        if (ret)
-                fpga_bridge_free(br);
-
-        return ret;
+        return fpga_bridge_register(br);
 }
 
 static int fme_br_remove(struct platform_device *pdev)
diff --git a/drivers/fpga/dfl-fme-mgr.c b/drivers/fpga/dfl-fme-mgr.c
index b5ef405b6d88..76f37709dd1a 100644
--- a/drivers/fpga/dfl-fme-mgr.c
+++ b/drivers/fpga/dfl-fme-mgr.c
@@ -201,7 +201,7 @@ static int fme_mgr_write(struct fpga_manager *mgr,
                 }
 
                 if (count < 4) {
-                        dev_err(dev, "Invaild PR bitstream size\n");
+                        dev_err(dev, "Invalid PR bitstream size\n");
                         return -EINVAL;
                 }
 
@@ -287,7 +287,6 @@ static int fme_mgr_probe(struct platform_device *pdev)
         struct fme_mgr_priv *priv;
         struct fpga_manager *mgr;
         struct resource *res;
-        int ret;
 
         priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
@@ -309,19 +308,15 @@ static int fme_mgr_probe(struct platform_device *pdev)
 
         fme_mgr_get_compat_id(priv->ioaddr, compat_id);
 
-        mgr = fpga_mgr_create(dev, "DFL FME FPGA Manager",
-                              &fme_mgr_ops, priv);
+        mgr = devm_fpga_mgr_create(dev, "DFL FME FPGA Manager",
+                                   &fme_mgr_ops, priv);
         if (!mgr)
                 return -ENOMEM;
 
         mgr->compat_id = compat_id;
         platform_set_drvdata(pdev, mgr);
 
-        ret = fpga_mgr_register(mgr);
-        if (ret)
-                fpga_mgr_free(mgr);
-
-        return ret;
+        return fpga_mgr_register(mgr);
 }
 
 static int fme_mgr_remove(struct platform_device *pdev)
diff --git a/drivers/fpga/dfl-fme-region.c b/drivers/fpga/dfl-fme-region.c
index 51a5ac2293a7..ec134ec93f08 100644
--- a/drivers/fpga/dfl-fme-region.c
+++ b/drivers/fpga/dfl-fme-region.c
@@ -39,7 +39,7 @@ static int fme_region_probe(struct platform_device *pdev)
         if (IS_ERR(mgr))
                 return -EPROBE_DEFER;
 
-        region = fpga_region_create(dev, mgr, fme_region_get_bridges);
+        region = devm_fpga_region_create(dev, mgr, fme_region_get_bridges);
         if (!region) {
                 ret = -ENOMEM;
                 goto eprobe_mgr_put;
@@ -51,14 +51,12 @@ static int fme_region_probe(struct platform_device *pdev)
 
         ret = fpga_region_register(region);
         if (ret)
-                goto region_free;
+                goto eprobe_mgr_put;
 
         dev_dbg(dev, "DFL FME FPGA Region probed\n");
 
         return 0;
 
-region_free:
-        fpga_region_free(region);
 eprobe_mgr_put:
         fpga_mgr_put(mgr);
         return ret;
diff --git a/drivers/fpga/dfl.c b/drivers/fpga/dfl.c
index a9b521bccb06..2c09e502e721 100644
--- a/drivers/fpga/dfl.c
+++ b/drivers/fpga/dfl.c
@@ -899,7 +899,7 @@ dfl_fpga_feature_devs_enumerate(struct dfl_fpga_enum_info *info)
         if (!cdev)
                 return ERR_PTR(-ENOMEM);
 
-        cdev->region = fpga_region_create(info->dev, NULL, NULL);
+        cdev->region = devm_fpga_region_create(info->dev, NULL, NULL);
         if (!cdev->region) {
                 ret = -ENOMEM;
                 goto free_cdev_exit;
@@ -911,7 +911,7 @@ dfl_fpga_feature_devs_enumerate(struct dfl_fpga_enum_info *info)
 
         ret = fpga_region_register(cdev->region);
         if (ret)
-                goto free_region_exit;
+                goto free_cdev_exit;
 
         /* create and init build info for enumeration */
         binfo = devm_kzalloc(info->dev, sizeof(*binfo), GFP_KERNEL);
@@ -942,8 +942,6 @@ dfl_fpga_feature_devs_enumerate(struct dfl_fpga_enum_info *info)
 
 unregister_region_exit:
         fpga_region_unregister(cdev->region);
-free_region_exit:
-        fpga_region_free(cdev->region);
 free_cdev_exit:
         devm_kfree(info->dev, cdev);
         return ERR_PTR(ret);
diff --git a/drivers/fpga/fpga-bridge.c b/drivers/fpga/fpga-bridge.c
index c983dac97501..80bd8f1b2aa6 100644
--- a/drivers/fpga/fpga-bridge.c
+++ b/drivers/fpga/fpga-bridge.c
@@ -324,6 +324,9 @@ ATTRIBUTE_GROUPS(fpga_bridge);
  * @br_ops:     pointer to structure of fpga bridge ops
  * @priv:       FPGA bridge private data
  *
+ * The caller of this function is responsible for freeing the bridge with
+ * fpga_bridge_free().  Using devm_fpga_bridge_create() instead is recommended.
+ *
  * Return: struct fpga_bridge or NULL
  */
 struct fpga_bridge *fpga_bridge_create(struct device *dev, const char *name,
@@ -378,8 +381,8 @@ error_kfree:
 EXPORT_SYMBOL_GPL(fpga_bridge_create);
 
 /**
- * fpga_bridge_free - free a fpga bridge and its id
- * @bridge:     FPGA bridge struct created by fpga_bridge_create
+ * fpga_bridge_free - free a fpga bridge created by fpga_bridge_create()
+ * @bridge:     FPGA bridge struct
  */
 void fpga_bridge_free(struct fpga_bridge *bridge)
 {
@@ -388,9 +391,56 @@ void fpga_bridge_free(struct fpga_bridge *bridge)
 }
 EXPORT_SYMBOL_GPL(fpga_bridge_free);
 
+static void devm_fpga_bridge_release(struct device *dev, void *res)
+{
+        struct fpga_bridge *bridge = *(struct fpga_bridge **)res;
+
+        fpga_bridge_free(bridge);
+}
+
 /**
- * fpga_bridge_register - register a fpga bridge
- * @bridge:     FPGA bridge struct created by fpga_bridge_create
+ * devm_fpga_bridge_create - create and init a managed struct fpga_bridge
+ * @dev:        FPGA bridge device from pdev
+ * @name:       FPGA bridge name
+ * @br_ops:     pointer to structure of fpga bridge ops
+ * @priv:       FPGA bridge private data
+ *
+ * This function is intended for use in a FPGA bridge driver's probe function.
+ * After the bridge driver creates the struct with devm_fpga_bridge_create(), it
+ * should register the bridge with fpga_bridge_register().  The bridge driver's
+ * remove function should call fpga_bridge_unregister().  The bridge struct
+ * allocated with this function will be freed automatically on driver detach.
+ * This includes the case of a probe function returning error before calling
+ * fpga_bridge_register(), the struct will still get cleaned up.
+ *
+ *  Return: struct fpga_bridge or NULL
+ */
+struct fpga_bridge
+*devm_fpga_bridge_create(struct device *dev, const char *name,
+                         const struct fpga_bridge_ops *br_ops, void *priv)
+{
+        struct fpga_bridge **ptr, *bridge;
+
+        ptr = devres_alloc(devm_fpga_bridge_release, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return NULL;
+
+        bridge = fpga_bridge_create(dev, name, br_ops, priv);
+        if (!bridge) {
+                devres_free(ptr);
+        } else {
+                *ptr = bridge;
+                devres_add(dev, ptr);
+        }
+
+        return bridge;
+}
+EXPORT_SYMBOL_GPL(devm_fpga_bridge_create);
+
+/**
+ * fpga_bridge_register - register a FPGA bridge
+ *
+ * @bridge: FPGA bridge struct
  *
  * Return: 0 for success, error code otherwise.
  */
@@ -412,8 +462,11 @@ int fpga_bridge_register(struct fpga_bridge *bridge)
 EXPORT_SYMBOL_GPL(fpga_bridge_register);
 
 /**
- * fpga_bridge_unregister - unregister and free a fpga bridge
- * @bridge:     FPGA bridge struct created by fpga_bridge_create
+ * fpga_bridge_unregister - unregister a FPGA bridge
+ *
+ * @bridge: FPGA bridge struct
+ *
+ * This function is intended for use in a FPGA bridge driver's remove function.
  */
 void fpga_bridge_unregister(struct fpga_bridge *bridge)
 {
@@ -430,9 +483,6 @@ EXPORT_SYMBOL_GPL(fpga_bridge_unregister);
 
 static void fpga_bridge_dev_release(struct device *dev)
 {
-        struct fpga_bridge *bridge = to_fpga_bridge(dev);
-
-        fpga_bridge_free(bridge);
 }
 
 static int __init fpga_bridge_dev_init(void)
diff --git a/drivers/fpga/fpga-mgr.c b/drivers/fpga/fpga-mgr.c
index a41b07e37884..c3866816456a 100644
--- a/drivers/fpga/fpga-mgr.c
+++ b/drivers/fpga/fpga-mgr.c
@@ -558,6 +558,9 @@ EXPORT_SYMBOL_GPL(fpga_mgr_unlock);
  * @mops:       pointer to structure of fpga manager ops
  * @priv:       fpga manager private data
  *
+ * The caller of this function is responsible for freeing the struct with
+ * fpga_mgr_free().  Using devm_fpga_mgr_create() instead is recommended.
+ *
  * Return: pointer to struct fpga_manager or NULL
  */
 struct fpga_manager *fpga_mgr_create(struct device *dev, const char *name,
@@ -618,8 +621,8 @@ error_kfree:
 EXPORT_SYMBOL_GPL(fpga_mgr_create);
 
 /**
- * fpga_mgr_free - deallocate a FPGA manager
- * @mgr:        fpga manager struct created by fpga_mgr_create
+ * fpga_mgr_free - free a FPGA manager created with fpga_mgr_create()
+ * @mgr:        fpga manager struct
  */
 void fpga_mgr_free(struct fpga_manager *mgr)
 {
@@ -628,9 +631,55 @@ void fpga_mgr_free(struct fpga_manager *mgr)
 }
 EXPORT_SYMBOL_GPL(fpga_mgr_free);
 
+static void devm_fpga_mgr_release(struct device *dev, void *res)
+{
+        struct fpga_manager *mgr = *(struct fpga_manager **)res;
+
+        fpga_mgr_free(mgr);
+}
+
+/**
+ * devm_fpga_mgr_create - create and initialize a managed FPGA manager struct
+ * @dev:        fpga manager device from pdev
+ * @name:       fpga manager name
+ * @mops:       pointer to structure of fpga manager ops
+ * @priv:       fpga manager private data
+ *
+ * This function is intended for use in a FPGA manager driver's probe function.
+ * After the manager driver creates the manager struct with
+ * devm_fpga_mgr_create(), it should register it with fpga_mgr_register().  The
+ * manager driver's remove function should call fpga_mgr_unregister().  The
+ * manager struct allocated with this function will be freed automatically on
+ * driver detach.  This includes the case of a probe function returning error
+ * before calling fpga_mgr_register(), the struct will still get cleaned up.
+ *
+ * Return: pointer to struct fpga_manager or NULL
+ */
+struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name,
+                                          const struct fpga_manager_ops *mops,
+                                          void *priv)
+{
+        struct fpga_manager **ptr, *mgr;
+
+        ptr = devres_alloc(devm_fpga_mgr_release, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return NULL;
+
+        mgr = fpga_mgr_create(dev, name, mops, priv);
+        if (!mgr) {
+                devres_free(ptr);
+        } else {
+                *ptr = mgr;
+                devres_add(dev, ptr);
+        }
+
+        return mgr;
+}
+EXPORT_SYMBOL_GPL(devm_fpga_mgr_create);
+
 /**
  * fpga_mgr_register - register a FPGA manager
- * @mgr:        fpga manager struct created by fpga_mgr_create
+ * @mgr: fpga manager struct
  *
  * Return: 0 on success, negative error code otherwise.
  */
@@ -661,8 +710,10 @@ error_device:
 EXPORT_SYMBOL_GPL(fpga_mgr_register);
 
 /**
- * fpga_mgr_unregister - unregister and free a FPGA manager
- * @mgr:        fpga manager struct
+ * fpga_mgr_unregister - unregister a FPGA manager
+ * @mgr: fpga manager struct
+ *
+ * This function is intended for use in a FPGA manager driver's remove function.
  */
 void fpga_mgr_unregister(struct fpga_manager *mgr)
 {
@@ -681,9 +732,6 @@ EXPORT_SYMBOL_GPL(fpga_mgr_unregister);
 
 static void fpga_mgr_dev_release(struct device *dev)
 {
-        struct fpga_manager *mgr = to_fpga_manager(dev);
-
-        fpga_mgr_free(mgr);
 }
 
 static int __init fpga_mgr_class_init(void)
diff --git a/drivers/fpga/fpga-region.c b/drivers/fpga/fpga-region.c
index 0d65220d5ec5..bde5a9d460c5 100644
--- a/drivers/fpga/fpga-region.c
+++ b/drivers/fpga/fpga-region.c
@@ -185,6 +185,10 @@ ATTRIBUTE_GROUPS(fpga_region);
  * @mgr: manager that programs this region
  * @get_bridges: optional function to get bridges to a list
  *
+ * The caller of this function is responsible for freeing the resulting region
+ * struct with fpga_region_free().  Using devm_fpga_region_create() instead is
+ * recommended.
+ *
  * Return: struct fpga_region or NULL
  */
 struct fpga_region
@@ -230,8 +234,8 @@ err_free:
 EXPORT_SYMBOL_GPL(fpga_region_create);
 
 /**
- * fpga_region_free - free a struct fpga_region
- * @region: FPGA region created by fpga_region_create
+ * fpga_region_free - free a FPGA region created by fpga_region_create()
+ * @region: FPGA region
  */
 void fpga_region_free(struct fpga_region *region)
 {
@@ -240,21 +244,69 @@ void fpga_region_free(struct fpga_region *region)
 }
 EXPORT_SYMBOL_GPL(fpga_region_free);
 
+static void devm_fpga_region_release(struct device *dev, void *res)
+{
+        struct fpga_region *region = *(struct fpga_region **)res;
+
+        fpga_region_free(region);
+}
+
+/**
+ * devm_fpga_region_create - create and initialize a managed FPGA region struct
+ * @dev: device parent
+ * @mgr: manager that programs this region
+ * @get_bridges: optional function to get bridges to a list
+ *
+ * This function is intended for use in a FPGA region driver's probe function.
+ * After the region driver creates the region struct with
+ * devm_fpga_region_create(), it should register it with fpga_region_register().
+ * The region driver's remove function should call fpga_region_unregister().
+ * The region struct allocated with this function will be freed automatically on
+ * driver detach.  This includes the case of a probe function returning error
+ * before calling fpga_region_register(), the struct will still get cleaned up.
+ *
+ * Return: struct fpga_region or NULL
+ */
+struct fpga_region
+*devm_fpga_region_create(struct device *dev,
+                         struct fpga_manager *mgr,
+                         int (*get_bridges)(struct fpga_region *))
+{
+        struct fpga_region **ptr, *region;
+
+        ptr = devres_alloc(devm_fpga_region_release, sizeof(*ptr), GFP_KERNEL);
+        if (!ptr)
+                return NULL;
+
+        region = fpga_region_create(dev, mgr, get_bridges);
+        if (!region) {
+                devres_free(ptr);
+        } else {
+                *ptr = region;
+                devres_add(dev, ptr);
+        }
+
+        return region;
+}
+EXPORT_SYMBOL_GPL(devm_fpga_region_create);
+
 /**
  * fpga_region_register - register a FPGA region
- * @region: FPGA region created by fpga_region_create
+ * @region: FPGA region
+ *
  * Return: 0 or -errno
  */
 int fpga_region_register(struct fpga_region *region)
 {
         return device_add(&region->dev);
-
 }
 EXPORT_SYMBOL_GPL(fpga_region_register);
 
 /**
- * fpga_region_unregister - unregister and free a FPGA region
+ * fpga_region_unregister - unregister a FPGA region
  * @region: FPGA region
+ *
+ * This function is intended for use in a FPGA region driver's remove function.
  */
 void fpga_region_unregister(struct fpga_region *region)
 {
@@ -264,9 +316,6 @@ EXPORT_SYMBOL_GPL(fpga_region_unregister);
 
 static void fpga_region_dev_release(struct device *dev)
 {
-        struct fpga_region *region = to_fpga_region(dev);
-
-        fpga_region_free(region);
 }
 
 /**
diff --git a/drivers/fpga/ice40-spi.c b/drivers/fpga/ice40-spi.c
index 5981c7ee7a7d..6154661b8f76 100644
--- a/drivers/fpga/ice40-spi.c
+++ b/drivers/fpga/ice40-spi.c
@@ -175,18 +175,14 @@ static int ice40_fpga_probe(struct spi_device *spi)
                 return ret;
         }
 
-        mgr = fpga_mgr_create(dev, "Lattice iCE40 FPGA Manager",
-                              &ice40_fpga_ops, priv);
+        mgr = devm_fpga_mgr_create(dev, "Lattice iCE40 FPGA Manager",
+                                   &ice40_fpga_ops, priv);
         if (!mgr)
                 return -ENOMEM;
 
         spi_set_drvdata(spi, mgr);
 
-        ret = fpga_mgr_register(mgr);
-        if (ret)
-                fpga_mgr_free(mgr);
-
-        return ret;
+        return fpga_mgr_register(mgr);
 }
 
 static int ice40_fpga_remove(struct spi_device *spi)
diff --git a/drivers/fpga/machxo2-spi.c b/drivers/fpga/machxo2-spi.c
index a582e0000c97..4d8a87641587 100644
--- a/drivers/fpga/machxo2-spi.c
+++ b/drivers/fpga/machxo2-spi.c
@@ -356,25 +356,20 @@ static int machxo2_spi_probe(struct spi_device *spi)
 {
         struct device *dev = &spi->dev;
         struct fpga_manager *mgr;
-        int ret;
 
         if (spi->max_speed_hz > MACHXO2_MAX_SPEED) {
                 dev_err(dev, "Speed is too high\n");
                 return -EINVAL;
         }
 
-        mgr = fpga_mgr_create(dev, "Lattice MachXO2 SPI FPGA Manager",
-                              &machxo2_ops, spi);
+        mgr = devm_fpga_mgr_create(dev, "Lattice MachXO2 SPI FPGA Manager",
+                                   &machxo2_ops, spi);
         if (!mgr)
                 return -ENOMEM;
 
         spi_set_drvdata(spi, mgr);
 
-        ret = fpga_mgr_register(mgr);
-        if (ret)
-                fpga_mgr_free(mgr);
-
-        return ret;
+        return fpga_mgr_register(mgr);
 }
 
 static int machxo2_spi_remove(struct spi_device *spi)
diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
index 052a1342ab7e..122286fd255a 100644
--- a/drivers/fpga/of-fpga-region.c
+++ b/drivers/fpga/of-fpga-region.c
@@ -410,7 +410,7 @@ static int of_fpga_region_probe(struct platform_device *pdev)
         if (IS_ERR(mgr))
                 return -EPROBE_DEFER;
 
-        region = fpga_region_create(dev, mgr, of_fpga_region_get_bridges);
+        region = devm_fpga_region_create(dev, mgr, of_fpga_region_get_bridges);
         if (!region) {
                 ret = -ENOMEM;
                 goto eprobe_mgr_put;
@@ -418,7 +418,7 @@ static int of_fpga_region_probe(struct platform_device *pdev)
 
         ret = fpga_region_register(region);
         if (ret)
-                goto eprobe_free;
+                goto eprobe_mgr_put;
 
         of_platform_populate(np, fpga_region_of_match, NULL, &region->dev);
         dev_set_drvdata(dev, region);
@@ -427,8 +427,6 @@ static int of_fpga_region_probe(struct platform_device *pdev)
 
         return 0;
 
-eprobe_free:
-        fpga_region_free(region);
 eprobe_mgr_put:
         fpga_mgr_put(mgr);
         return ret;
diff --git a/drivers/fpga/socfpga-a10.c b/drivers/fpga/socfpga-a10.c
index be30c48eb6e4..573d88bdf730 100644
--- a/drivers/fpga/socfpga-a10.c
+++ b/drivers/fpga/socfpga-a10.c
@@ -508,8 +508,8 @@ static int socfpga_a10_fpga_probe(struct platform_device *pdev)
                 return -EBUSY;
         }
 
-        mgr = fpga_mgr_create(dev, "SoCFPGA Arria10 FPGA Manager",
-                              &socfpga_a10_fpga_mgr_ops, priv);
+        mgr = devm_fpga_mgr_create(dev, "SoCFPGA Arria10 FPGA Manager",
+                                   &socfpga_a10_fpga_mgr_ops, priv);
         if (!mgr)
                 return -ENOMEM;
 
@@ -517,7 +517,6 @@ static int socfpga_a10_fpga_probe(struct platform_device *pdev)
 
         ret = fpga_mgr_register(mgr);
         if (ret) {
-                fpga_mgr_free(mgr);
                 clk_disable_unprepare(priv->clk);
                 return ret;
         }
diff --git a/drivers/fpga/socfpga.c b/drivers/fpga/socfpga.c
index 959d71f26896..4a8a2fcd4e6c 100644
--- a/drivers/fpga/socfpga.c
+++ b/drivers/fpga/socfpga.c
@@ -571,18 +571,14 @@ static int socfpga_fpga_probe(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        mgr = fpga_mgr_create(dev, "Altera SOCFPGA FPGA Manager",
-                              &socfpga_fpga_ops, priv);
+        mgr = devm_fpga_mgr_create(dev, "Altera SOCFPGA FPGA Manager",
+                                   &socfpga_fpga_ops, priv);
         if (!mgr)
                 return -ENOMEM;
 
         platform_set_drvdata(pdev, mgr);
 
-        ret = fpga_mgr_register(mgr);
-        if (ret)
-                fpga_mgr_free(mgr);
-
-        return ret;
+        return fpga_mgr_register(mgr);
 }
 
 static int socfpga_fpga_remove(struct platform_device *pdev)
diff --git a/drivers/fpga/ts73xx-fpga.c b/drivers/fpga/ts73xx-fpga.c
index 08efd1895b1b..dc22a5842609 100644
--- a/drivers/fpga/ts73xx-fpga.c
+++ b/drivers/fpga/ts73xx-fpga.c
@@ -118,7 +118,6 @@ static int ts73xx_fpga_probe(struct platform_device *pdev)
         struct ts73xx_fpga_priv *priv;
         struct fpga_manager *mgr;
         struct resource *res;
-        int ret;
 
         priv = devm_kzalloc(kdev, sizeof(*priv), GFP_KERNEL);
         if (!priv)
@@ -133,18 +132,14 @@ static int ts73xx_fpga_probe(struct platform_device *pdev)
                 return PTR_ERR(priv->io_base);
         }
 
-        mgr = fpga_mgr_create(kdev, "TS-73xx FPGA Manager",
-                              &ts73xx_fpga_ops, priv);
+        mgr = devm_fpga_mgr_create(kdev, "TS-73xx FPGA Manager",
+                                   &ts73xx_fpga_ops, priv);
         if (!mgr)
                 return -ENOMEM;
 
         platform_set_drvdata(pdev, mgr);
 
-        ret = fpga_mgr_register(mgr);
-        if (ret)
-                fpga_mgr_free(mgr);
-
-        return ret;
+        return fpga_mgr_register(mgr);
 }
 
 static int ts73xx_fpga_remove(struct platform_device *pdev)
diff --git a/drivers/fpga/xilinx-pr-decoupler.c b/drivers/fpga/xilinx-pr-decoupler.c
index 07ba1539e82c..641036135207 100644
--- a/drivers/fpga/xilinx-pr-decoupler.c
+++ b/drivers/fpga/xilinx-pr-decoupler.c
@@ -121,8 +121,8 @@ static int xlnx_pr_decoupler_probe(struct platform_device *pdev)
 
         clk_disable(priv->clk);
 
-        br = fpga_bridge_create(&pdev->dev, "Xilinx PR Decoupler",
-                                &xlnx_pr_decoupler_br_ops, priv);
+        br = devm_fpga_bridge_create(&pdev->dev, "Xilinx PR Decoupler",
+                                     &xlnx_pr_decoupler_br_ops, priv);
         if (!br) {
                 err = -ENOMEM;
                 goto err_clk;
diff --git a/drivers/fpga/xilinx-spi.c b/drivers/fpga/xilinx-spi.c
index 8d1945966533..469486be20c4 100644
--- a/drivers/fpga/xilinx-spi.c
+++ b/drivers/fpga/xilinx-spi.c
@@ -144,7 +144,6 @@ static int xilinx_spi_probe(struct spi_device *spi)
 {
         struct xilinx_spi_conf *conf;
         struct fpga_manager *mgr;
-        int ret;
 
         conf = devm_kzalloc(&spi->dev, sizeof(*conf), GFP_KERNEL);
         if (!conf)
@@ -167,18 +166,15 @@ static int xilinx_spi_probe(struct spi_device *spi)
                 return PTR_ERR(conf->done);
         }
 
-        mgr = fpga_mgr_create(&spi->dev, "Xilinx Slave Serial FPGA Manager",
-                              &xilinx_spi_ops, conf);
+        mgr = devm_fpga_mgr_create(&spi->dev,
+                                   "Xilinx Slave Serial FPGA Manager",
+                                   &xilinx_spi_ops, conf);
         if (!mgr)
                 return -ENOMEM;
 
         spi_set_drvdata(spi, mgr);
 
-        ret = fpga_mgr_register(mgr);
-        if (ret)
-                fpga_mgr_free(mgr);
-
-        return ret;
+        return fpga_mgr_register(mgr);
 }
 
 static int xilinx_spi_remove(struct spi_device *spi)
diff --git a/drivers/fpga/zynq-fpga.c b/drivers/fpga/zynq-fpga.c
index 3110e00121ca..bb82efeebb9d 100644
--- a/drivers/fpga/zynq-fpga.c
+++ b/drivers/fpga/zynq-fpga.c
@@ -614,8 +614,8 @@ static int zynq_fpga_probe(struct platform_device *pdev)
 
         clk_disable(priv->clk);
 
-        mgr = fpga_mgr_create(dev, "Xilinx Zynq FPGA Manager",
-                              &zynq_fpga_ops, priv);
+        mgr = devm_fpga_mgr_create(dev, "Xilinx Zynq FPGA Manager",
+                                   &zynq_fpga_ops, priv);
         if (!mgr)
                 return -ENOMEM;
 
@@ -624,7 +624,6 @@ static int zynq_fpga_probe(struct platform_device *pdev)
         err = fpga_mgr_register(mgr);
         if (err) {
                 dev_err(dev, "unable to register FPGA manager\n");
-                fpga_mgr_free(mgr);
                 clk_unprepare(priv->clk);
                 return err;
         }
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
index 741857d80da1..de8193f3b838 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
@@ -79,85 +79,96 @@ void vmbus_setevent(struct vmbus_channel *channel)
 }
 EXPORT_SYMBOL_GPL(vmbus_setevent);
 
-/*
- * vmbus_open - Open the specified channel.
- */
-int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
-                     u32 recv_ringbuffer_size, void *userdata, u32 userdatalen,
-                     void (*onchannelcallback)(void *context), void *context)
+/* vmbus_free_ring - drop mapping of ring buffer */
+void vmbus_free_ring(struct vmbus_channel *channel)
+{
+        hv_ringbuffer_cleanup(&channel->outbound);
+        hv_ringbuffer_cleanup(&channel->inbound);
+
+        if (channel->ringbuffer_page) {
+                __free_pages(channel->ringbuffer_page,
+                             get_order(channel->ringbuffer_pagecount
+                                       << PAGE_SHIFT));
+                channel->ringbuffer_page = NULL;
+        }
+}
+EXPORT_SYMBOL_GPL(vmbus_free_ring);
+
+/* vmbus_alloc_ring - allocate and map pages for ring buffer */
+int vmbus_alloc_ring(struct vmbus_channel *newchannel,
+                     u32 send_size, u32 recv_size)
+{
+        struct page *page;
+        int order;
+
+        if (send_size % PAGE_SIZE || recv_size % PAGE_SIZE)
+                return -EINVAL;
+
+        /* Allocate the ring buffer */
+        order = get_order(send_size + recv_size);
+        page = alloc_pages_node(cpu_to_node(newchannel->target_cpu),
+                                GFP_KERNEL|__GFP_ZERO, order);
+
+        if (!page)
+                page = alloc_pages(GFP_KERNEL|__GFP_ZERO, order);
+
+        if (!page)
+                return -ENOMEM;
+
+        newchannel->ringbuffer_page = page;
+        newchannel->ringbuffer_pagecount = (send_size + recv_size) >> PAGE_SHIFT;
+        newchannel->ringbuffer_send_offset = send_size >> PAGE_SHIFT;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(vmbus_alloc_ring);
+
+static int __vmbus_open(struct vmbus_channel *newchannel,
+                       void *userdata, u32 userdatalen,
+                       void (*onchannelcallback)(void *context), void *context)
 {
         struct vmbus_channel_open_channel *open_msg;
         struct vmbus_channel_msginfo *open_info = NULL;
+        struct page *page = newchannel->ringbuffer_page;
+        u32 send_pages, recv_pages;
         unsigned long flags;
-        int ret, err = 0;
-        struct page *page;
+        int err;
 
-        if (send_ringbuffer_size % PAGE_SIZE ||
-            recv_ringbuffer_size % PAGE_SIZE)
+        if (userdatalen > MAX_USER_DEFINED_BYTES)
                 return -EINVAL;
 
+        send_pages = newchannel->ringbuffer_send_offset;
+        recv_pages = newchannel->ringbuffer_pagecount - send_pages;
+
         spin_lock_irqsave(&newchannel->lock, flags);
-        if (newchannel->state == CHANNEL_OPEN_STATE) {
-                newchannel->state = CHANNEL_OPENING_STATE;
-        } else {
+        if (newchannel->state != CHANNEL_OPEN_STATE) {
                 spin_unlock_irqrestore(&newchannel->lock, flags);
                 return -EINVAL;
         }
         spin_unlock_irqrestore(&newchannel->lock, flags);
 
+        newchannel->state = CHANNEL_OPENING_STATE;
         newchannel->onchannel_callback = onchannelcallback;
         newchannel->channel_callback_context = context;
 
-        /* Allocate the ring buffer */
-        page = alloc_pages_node(cpu_to_node(newchannel->target_cpu),
-                                GFP_KERNEL|__GFP_ZERO,
-                                get_order(send_ringbuffer_size +
-                                recv_ringbuffer_size));
-
-        if (!page)
-                page = alloc_pages(GFP_KERNEL|__GFP_ZERO,
-                                   get_order(send_ringbuffer_size +
-                                             recv_ringbuffer_size));
-
-        if (!page) {
-                err = -ENOMEM;
-                goto error_set_chnstate;
-        }
-
-        newchannel->ringbuffer_pages = page_address(page);
-        newchannel->ringbuffer_pagecount = (send_ringbuffer_size +
-                                           recv_ringbuffer_size) >> PAGE_SHIFT;
-
-        ret = hv_ringbuffer_init(&newchannel->outbound, page,
-                                 send_ringbuffer_size >> PAGE_SHIFT);
-
-        if (ret != 0) {
-                err = ret;
-                goto error_free_pages;
-        }
-
-        ret = hv_ringbuffer_init(&newchannel->inbound,
-                                 &page[send_ringbuffer_size >> PAGE_SHIFT],
-                                 recv_ringbuffer_size >> PAGE_SHIFT);
-        if (ret != 0) {
-                err = ret;
-                goto error_free_pages;
-        }
+        err = hv_ringbuffer_init(&newchannel->outbound, page, send_pages);
+        if (err)
+                goto error_clean_ring;
 
+        err = hv_ringbuffer_init(&newchannel->inbound,
+                                 &page[send_pages], recv_pages);
+        if (err)
+                goto error_clean_ring;
 
         /* Establish the gpadl for the ring buffer */
         newchannel->ringbuffer_gpadlhandle = 0;
 
-        ret = vmbus_establish_gpadl(newchannel,
-                                    page_address(page),
-                                    send_ringbuffer_size +
-                                    recv_ringbuffer_size,
+        err = vmbus_establish_gpadl(newchannel,
+                                    page_address(newchannel->ringbuffer_page),
+                                    (send_pages + recv_pages) << PAGE_SHIFT,
                                     &newchannel->ringbuffer_gpadlhandle);
-
-        if (ret != 0) {
-                err = ret;
-                goto error_free_pages;
-        }
+        if (err)
+                goto error_clean_ring;
 
         /* Create and init the channel open message */
         open_info = kmalloc(sizeof(*open_info) +
@@ -176,15 +187,9 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
         open_msg->openid = newchannel->offermsg.child_relid;
         open_msg->child_relid = newchannel->offermsg.child_relid;
         open_msg->ringbuffer_gpadlhandle = newchannel->ringbuffer_gpadlhandle;
-        open_msg->downstream_ringbuffer_pageoffset = send_ringbuffer_size >>
-                                                  PAGE_SHIFT;
+        open_msg->downstream_ringbuffer_pageoffset = newchannel->ringbuffer_send_offset;
         open_msg->target_vp = newchannel->target_vp;
 
-        if (userdatalen > MAX_USER_DEFINED_BYTES) {
-                err = -EINVAL;
-                goto error_free_gpadl;
-        }
-
         if (userdatalen)
                 memcpy(open_msg->userdata, userdata, userdatalen);
 
@@ -195,18 +200,16 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
 
         if (newchannel->rescind) {
                 err = -ENODEV;
-                goto error_free_gpadl;
+                goto error_free_info;
         }
 
-        ret = vmbus_post_msg(open_msg,
+        err = vmbus_post_msg(open_msg,
                              sizeof(struct vmbus_channel_open_channel), true);
 
-        trace_vmbus_open(open_msg, ret);
+        trace_vmbus_open(open_msg, err);
 
-        if (ret != 0) {
-                err = ret;
+        if (err != 0)
                 goto error_clean_msglist;
-        }
 
         wait_for_completion(&open_info->waitevent);
 
@@ -216,12 +219,12 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
 
         if (newchannel->rescind) {
                 err = -ENODEV;
-                goto error_free_gpadl;
+                goto error_free_info;
         }
 
         if (open_info->response.open_result.status) {
                 err = -EAGAIN;
-                goto error_free_gpadl;
+                goto error_free_info;
         }
 
         newchannel->state = CHANNEL_OPENED_STATE;
@@ -232,19 +235,50 @@ error_clean_msglist:
         spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
         list_del(&open_info->msglistentry);
         spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
-
+error_free_info:
+        kfree(open_info);
 error_free_gpadl:
         vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
-        kfree(open_info);
-error_free_pages:
+        newchannel->ringbuffer_gpadlhandle = 0;
+error_clean_ring:
         hv_ringbuffer_cleanup(&newchannel->outbound);
         hv_ringbuffer_cleanup(&newchannel->inbound);
-        __free_pages(page,
-                     get_order(send_ringbuffer_size + recv_ringbuffer_size));
-error_set_chnstate:
         newchannel->state = CHANNEL_OPEN_STATE;
         return err;
 }
+
+/*
+ * vmbus_connect_ring - Open the channel but reuse ring buffer
+ */
+int vmbus_connect_ring(struct vmbus_channel *newchannel,
+                       void (*onchannelcallback)(void *context), void *context)
+{
+        return  __vmbus_open(newchannel, NULL, 0, onchannelcallback, context);
+}
+EXPORT_SYMBOL_GPL(vmbus_connect_ring);
+
+/*
+ * vmbus_open - Open the specified channel.
+ */
+int vmbus_open(struct vmbus_channel *newchannel,
+               u32 send_ringbuffer_size, u32 recv_ringbuffer_size,
+               void *userdata, u32 userdatalen,
+               void (*onchannelcallback)(void *context), void *context)
+{
+        int err;
+
+        err = vmbus_alloc_ring(newchannel, send_ringbuffer_size,
+                               recv_ringbuffer_size);
+        if (err)
+                return err;
+
+        err = __vmbus_open(newchannel, userdata, userdatalen,
+                           onchannelcallback, context);
+        if (err)
+                vmbus_free_ring(newchannel);
+
+        return err;
+}
 EXPORT_SYMBOL_GPL(vmbus_open);
 
 /* Used for Hyper-V Socket: a guest client's connect() to the host */
@@ -612,10 +646,8 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
          * in Hyper-V Manager), the driver's remove() invokes vmbus_close():
          * here we should skip most of the below cleanup work.
          */
-        if (channel->state != CHANNEL_OPENED_STATE) {
-                ret = -EINVAL;
-                goto out;
-        }
+        if (channel->state != CHANNEL_OPENED_STATE)
+                return -EINVAL;
 
         channel->state = CHANNEL_OPEN_STATE;
 
@@ -637,11 +669,10 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
                  * If we failed to post the close msg,
                  * it is perhaps better to leak memory.
                  */
-                goto out;
         }
 
         /* Tear down the gpadl for the channel's ring buffer */
-        if (channel->ringbuffer_gpadlhandle) {
+        else if (channel->ringbuffer_gpadlhandle) {
                 ret = vmbus_teardown_gpadl(channel,
                                            channel->ringbuffer_gpadlhandle);
                 if (ret) {
@@ -650,74 +681,78 @@ static int vmbus_close_internal(struct vmbus_channel *channel)
                          * If we failed to teardown gpadl,
                          * it is perhaps better to leak memory.
                          */
-                        goto out;
                 }
-        }
-
-        /* Cleanup the ring buffers for this channel */
-        hv_ringbuffer_cleanup(&channel->outbound);
-        hv_ringbuffer_cleanup(&channel->inbound);
 
-        free_pages((unsigned long)channel->ringbuffer_pages,
-                get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
+                channel->ringbuffer_gpadlhandle = 0;
+        }
 
-out:
         return ret;
 }
 
-/*
- * vmbus_close - Close the specified channel
- */
-void vmbus_close(struct vmbus_channel *channel)
+/* disconnect ring - close all channels */
+int vmbus_disconnect_ring(struct vmbus_channel *channel)
 {
-        struct list_head *cur, *tmp;
-        struct vmbus_channel *cur_channel;
+        struct vmbus_channel *cur_channel, *tmp;
+        unsigned long flags;
+        LIST_HEAD(list);
+        int ret;
 
-        if (channel->primary_channel != NULL) {
-                /*
-                 * We will only close sub-channels when
-                 * the primary is closed.
-                 */
-                return;
-        }
-        /*
-         * Close all the sub-channels first and then close the
-         * primary channel.
-         */
-        list_for_each_safe(cur, tmp, &channel->sc_list) {
-                cur_channel = list_entry(cur, struct vmbus_channel, sc_list);
-                if (cur_channel->rescind) {
+        if (channel->primary_channel != NULL)
+                return -EINVAL;
+
+        /* Snapshot the list of subchannels */
+        spin_lock_irqsave(&channel->lock, flags);
+        list_splice_init(&channel->sc_list, &list);
+        channel->num_sc = 0;
+        spin_unlock_irqrestore(&channel->lock, flags);
+
+        list_for_each_entry_safe(cur_channel, tmp, &list, sc_list) {
+                if (cur_channel->rescind)
                         wait_for_completion(&cur_channel->rescind_event);
-                        mutex_lock(&vmbus_connection.channel_mutex);
-                        vmbus_close_internal(cur_channel);
-                        hv_process_channel_removal(
-                                           cur_channel->offermsg.child_relid);
-                } else {
-                        mutex_lock(&vmbus_connection.channel_mutex);
-                        vmbus_close_internal(cur_channel);
+
+                mutex_lock(&vmbus_connection.channel_mutex);
+                if (vmbus_close_internal(cur_channel) == 0) {
+                        vmbus_free_ring(cur_channel);
+
+                        if (cur_channel->rescind)
+                                hv_process_channel_removal(cur_channel);
                 }
                 mutex_unlock(&vmbus_connection.channel_mutex);
         }
+
         /*
          * Now close the primary.
          */
         mutex_lock(&vmbus_connection.channel_mutex);
-        vmbus_close_internal(channel);
+        ret = vmbus_close_internal(channel);
         mutex_unlock(&vmbus_connection.channel_mutex);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(vmbus_disconnect_ring);
+
+/*
+ * vmbus_close - Close the specified channel
+ */
+void vmbus_close(struct vmbus_channel *channel)
+{
+        if (vmbus_disconnect_ring(channel) == 0)
+                vmbus_free_ring(channel);
 }
 EXPORT_SYMBOL_GPL(vmbus_close);
 
 /**
  * vmbus_sendpacket() - Send the specified buffer on the given channel
- * @channel: Pointer to vmbus_channel structure.
- * @buffer: Pointer to the buffer you want to receive the data into.
- * @bufferlen: Maximum size of what the the buffer will hold
+ * @channel: Pointer to vmbus_channel structure
+ * @buffer: Pointer to the buffer you want to send the data from.
+ * @bufferlen: Maximum size of what the buffer holds.
  * @requestid: Identifier of the request
- * @type: Type of packet that is being send e.g. negotiate, time
- * packet etc.
+ * @type: Type of packet that is being sent e.g. negotiate, time
+ *        packet etc.
+ * @flags: 0 or VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED
  *
- * Sends data in @buffer directly to hyper-v via the vmbus
- * This will send the data unparsed to hyper-v.
+ * Sends data in @buffer directly to Hyper-V via the vmbus.
+ * This will send the data unparsed to Hyper-V.
  *
  * Mainly used by Hyper-V drivers.
  */
@@ -850,12 +885,13 @@ int vmbus_sendpacket_mpb_desc(struct vmbus_channel *channel,
 EXPORT_SYMBOL_GPL(vmbus_sendpacket_mpb_desc);
 
 /**
- * vmbus_recvpacket() - Retrieve the user packet on the specified channel
- * @channel: Pointer to vmbus_channel structure.
+ * __vmbus_recvpacket() - Retrieve the user packet on the specified channel
+ * @channel: Pointer to vmbus_channel structure
  * @buffer: Pointer to the buffer you want to receive the data into.
- * @bufferlen: Maximum size of what the the buffer will hold
- * @buffer_actual_len: The actual size of the data after it was received
+ * @bufferlen: Maximum size of what the buffer can hold.
+ * @buffer_actual_len: The actual size of the data after it was received.
  * @requestid: Identifier of the request
+ * @raw: true means keep the vmpacket_descriptor header in the received data.
  *
  * Receives directly from the hyper-v vmbus and puts the data it received
  * into Buffer. This will receive the data unparsed from hyper-v.
diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
index 0f0e091c117c..6277597d3d58 100644
--- a/drivers/hv/channel_mgmt.c
+++ b/drivers/hv/channel_mgmt.c
@@ -198,24 +198,19 @@ static u16 hv_get_dev_type(const struct vmbus_channel *channel)
 }
 
 /**
- * vmbus_prep_negotiate_resp() - Create default response for Hyper-V Negotiate message
+ * vmbus_prep_negotiate_resp() - Create default response for Negotiate message
  * @icmsghdrp: Pointer to msg header structure
- * @icmsg_negotiate: Pointer to negotiate message structure
  * @buf: Raw buffer channel data
+ * @fw_version: The framework versions we can support.
+ * @fw_vercnt: The size of @fw_version.
+ * @srv_version: The service versions we can support.
+ * @srv_vercnt: The size of @srv_version.
+ * @nego_fw_version: The selected framework version.
+ * @nego_srv_version: The selected service version.
  *
- * @icmsghdrp is of type &struct icmsg_hdr.
- * Set up and fill in default negotiate response message.
- *
- * The fw_version and fw_vercnt specifies the framework version that
- * we can support.
- *
- * The srv_version and srv_vercnt specifies the service
- * versions we can support.
- *
- * Versions are given in decreasing order.
- *
- * nego_fw_version and nego_srv_version store the selected protocol versions.
+ * Note: Versions are given in decreasing order.
  *
+ * Set up and fill in default negotiate response message.
  * Mainly used by Hyper-V drivers.
  */
 bool vmbus_prep_negotiate_resp(struct icmsg_hdr *icmsghdrp,
@@ -385,21 +380,14 @@ static void vmbus_release_relid(u32 relid)
         trace_vmbus_release_relid(&msg, ret);
 }
 
-void hv_process_channel_removal(u32 relid)
+void hv_process_channel_removal(struct vmbus_channel *channel)
 {
+        struct vmbus_channel *primary_channel;
         unsigned long flags;
-        struct vmbus_channel *primary_channel, *channel;
 
         BUG_ON(!mutex_is_locked(&vmbus_connection.channel_mutex));
-
-        /*
-         * Make sure channel is valid as we may have raced.
-         */
-        channel = relid2channel(relid);
-        if (!channel)
-                return;
-
         BUG_ON(!channel->rescind);
+
         if (channel->target_cpu != get_cpu()) {
                 put_cpu();
                 smp_call_function_single(channel->target_cpu,
@@ -429,7 +417,7 @@ void hv_process_channel_removal(u32 relid)
                 cpumask_clear_cpu(channel->target_cpu,
                                   &primary_channel->alloced_cpus_in_node);
 
-        vmbus_release_relid(relid);
+        vmbus_release_relid(channel->offermsg.child_relid);
 
         free_channel(channel);
 }
@@ -606,16 +594,18 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
         bool perf_chn = vmbus_devs[dev_type].perf_device;
         struct vmbus_channel *primary = channel->primary_channel;
         int next_node;
-        struct cpumask available_mask;
+        cpumask_var_t available_mask;
         struct cpumask *alloced_mask;
 
         if ((vmbus_proto_version == VERSION_WS2008) ||
-            (vmbus_proto_version == VERSION_WIN7) || (!perf_chn)) {
+            (vmbus_proto_version == VERSION_WIN7) || (!perf_chn) ||
+            !alloc_cpumask_var(&available_mask, GFP_KERNEL)) {
                 /*
                  * Prior to win8, all channel interrupts are
                  * delivered on cpu 0.
                  * Also if the channel is not a performance critical
                  * channel, bind it to cpu 0.
+                 * In case alloc_cpumask_var() fails, bind it to cpu 0.
                  */
                 channel->numa_node = 0;
                 channel->target_cpu = 0;
@@ -653,7 +643,7 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
                 cpumask_clear(alloced_mask);
         }
 
-        cpumask_xor(&available_mask, alloced_mask,
+        cpumask_xor(available_mask, alloced_mask,
                     cpumask_of_node(primary->numa_node));
 
         cur_cpu = -1;
@@ -671,10 +661,10 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
         }
 
         while (true) {
-                cur_cpu = cpumask_next(cur_cpu, &available_mask);
+                cur_cpu = cpumask_next(cur_cpu, available_mask);
                 if (cur_cpu >= nr_cpu_ids) {
                         cur_cpu = -1;
-                        cpumask_copy(&available_mask,
+                        cpumask_copy(available_mask,
                                      cpumask_of_node(primary->numa_node));
                         continue;
                 }
@@ -704,6 +694,8 @@ static void init_vp_index(struct vmbus_channel *channel, u16 dev_type)
 
         channel->target_cpu = cur_cpu;
         channel->target_vp = hv_cpu_number_to_vp_number(cur_cpu);
+
+        free_cpumask_var(available_mask);
 }
 
 static void vmbus_wait_for_unload(void)
@@ -943,7 +935,7 @@ static void vmbus_onoffer_rescind(struct vmbus_channel_message_header *hdr)
                          * The channel is currently not open;
                          * it is safe for us to cleanup the channel.
                          */
-                        hv_process_channel_removal(rescind->child_relid);
+                        hv_process_channel_removal(channel);
                 } else {
                         complete(&channel->rescind_event);
                 }
diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index 748a1c4172a6..332d7c34be5c 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -189,6 +189,17 @@ static void hv_init_clockevent_device(struct clock_event_device *dev, int cpu)
 int hv_synic_alloc(void)
 {
         int cpu;
+        struct hv_per_cpu_context *hv_cpu;
+
+        /*
+         * First, zero all per-cpu memory areas so hv_synic_free() can
+         * detect what memory has been allocated and cleanup properly
+         * after any failures.
+         */
+        for_each_present_cpu(cpu) {
+                hv_cpu = per_cpu_ptr(hv_context.cpu_context, cpu);
+                memset(hv_cpu, 0, sizeof(*hv_cpu));
+        }
 
         hv_context.hv_numa_map = kcalloc(nr_node_ids, sizeof(struct cpumask),
                                          GFP_KERNEL);
@@ -198,10 +209,8 @@ int hv_synic_alloc(void)
         }
 
         for_each_present_cpu(cpu) {
-                struct hv_per_cpu_context *hv_cpu
-                        = per_cpu_ptr(hv_context.cpu_context, cpu);
+                hv_cpu = per_cpu_ptr(hv_context.cpu_context, cpu);
 
-                memset(hv_cpu, 0, sizeof(*hv_cpu));
                 tasklet_init(&hv_cpu->msg_dpc,
                              vmbus_on_msg_dpc, (unsigned long) hv_cpu);
 
diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
index b1b788082793..41631512ae97 100644
--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -689,7 +689,7 @@ static void hv_page_online_one(struct hv_hotadd_state *has, struct page *pg)
         __online_page_increment_counters(pg);
         __online_page_free(pg);
 
-        WARN_ON_ONCE(!spin_is_locked(&dm_device.ha_lock));
+        lockdep_assert_held(&dm_device.ha_lock);
         dm_device.num_pages_onlined++;
 }
 
diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c
index 5eed1e7da15c..a7513a8a8e37 100644
--- a/drivers/hv/hv_kvp.c
+++ b/drivers/hv/hv_kvp.c
@@ -353,7 +353,6 @@ static void process_ib_ipinfo(void *in_msg, void *out_msg, int op)
 
                 out->body.kvp_ip_val.dhcp_enabled = in->kvp_ip_val.dhcp_enabled;
 
-        default:
                 utf16s_to_utf8s((wchar_t *)in->kvp_ip_val.adapter_id,
                                 MAX_ADAPTER_ID_SIZE,
                                 UTF16_LITTLE_ENDIAN,
@@ -406,7 +405,7 @@ kvp_send_key(struct work_struct *dummy)
                 process_ib_ipinfo(in_msg, message, KVP_OP_SET_IP_INFO);
                 break;
         case KVP_OP_GET_IP_INFO:
-                process_ib_ipinfo(in_msg, message, KVP_OP_GET_IP_INFO);
+                /* We only need to pass on message->kvp_hdr.operation.  */
                 break;
         case KVP_OP_SET:
                 switch (in_msg->body.kvp_set.data.value_type) {
@@ -421,7 +420,7 @@ kvp_send_key(struct work_struct *dummy)
                                 UTF16_LITTLE_ENDIAN,
                                 message->body.kvp_set.data.value,
                                 HV_KVP_EXCHANGE_MAX_VALUE_SIZE - 1) + 1;
-                                break;
+                        break;
 
                 case REG_U32:
                         /*
@@ -446,6 +445,9 @@ kvp_send_key(struct work_struct *dummy)
                         break;
 
                 }
+
+                break;
+
         case KVP_OP_GET:
                 message->body.kvp_set.data.key_size =
                         utf16s_to_utf8s(
@@ -454,7 +456,7 @@ kvp_send_key(struct work_struct *dummy)
                         UTF16_LITTLE_ENDIAN,
                         message->body.kvp_set.data.key,
                         HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
-                        break;
+                break;
 
         case KVP_OP_DELETE:
                 message->body.kvp_delete.key_size =
@@ -464,12 +466,12 @@ kvp_send_key(struct work_struct *dummy)
                         UTF16_LITTLE_ENDIAN,
                         message->body.kvp_delete.key,
                         HV_KVP_EXCHANGE_MAX_KEY_SIZE - 1) + 1;
-                        break;
+                break;
 
         case KVP_OP_ENUMERATE:
                 message->body.kvp_enum_data.index =
                         in_msg->body.kvp_enum_data.index;
-                        break;
+                break;
         }
 
         kvp_transaction.state = HVUTIL_USERSPACE_REQ;
diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c
index 3e90eb91db45..64d0c85d5161 100644
--- a/drivers/hv/ring_buffer.c
+++ b/drivers/hv/ring_buffer.c
@@ -241,6 +241,7 @@ int hv_ringbuffer_init(struct hv_ring_buffer_info *ring_info,
 void hv_ringbuffer_cleanup(struct hv_ring_buffer_info *ring_info)
 {
         vunmap(ring_info->ring_buffer);
+        ring_info->ring_buffer = NULL;
 }
 
 /* Write to the ring buffer. */
diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
index c71cc857b649..283d184280af 100644
--- a/drivers/hv/vmbus_drv.c
+++ b/drivers/hv/vmbus_drv.c
@@ -498,6 +498,54 @@ static ssize_t device_show(struct device *dev,
 }
 static DEVICE_ATTR_RO(device);
 
+static ssize_t driver_override_store(struct device *dev,
+                                     struct device_attribute *attr,
+                                     const char *buf, size_t count)
+{
+        struct hv_device *hv_dev = device_to_hv_device(dev);
+        char *driver_override, *old, *cp;
+
+        /* We need to keep extra room for a newline */
+        if (count >= (PAGE_SIZE - 1))
+                return -EINVAL;
+
+        driver_override = kstrndup(buf, count, GFP_KERNEL);
+        if (!driver_override)
+                return -ENOMEM;
+
+        cp = strchr(driver_override, '\n');
+        if (cp)
+                *cp = '\0';
+
+        device_lock(dev);
+        old = hv_dev->driver_override;
+        if (strlen(driver_override)) {
+                hv_dev->driver_override = driver_override;
+        } else {
+                kfree(driver_override);
+                hv_dev->driver_override = NULL;
+        }
+        device_unlock(dev);
+
+        kfree(old);
+
+        return count;
+}
+
+static ssize_t driver_override_show(struct device *dev,
+                                    struct device_attribute *attr, char *buf)
+{
+        struct hv_device *hv_dev = device_to_hv_device(dev);
+        ssize_t len;
+
+        device_lock(dev);
+        len = snprintf(buf, PAGE_SIZE, "%s\n", hv_dev->driver_override);
+        device_unlock(dev);
+
+        return len;
+}
+static DEVICE_ATTR_RW(driver_override);
+
 /* Set up per device attributes in /sys/bus/vmbus/devices/<bus device> */
 static struct attribute *vmbus_dev_attrs[] = {
         &dev_attr_id.attr,
@@ -528,6 +576,7 @@ static struct attribute *vmbus_dev_attrs[] = {
         &dev_attr_channel_vp_mapping.attr,
         &dev_attr_vendor.attr,
         &dev_attr_device.attr,
+        &dev_attr_driver_override.attr,
         NULL,
 };
 ATTRIBUTE_GROUPS(vmbus_dev);
@@ -563,17 +612,26 @@ static inline bool is_null_guid(const uuid_le *guid)
         return true;
 }
 
-/*
- * Return a matching hv_vmbus_device_id pointer.
- * If there is no match, return NULL.
- */
-static const struct hv_vmbus_device_id *hv_vmbus_get_id(struct hv_driver *drv,
-                                        const uuid_le *guid)
+static const struct hv_vmbus_device_id *
+hv_vmbus_dev_match(const struct hv_vmbus_device_id *id, const uuid_le *guid)
+
+{
+        if (id == NULL)
+                return NULL; /* empty device table */
+
+        for (; !is_null_guid(&id->guid); id++)
+                if (!uuid_le_cmp(id->guid, *guid))
+                        return id;
+
+        return NULL;
+}
+
+static const struct hv_vmbus_device_id *
+hv_vmbus_dynid_match(struct hv_driver *drv, const uuid_le *guid)
 {
         const struct hv_vmbus_device_id *id = NULL;
         struct vmbus_dynid *dynid;
 
-        /* Look at the dynamic ids first, before the static ones */
         spin_lock(&drv->dynids.lock);
         list_for_each_entry(dynid, &drv->dynids.list, node) {
                 if (!uuid_le_cmp(dynid->id.guid, *guid)) {
@@ -583,18 +641,37 @@ static const struct hv_vmbus_device_id *hv_vmbus_get_id(struct hv_driver *drv,
         }
         spin_unlock(&drv->dynids.lock);
 
-        if (id)
-                return id;
+        return id;
+}
 
-        id = drv->id_table;
-        if (id == NULL)
-                return NULL; /* empty device table */
+static const struct hv_vmbus_device_id vmbus_device_null = {
+        .guid = NULL_UUID_LE,
+};
 
-        for (; !is_null_guid(&id->guid); id++)
-                if (!uuid_le_cmp(id->guid, *guid))
-                        return id;
+/*
+ * Return a matching hv_vmbus_device_id pointer.
+ * If there is no match, return NULL.
+ */
+static const struct hv_vmbus_device_id *hv_vmbus_get_id(struct hv_driver *drv,
+                                                        struct hv_device *dev)
+{
+        const uuid_le *guid = &dev->dev_type;
+        const struct hv_vmbus_device_id *id;
 
-        return NULL;
+        /* When driver_override is set, only bind to the matching driver */
+        if (dev->driver_override && strcmp(dev->driver_override, drv->name))
+                return NULL;
+
+        /* Look at the dynamic ids first, before the static ones */
+        id = hv_vmbus_dynid_match(drv, guid);
+        if (!id)
+                id = hv_vmbus_dev_match(drv->id_table, guid);
+
+        /* driver_override will always match, send a dummy id */
+        if (!id && dev->driver_override)
+                id = &vmbus_device_null;
+
+        return id;
 }
 
 /* vmbus_add_dynid - add a new device ID to this driver and re-probe devices */
@@ -643,7 +720,7 @@ static ssize_t new_id_store(struct device_driver *driver, const char *buf,
         if (retval)
                 return retval;
 
-        if (hv_vmbus_get_id(drv, &guid))
+        if (hv_vmbus_dynid_match(drv, &guid))
                 return -EEXIST;
 
         retval = vmbus_add_dynid(drv, &guid);
@@ -708,7 +785,7 @@ static int vmbus_match(struct device *device, struct device_driver *driver)
         if (is_hvsock_channel(hv_dev->channel))
                 return drv->hvsock;
 
-        if (hv_vmbus_get_id(drv, &hv_dev->dev_type))
+        if (hv_vmbus_get_id(drv, hv_dev))
                 return 1;
 
         return 0;
@@ -725,7 +802,7 @@ static int vmbus_probe(struct device *child_device)
         struct hv_device *dev = device_to_hv_device(child_device);
         const struct hv_vmbus_device_id *dev_id;
 
-        dev_id = hv_vmbus_get_id(drv, &dev->dev_type);
+        dev_id = hv_vmbus_get_id(drv, dev);
         if (drv->probe) {
                 ret = drv->probe(dev, dev_id);
                 if (ret != 0)
@@ -787,10 +864,9 @@ static void vmbus_device_release(struct device *device)
         struct vmbus_channel *channel = hv_dev->channel;
 
         mutex_lock(&vmbus_connection.channel_mutex);
-        hv_process_channel_removal(channel->offermsg.child_relid);
+        hv_process_channel_removal(channel);
         mutex_unlock(&vmbus_connection.channel_mutex);
         kfree(hv_dev);
-
 }
 
 /* The one and only one */
diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c
index ff94e58845b7..170fbb66bda2 100644
--- a/drivers/hwtracing/coresight/coresight-catu.c
+++ b/drivers/hwtracing/coresight/coresight-catu.c
@@ -406,6 +406,7 @@ static inline int catu_wait_for_ready(struct catu_drvdata *drvdata)
 
 static int catu_enable_hw(struct catu_drvdata *drvdata, void *data)
 {
+        int rc;
         u32 control, mode;
         struct etr_buf *etr_buf = data;
 
@@ -418,6 +419,10 @@ static int catu_enable_hw(struct catu_drvdata *drvdata, void *data)
                 return -EBUSY;
         }
 
+        rc = coresight_claim_device_unlocked(drvdata->base);
+        if (rc)
+                return rc;
+
         control |= BIT(CATU_CONTROL_ENABLE);
 
         if (etr_buf && etr_buf->mode == ETR_MODE_CATU) {
@@ -459,6 +464,7 @@ static int catu_disable_hw(struct catu_drvdata *drvdata)
         int rc = 0;
 
         catu_write_control(drvdata, 0);
+        coresight_disclaim_device_unlocked(drvdata->base);
         if (catu_wait_for_ready(drvdata)) {
                 dev_info(drvdata->dev, "Timeout while waiting for READY\n");
                 rc = -EAGAIN;
diff --git a/drivers/hwtracing/coresight/coresight-dynamic-replicator.c b/drivers/hwtracing/coresight/coresight-dynamic-replicator.c
index f6d0571ab9dd..299667b887fc 100644
--- a/drivers/hwtracing/coresight/coresight-dynamic-replicator.c
+++ b/drivers/hwtracing/coresight/coresight-dynamic-replicator.c
@@ -34,48 +34,87 @@ struct replicator_state {
         struct coresight_device *csdev;
 };
 
+/*
+ * replicator_reset : Reset the replicator configuration to sane values.
+ */
+static void replicator_reset(struct replicator_state *drvdata)
+{
+        CS_UNLOCK(drvdata->base);
+
+        if (!coresight_claim_device_unlocked(drvdata->base)) {
+                writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER0);
+                writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER1);
+                coresight_disclaim_device_unlocked(drvdata->base);
+        }
+
+        CS_LOCK(drvdata->base);
+}
+
 static int replicator_enable(struct coresight_device *csdev, int inport,
                               int outport)
 {
+        int rc = 0;
+        u32 reg;
         struct replicator_state *drvdata = dev_get_drvdata(csdev->dev.parent);
 
+        switch (outport) {
+        case 0:
+                reg = REPLICATOR_IDFILTER0;
+                break;
+        case 1:
+                reg = REPLICATOR_IDFILTER1;
+                break;
+        default:
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
         CS_UNLOCK(drvdata->base);
 
-        /*
-         * Ensure that the other port is disabled
-         * 0x00 - passing through the replicator unimpeded
-         * 0xff - disable (or impede) the flow of ATB data
-         */
-        if (outport == 0) {
-                writel_relaxed(0x00, drvdata->base + REPLICATOR_IDFILTER0);
-                writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER1);
-        } else {
-                writel_relaxed(0x00, drvdata->base + REPLICATOR_IDFILTER1);
-                writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER0);
+        if ((readl_relaxed(drvdata->base + REPLICATOR_IDFILTER0) == 0xff) &&
+            (readl_relaxed(drvdata->base + REPLICATOR_IDFILTER1) == 0xff))
+                rc = coresight_claim_device_unlocked(drvdata->base);
+
+        /* Ensure that the outport is enabled. */
+        if (!rc) {
+                writel_relaxed(0x00, drvdata->base + reg);
+                dev_dbg(drvdata->dev, "REPLICATOR enabled\n");
         }
 
         CS_LOCK(drvdata->base);
 
-        dev_info(drvdata->dev, "REPLICATOR enabled\n");
-        return 0;
+        return rc;
 }
 
 static void replicator_disable(struct coresight_device *csdev, int inport,
                                 int outport)
 {
+        u32 reg;
         struct replicator_state *drvdata = dev_get_drvdata(csdev->dev.parent);
 
+        switch (outport) {
+        case 0:
+                reg = REPLICATOR_IDFILTER0;
+                break;
+        case 1:
+                reg = REPLICATOR_IDFILTER1;
+                break;
+        default:
+                WARN_ON(1);
+                return;
+        }
+
         CS_UNLOCK(drvdata->base);
 
         /* disable the flow of ATB data through port */
-        if (outport == 0)
-                writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER0);
-        else
-                writel_relaxed(0xff, drvdata->base + REPLICATOR_IDFILTER1);
+        writel_relaxed(0xff, drvdata->base + reg);
 
+        if ((readl_relaxed(drvdata->base + REPLICATOR_IDFILTER0) == 0xff) &&
+            (readl_relaxed(drvdata->base + REPLICATOR_IDFILTER1) == 0xff))
+                coresight_disclaim_device_unlocked(drvdata->base);
         CS_LOCK(drvdata->base);
 
-        dev_info(drvdata->dev, "REPLICATOR disabled\n");
+        dev_dbg(drvdata->dev, "REPLICATOR disabled\n");
 }
 
 static const struct coresight_ops_link replicator_link_ops = {
@@ -156,7 +195,11 @@ static int replicator_probe(struct amba_device *adev, const struct amba_id *id)
         desc.groups = replicator_groups;
         drvdata->csdev = coresight_register(&desc);
 
-        return PTR_ERR_OR_ZERO(drvdata->csdev);
+        if (!IS_ERR(drvdata->csdev)) {
+                replicator_reset(drvdata);
+                return 0;
+        }
+        return PTR_ERR(drvdata->csdev);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c
index 306119eaf16a..824be0c5f592 100644
--- a/drivers/hwtracing/coresight/coresight-etb10.c
+++ b/drivers/hwtracing/coresight/coresight-etb10.c
@@ -5,7 +5,6 @@
  * Description: CoreSight Embedded Trace Buffer driver
  */
 
-#include <asm/local.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/types.h>
@@ -28,6 +27,7 @@
 
 
 #include "coresight-priv.h"
+#include "coresight-etm-perf.h"
 
 #define ETB_RAM_DEPTH_REG       0x004
 #define ETB_STATUS_REG          0x00c
@@ -71,8 +71,8 @@
  * @miscdev:    specifics to handle "/dev/xyz.etb" entry.
  * @spinlock:   only one at a time pls.
  * @reading:    synchronise user space access to etb buffer.
- * @mode:       this ETB is being used.
  * @buf:        area of memory where ETB buffer content gets sent.
+ * @mode:       this ETB is being used.
  * @buffer_depth: size of @buf.
  * @trigger_cntr: amount of words to store after a trigger.
  */
@@ -84,12 +84,15 @@ struct etb_drvdata {
         struct miscdevice       miscdev;
         spinlock_t              spinlock;
         local_t                 reading;
-        local_t                 mode;
         u8                      *buf;
+        u32                     mode;
         u32                     buffer_depth;
         u32                     trigger_cntr;
 };
 
+static int etb_set_buffer(struct coresight_device *csdev,
+                          struct perf_output_handle *handle);
+
 static unsigned int etb_get_buffer_depth(struct etb_drvdata *drvdata)
 {
         u32 depth = 0;
@@ -103,7 +106,7 @@ static unsigned int etb_get_buffer_depth(struct etb_drvdata *drvdata)
         return depth;
 }
 
-static void etb_enable_hw(struct etb_drvdata *drvdata)
+static void __etb_enable_hw(struct etb_drvdata *drvdata)
 {
         int i;
         u32 depth;
@@ -131,32 +134,92 @@ static void etb_enable_hw(struct etb_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
-static int etb_enable(struct coresight_device *csdev, u32 mode)
+static int etb_enable_hw(struct etb_drvdata *drvdata)
+{
+        __etb_enable_hw(drvdata);
+        return 0;
+}
+
+static int etb_enable_sysfs(struct coresight_device *csdev)
 {
-        u32 val;
+        int ret = 0;
         unsigned long flags;
         struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        val = local_cmpxchg(&drvdata->mode,
-                            CS_MODE_DISABLED, mode);
-        /*
-         * When accessing from Perf, a HW buffer can be handled
-         * by a single trace entity.  In sysFS mode many tracers
-         * can be logging to the same HW buffer.
-         */
-        if (val == CS_MODE_PERF)
-                return -EBUSY;
+        spin_lock_irqsave(&drvdata->spinlock, flags);
+
+        /* Don't messup with perf sessions. */
+        if (drvdata->mode == CS_MODE_PERF) {
+                ret = -EBUSY;
+                goto out;
+        }
 
         /* Nothing to do, the tracer is already enabled. */
-        if (val == CS_MODE_SYSFS)
+        if (drvdata->mode == CS_MODE_SYSFS)
                 goto out;
 
-        spin_lock_irqsave(&drvdata->spinlock, flags);
-        etb_enable_hw(drvdata);
+        ret = etb_enable_hw(drvdata);
+        if (!ret)
+                drvdata->mode = CS_MODE_SYSFS;
+
+out:
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
+        return ret;
+}
+
+static int etb_enable_perf(struct coresight_device *csdev, void *data)
+{
+        int ret = 0;
+        unsigned long flags;
+        struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        spin_lock_irqsave(&drvdata->spinlock, flags);
+
+        /* No need to continue if the component is already in use. */
+        if (drvdata->mode != CS_MODE_DISABLED) {
+                ret = -EBUSY;
+                goto out;
+        }
+
+        /*
+         * We don't have an internal state to clean up if we fail to setup
+         * the perf buffer. So we can perform the step before we turn the
+         * ETB on and leave without cleaning up.
+         */
+        ret = etb_set_buffer(csdev, (struct perf_output_handle *)data);
+        if (ret)
+                goto out;
+
+        ret = etb_enable_hw(drvdata);
+        if (!ret)
+                drvdata->mode = CS_MODE_PERF;
 
 out:
-        dev_info(drvdata->dev, "ETB enabled\n");
+        spin_unlock_irqrestore(&drvdata->spinlock, flags);
+        return ret;
+}
+
+static int etb_enable(struct coresight_device *csdev, u32 mode, void *data)
+{
+        int ret;
+        struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        switch (mode) {
+        case CS_MODE_SYSFS:
+                ret = etb_enable_sysfs(csdev);
+                break;
+        case CS_MODE_PERF:
+                ret = etb_enable_perf(csdev, data);
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+
+        if (ret)
+                return ret;
+
+        dev_dbg(drvdata->dev, "ETB enabled\n");
         return 0;
 }
 
@@ -256,13 +319,16 @@ static void etb_disable(struct coresight_device *csdev)
         unsigned long flags;
 
         spin_lock_irqsave(&drvdata->spinlock, flags);
-        etb_disable_hw(drvdata);
-        etb_dump_hw(drvdata);
-        spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-        local_set(&drvdata->mode, CS_MODE_DISABLED);
+        /* Disable the ETB only if it needs to */
+        if (drvdata->mode != CS_MODE_DISABLED) {
+                etb_disable_hw(drvdata);
+                etb_dump_hw(drvdata);
+                drvdata->mode = CS_MODE_DISABLED;
+        }
+        spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-        dev_info(drvdata->dev, "ETB disabled\n");
+        dev_dbg(drvdata->dev, "ETB disabled\n");
 }
 
 static void *etb_alloc_buffer(struct coresight_device *csdev, int cpu,
@@ -294,12 +360,14 @@ static void etb_free_buffer(void *config)
 }
 
 static int etb_set_buffer(struct coresight_device *csdev,
-                          struct perf_output_handle *handle,
-                          void *sink_config)
+                          struct perf_output_handle *handle)
 {
         int ret = 0;
         unsigned long head;
-        struct cs_buffers *buf = sink_config;
+        struct cs_buffers *buf = etm_perf_sink_config(handle);
+
+        if (!buf)
+                return -EINVAL;
 
         /* wrap head around to the amount of space we have */
         head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1);
@@ -315,37 +383,7 @@ static int etb_set_buffer(struct coresight_device *csdev,
         return ret;
 }
 
-static unsigned long etb_reset_buffer(struct coresight_device *csdev,
-                                      struct perf_output_handle *handle,
-                                      void *sink_config)
-{
-        unsigned long size = 0;
-        struct cs_buffers *buf = sink_config;
-
-        if (buf) {
-                /*
-                 * In snapshot mode ->data_size holds the new address of the
-                 * ring buffer's head.  The size itself is the whole address
-                 * range since we want the latest information.
-                 */
-                if (buf->snapshot)
-                        handle->head = local_xchg(&buf->data_size,
-                                                  buf->nr_pages << PAGE_SHIFT);
-
-                /*
-                 * Tell the tracer PMU how much we got in this run and if
-                 * something went wrong along the way.  Nobody else can use
-                 * this cs_buffers instance until we are done.  As such
-                 * resetting parameters here and squaring off with the ring
-                 * buffer API in the tracer PMU is fine.
-                 */
-                size = local_xchg(&buf->data_size, 0);
-        }
-
-        return size;
-}
-
-static void etb_update_buffer(struct coresight_device *csdev,
+static unsigned long etb_update_buffer(struct coresight_device *csdev,
                               struct perf_output_handle *handle,
                               void *sink_config)
 {
@@ -354,13 +392,13 @@ static void etb_update_buffer(struct coresight_device *csdev,
         u8 *buf_ptr;
         const u32 *barrier;
         u32 read_ptr, write_ptr, capacity;
-        u32 status, read_data, to_read;
-        unsigned long offset;
+        u32 status, read_data;
+        unsigned long offset, to_read;
         struct cs_buffers *buf = sink_config;
         struct etb_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
         if (!buf)
-                return;
+                return 0;
 
         capacity = drvdata->buffer_depth * ETB_FRAME_SIZE_WORDS;
 
@@ -465,18 +503,17 @@ static void etb_update_buffer(struct coresight_device *csdev,
         writel_relaxed(0x0, drvdata->base + ETB_RAM_WRITE_POINTER);
 
         /*
-         * In snapshot mode all we have to do is communicate to
-         * perf_aux_output_end() the address of the current head.  In full
-         * trace mode the same function expects a size to move rb->aux_head
-         * forward.
+         * In snapshot mode we have to update the handle->head to point
+         * to the new location.
          */
-        if (buf->snapshot)
-                local_set(&buf->data_size, (cur * PAGE_SIZE) + offset);
-        else
-                local_add(to_read, &buf->data_size);
-
+        if (buf->snapshot) {
+                handle->head = (cur * PAGE_SIZE) + offset;
+                to_read = buf->nr_pages << PAGE_SHIFT;
+        }
         etb_enable_hw(drvdata);
         CS_LOCK(drvdata->base);
+
+        return to_read;
 }
 
 static const struct coresight_ops_sink etb_sink_ops = {
@@ -484,8 +521,6 @@ static const struct coresight_ops_sink etb_sink_ops = {
         .disable        = etb_disable,
         .alloc_buffer   = etb_alloc_buffer,
         .free_buffer    = etb_free_buffer,
-        .set_buffer     = etb_set_buffer,
-        .reset_buffer   = etb_reset_buffer,
         .update_buffer  = etb_update_buffer,
 };
 
@@ -498,14 +533,14 @@ static void etb_dump(struct etb_drvdata *drvdata)
         unsigned long flags;
 
         spin_lock_irqsave(&drvdata->spinlock, flags);
-        if (local_read(&drvdata->mode) == CS_MODE_SYSFS) {
+        if (drvdata->mode == CS_MODE_SYSFS) {
                 etb_disable_hw(drvdata);
                 etb_dump_hw(drvdata);
                 etb_enable_hw(drvdata);
         }
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-        dev_info(drvdata->dev, "ETB dumped\n");
+        dev_dbg(drvdata->dev, "ETB dumped\n");
 }
 
 static int etb_open(struct inode *inode, struct file *file)
diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
index 677695635211..abe8249b893b 100644
--- a/drivers/hwtracing/coresight/coresight-etm-perf.c
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
@@ -12,6 +12,7 @@
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/perf_event.h>
+#include <linux/percpu-defs.h>
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/workqueue.h>
@@ -22,20 +23,6 @@
 static struct pmu etm_pmu;
 static bool etm_perf_up;
 
-/**
- * struct etm_event_data - Coresight specifics associated to an event
- * @work:               Handle to free allocated memory outside IRQ context.
- * @mask:               Hold the CPU(s) this event was set for.
- * @snk_config:         The sink configuration.
- * @path:               An array of path, each slot for one CPU.
- */
-struct etm_event_data {
-        struct work_struct work;
-        cpumask_t mask;
-        void *snk_config;
-        struct list_head **path;
-};
-
 static DEFINE_PER_CPU(struct perf_output_handle, ctx_handle);
 static DEFINE_PER_CPU(struct coresight_device *, csdev_src);
 
@@ -61,6 +48,18 @@ static const struct attribute_group *etm_pmu_attr_groups[] = {
         NULL,
 };
 
+static inline struct list_head **
+etm_event_cpu_path_ptr(struct etm_event_data *data, int cpu)
+{
+        return per_cpu_ptr(data->path, cpu);
+}
+
+static inline struct list_head *
+etm_event_cpu_path(struct etm_event_data *data, int cpu)
+{
+        return *etm_event_cpu_path_ptr(data, cpu);
+}
+
 static void etm_event_read(struct perf_event *event) {}
 
 static int etm_addr_filters_alloc(struct perf_event *event)
@@ -114,29 +113,30 @@ static void free_event_data(struct work_struct *work)
 
         event_data = container_of(work, struct etm_event_data, work);
         mask = &event_data->mask;
-        /*
-         * First deal with the sink configuration.  See comment in
-         * etm_setup_aux() about why we take the first available path.
-         */
-        if (event_data->snk_config) {
+
+        /* Free the sink buffers, if there are any */
+        if (event_data->snk_config && !WARN_ON(cpumask_empty(mask))) {
                 cpu = cpumask_first(mask);
-                sink = coresight_get_sink(event_data->path[cpu]);
+                sink = coresight_get_sink(etm_event_cpu_path(event_data, cpu));
                 if (sink_ops(sink)->free_buffer)
                         sink_ops(sink)->free_buffer(event_data->snk_config);
         }
 
         for_each_cpu(cpu, mask) {
-                if (!(IS_ERR_OR_NULL(event_data->path[cpu])))
-                        coresight_release_path(event_data->path[cpu]);
+                struct list_head **ppath;
+
+                ppath = etm_event_cpu_path_ptr(event_data, cpu);
+                if (!(IS_ERR_OR_NULL(*ppath)))
+                        coresight_release_path(*ppath);
+                *ppath = NULL;
         }
 
-        kfree(event_data->path);
+        free_percpu(event_data->path);
         kfree(event_data);
 }
 
 static void *alloc_event_data(int cpu)
 {
-        int size;
         cpumask_t *mask;
         struct etm_event_data *event_data;
 
@@ -145,16 +145,12 @@ static void *alloc_event_data(int cpu)
         if (!event_data)
                 return NULL;
 
-        /* Make sure nothing disappears under us */
-        get_online_cpus();
-        size = num_online_cpus();
 
         mask = &event_data->mask;
         if (cpu != -1)
                 cpumask_set_cpu(cpu, mask);
         else
-                cpumask_copy(mask, cpu_online_mask);
-        put_online_cpus();
+                cpumask_copy(mask, cpu_present_mask);
 
         /*
          * Each CPU has a single path between source and destination.  As such
@@ -164,8 +160,8 @@ static void *alloc_event_data(int cpu)
          * unused memory when dealing with single CPU trace scenarios is small
          * compared to the cost of searching through an optimized array.
          */
-        event_data->path = kcalloc(size,
-                                   sizeof(struct list_head *), GFP_KERNEL);
+        event_data->path = alloc_percpu(struct list_head *);
+
         if (!event_data->path) {
                 kfree(event_data);
                 return NULL;
@@ -206,34 +202,53 @@ static void *etm_setup_aux(int event_cpu, void **pages,
          * on the cmd line.  As such the "enable_sink" flag in sysFS is reset.
          */
         sink = coresight_get_enabled_sink(true);
-        if (!sink)
+        if (!sink || !sink_ops(sink)->alloc_buffer)
                 goto err;
 
         mask = &event_data->mask;
 
-        /* Setup the path for each CPU in a trace session */
+        /*
+         * Setup the path for each CPU in a trace session. We try to build
+         * trace path for each CPU in the mask. If we don't find an ETM
+         * for the CPU or fail to build a path, we clear the CPU from the
+         * mask and continue with the rest. If ever we try to trace on those
+         * CPUs, we can handle it and fail the session.
+         */
         for_each_cpu(cpu, mask) {
+                struct list_head *path;
                 struct coresight_device *csdev;
 
                 csdev = per_cpu(csdev_src, cpu);
-                if (!csdev)
-                        goto err;
+                /*
+                 * If there is no ETM associated with this CPU clear it from
+                 * the mask and continue with the rest. If ever we try to trace
+                 * on this CPU, we handle it accordingly.
+                 */
+                if (!csdev) {
+                        cpumask_clear_cpu(cpu, mask);
+                        continue;
+                }
 
                 /*
                  * Building a path doesn't enable it, it simply builds a
                  * list of devices from source to sink that can be
                  * referenced later when the path is actually needed.
                  */
-                event_data->path[cpu] = coresight_build_path(csdev, sink);
-                if (IS_ERR(event_data->path[cpu]))
-                        goto err;
+                path = coresight_build_path(csdev, sink);
+                if (IS_ERR(path)) {
+                        cpumask_clear_cpu(cpu, mask);
+                        continue;
+                }
+
+                *etm_event_cpu_path_ptr(event_data, cpu) = path;
         }
 
-        if (!sink_ops(sink)->alloc_buffer)
+        /* If we don't have any CPUs ready for tracing, abort */
+        cpu = cpumask_first(mask);
+        if (cpu >= nr_cpu_ids)
                 goto err;
 
-        cpu = cpumask_first(mask);
-        /* Get the AUX specific data from the sink buffer */
+        /* Allocate the sink buffer for this session */
         event_data->snk_config =
                         sink_ops(sink)->alloc_buffer(sink, cpu, pages,
                                                      nr_pages, overwrite);
@@ -255,6 +270,7 @@ static void etm_event_start(struct perf_event *event, int flags)
         struct etm_event_data *event_data;
         struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
         struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
+        struct list_head *path;
 
         if (!csdev)
                 goto fail;
@@ -267,18 +283,14 @@ static void etm_event_start(struct perf_event *event, int flags)
         if (!event_data)
                 goto fail;
 
+        path = etm_event_cpu_path(event_data, cpu);
         /* We need a sink, no need to continue without one */
-        sink = coresight_get_sink(event_data->path[cpu]);
-        if (WARN_ON_ONCE(!sink || !sink_ops(sink)->set_buffer))
-                goto fail_end_stop;
-
-        /* Configure the sink */
-        if (sink_ops(sink)->set_buffer(sink, handle,
-                                       event_data->snk_config))
+        sink = coresight_get_sink(path);
+        if (WARN_ON_ONCE(!sink))
                 goto fail_end_stop;
 
         /* Nothing will happen without a path */
-        if (coresight_enable_path(event_data->path[cpu], CS_MODE_PERF))
+        if (coresight_enable_path(path, CS_MODE_PERF, handle))
                 goto fail_end_stop;
 
         /* Tell the perf core the event is alive */
@@ -286,11 +298,13 @@ static void etm_event_start(struct perf_event *event, int flags)
 
         /* Finally enable the tracer */
         if (source_ops(csdev)->enable(csdev, event, CS_MODE_PERF))
-                goto fail_end_stop;
+                goto fail_disable_path;
 
 out:
         return;
 
+fail_disable_path:
+        coresight_disable_path(path);
 fail_end_stop:
         perf_aux_output_flag(handle, PERF_AUX_FLAG_TRUNCATED);
         perf_aux_output_end(handle, 0);
@@ -306,6 +320,7 @@ static void etm_event_stop(struct perf_event *event, int mode)
         struct coresight_device *sink, *csdev = per_cpu(csdev_src, cpu);
         struct perf_output_handle *handle = this_cpu_ptr(&ctx_handle);
         struct etm_event_data *event_data = perf_get_aux(handle);
+        struct list_head *path;
 
         if (event->hw.state == PERF_HES_STOPPED)
                 return;
@@ -313,7 +328,11 @@ static void etm_event_stop(struct perf_event *event, int mode)
         if (!csdev)
                 return;
 
-        sink = coresight_get_sink(event_data->path[cpu]);
+        path = etm_event_cpu_path(event_data, cpu);
+        if (!path)
+                return;
+
+        sink = coresight_get_sink(path);
         if (!sink)
                 return;
 
@@ -331,20 +350,13 @@ static void etm_event_stop(struct perf_event *event, int mode)
                 if (!sink_ops(sink)->update_buffer)
                         return;
 
-                sink_ops(sink)->update_buffer(sink, handle,
+                size = sink_ops(sink)->update_buffer(sink, handle,
                                               event_data->snk_config);
-
-                if (!sink_ops(sink)->reset_buffer)
-                        return;
-
-                size = sink_ops(sink)->reset_buffer(sink, handle,
-                                                    event_data->snk_config);
-
                 perf_aux_output_end(handle, size);
         }
 
         /* Disabling the path make its elements available to other sessions */
-        coresight_disable_path(event_data->path[cpu]);
+        coresight_disable_path(path);
 }
 
 static int etm_event_add(struct perf_event *event, int mode)
diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.h b/drivers/hwtracing/coresight/coresight-etm-perf.h
index 4197df4faf5e..da7d9336a15c 100644
--- a/drivers/hwtracing/coresight/coresight-etm-perf.h
+++ b/drivers/hwtracing/coresight/coresight-etm-perf.h
@@ -7,6 +7,7 @@
 #ifndef _CORESIGHT_ETM_PERF_H
 #define _CORESIGHT_ETM_PERF_H
 
+#include <linux/percpu-defs.h>
 #include "coresight-priv.h"
 
 struct coresight_device;
@@ -42,14 +43,39 @@ struct etm_filters {
         bool                    ssstatus;
 };
 
+/**
+ * struct etm_event_data - Coresight specifics associated to an event
+ * @work:               Handle to free allocated memory outside IRQ context.
+ * @mask:               Hold the CPU(s) this event was set for.
+ * @snk_config:         The sink configuration.
+ * @path:               An array of path, each slot for one CPU.
+ */
+struct etm_event_data {
+        struct work_struct work;
+        cpumask_t mask;
+        void *snk_config;
+        struct list_head * __percpu *path;
+};
 
 #ifdef CONFIG_CORESIGHT
 int etm_perf_symlink(struct coresight_device *csdev, bool link);
+static inline void *etm_perf_sink_config(struct perf_output_handle *handle)
+{
+        struct etm_event_data *data = perf_get_aux(handle);
 
+        if (data)
+                return data->snk_config;
+        return NULL;
+}
 #else
 static inline int etm_perf_symlink(struct coresight_device *csdev, bool link)
 { return -EINVAL; }
 
+static inline void *etm_perf_sink_config(struct perf_output_handle *handle)
+{
+        return NULL;
+}
+
 #endif /* CONFIG_CORESIGHT */
 
 #endif
diff --git a/drivers/hwtracing/coresight/coresight-etm3x.c b/drivers/hwtracing/coresight/coresight-etm3x.c
index 7c74263c333d..fd5c4cca7db5 100644
--- a/drivers/hwtracing/coresight/coresight-etm3x.c
+++ b/drivers/hwtracing/coresight/coresight-etm3x.c
@@ -355,11 +355,10 @@ static int etm_parse_event_config(struct etm_drvdata *drvdata,
         return 0;
 }
 
-static void etm_enable_hw(void *info)
+static int etm_enable_hw(struct etm_drvdata *drvdata)
 {
-        int i;
+        int i, rc;
         u32 etmcr;
-        struct etm_drvdata *drvdata = info;
         struct etm_config *config = &drvdata->config;
 
         CS_UNLOCK(drvdata->base);
@@ -370,6 +369,9 @@ static void etm_enable_hw(void *info)
         etm_set_pwrup(drvdata);
         /* Make sure all registers are accessible */
         etm_os_unlock(drvdata);
+        rc = coresight_claim_device_unlocked(drvdata->base);
+        if (rc)
+                goto done;
 
         etm_set_prog(drvdata);
 
@@ -418,9 +420,29 @@ static void etm_enable_hw(void *info)
         etm_writel(drvdata, 0x0, ETMVMIDCVR);
 
         etm_clr_prog(drvdata);
+
+done:
+        if (rc)
+                etm_set_pwrdwn(drvdata);
         CS_LOCK(drvdata->base);
 
-        dev_dbg(drvdata->dev, "cpu: %d enable smp call done\n", drvdata->cpu);
+        dev_dbg(drvdata->dev, "cpu: %d enable smp call done: %d\n",
+                drvdata->cpu, rc);
+        return rc;
+}
+
+struct etm_enable_arg {
+        struct etm_drvdata *drvdata;
+        int rc;
+};
+
+static void etm_enable_hw_smp_call(void *info)
+{
+        struct etm_enable_arg *arg = info;
+
+        if (WARN_ON(!arg))
+                return;
+        arg->rc = etm_enable_hw(arg->drvdata);
 }
 
 static int etm_cpu_id(struct coresight_device *csdev)
@@ -475,14 +497,13 @@ static int etm_enable_perf(struct coresight_device *csdev,
         /* Configure the tracer based on the session's specifics */
         etm_parse_event_config(drvdata, event);
         /* And enable it */
-        etm_enable_hw(drvdata);
-
-        return 0;
+        return etm_enable_hw(drvdata);
 }
 
 static int etm_enable_sysfs(struct coresight_device *csdev)
 {
         struct etm_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+        struct etm_enable_arg arg = { 0 };
         int ret;
 
         spin_lock(&drvdata->spinlock);
@@ -492,20 +513,21 @@ static int etm_enable_sysfs(struct coresight_device *csdev)
          * hw configuration will take place on the local CPU during bring up.
          */
         if (cpu_online(drvdata->cpu)) {
+                arg.drvdata = drvdata;
                 ret = smp_call_function_single(drvdata->cpu,
-                                               etm_enable_hw, drvdata, 1);
-                if (ret)
-                        goto err;
+                                               etm_enable_hw_smp_call, &arg, 1);
+                if (!ret)
+                        ret = arg.rc;
+                if (!ret)
+                        drvdata->sticky_enable = true;
+        } else {
+                ret = -ENODEV;
         }
 
-        drvdata->sticky_enable = true;
         spin_unlock(&drvdata->spinlock);
 
-        dev_info(drvdata->dev, "ETM tracing enabled\n");
-        return 0;
-
-err:
-        spin_unlock(&drvdata->spinlock);
+        if (!ret)
+                dev_dbg(drvdata->dev, "ETM tracing enabled\n");
         return ret;
 }
 
@@ -555,6 +577,8 @@ static void etm_disable_hw(void *info)
         for (i = 0; i < drvdata->nr_cntr; i++)
                 config->cntr_val[i] = etm_readl(drvdata, ETMCNTVRn(i));
 
+        coresight_disclaim_device_unlocked(drvdata->base);
+
         etm_set_pwrdwn(drvdata);
         CS_LOCK(drvdata->base);
 
@@ -604,7 +628,7 @@ static void etm_disable_sysfs(struct coresight_device *csdev)
         spin_unlock(&drvdata->spinlock);
         cpus_read_unlock();
 
-        dev_info(drvdata->dev, "ETM tracing disabled\n");
+        dev_dbg(drvdata->dev, "ETM tracing disabled\n");
 }
 
 static void etm_disable(struct coresight_device *csdev,
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c
index 1d94ebec027b..53e2fb6e86f6 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x.c
@@ -28,6 +28,7 @@
 #include <linux/pm_runtime.h>
 #include <asm/sections.h>
 #include <asm/local.h>
+#include <asm/virt.h>
 
 #include "coresight-etm4x.h"
 #include "coresight-etm-perf.h"
@@ -77,16 +78,24 @@ static int etm4_trace_id(struct coresight_device *csdev)
         return drvdata->trcid;
 }
 
-static void etm4_enable_hw(void *info)
+struct etm4_enable_arg {
+        struct etmv4_drvdata *drvdata;
+        int rc;
+};
+
+static int etm4_enable_hw(struct etmv4_drvdata *drvdata)
 {
-        int i;
-        struct etmv4_drvdata *drvdata = info;
+        int i, rc;
         struct etmv4_config *config = &drvdata->config;
 
         CS_UNLOCK(drvdata->base);
 
         etm4_os_unlock(drvdata);
 
+        rc = coresight_claim_device_unlocked(drvdata->base);
+        if (rc)
+                goto done;
+
         /* Disable the trace unit before programming trace registers */
         writel_relaxed(0, drvdata->base + TRCPRGCTLR);
 
@@ -174,9 +183,21 @@ static void etm4_enable_hw(void *info)
                 dev_err(drvdata->dev,
                         "timeout while waiting for Idle Trace Status\n");
 
+done:
         CS_LOCK(drvdata->base);
 
-        dev_dbg(drvdata->dev, "cpu: %d enable smp call done\n", drvdata->cpu);
+        dev_dbg(drvdata->dev, "cpu: %d enable smp call done: %d\n",
+                drvdata->cpu, rc);
+        return rc;
+}
+
+static void etm4_enable_hw_smp_call(void *info)
+{
+        struct etm4_enable_arg *arg = info;
+
+        if (WARN_ON(!arg))
+                return;
+        arg->rc = etm4_enable_hw(arg->drvdata);
 }
 
 static int etm4_parse_event_config(struct etmv4_drvdata *drvdata,
@@ -242,7 +263,7 @@ static int etm4_enable_perf(struct coresight_device *csdev,
         if (ret)
                 goto out;
         /* And enable it */
-        etm4_enable_hw(drvdata);
+        ret = etm4_enable_hw(drvdata);
 
 out:
         return ret;
@@ -251,6 +272,7 @@ out:
 static int etm4_enable_sysfs(struct coresight_device *csdev)
 {
         struct etmv4_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+        struct etm4_enable_arg arg = { 0 };
         int ret;
 
         spin_lock(&drvdata->spinlock);
@@ -259,19 +281,17 @@ static int etm4_enable_sysfs(struct coresight_device *csdev)
          * Executing etm4_enable_hw on the cpu whose ETM is being enabled
          * ensures that register writes occur when cpu is powered.
          */
+        arg.drvdata = drvdata;
         ret = smp_call_function_single(drvdata->cpu,
-                                       etm4_enable_hw, drvdata, 1);
-        if (ret)
-                goto err;
-
-        drvdata->sticky_enable = true;
+                                       etm4_enable_hw_smp_call, &arg, 1);
+        if (!ret)
+                ret = arg.rc;
+        if (!ret)
+                drvdata->sticky_enable = true;
         spin_unlock(&drvdata->spinlock);
 
-        dev_info(drvdata->dev, "ETM tracing enabled\n");
-        return 0;
-
-err:
-        spin_unlock(&drvdata->spinlock);
+        if (!ret)
+                dev_dbg(drvdata->dev, "ETM tracing enabled\n");
         return ret;
 }
 
@@ -328,6 +348,8 @@ static void etm4_disable_hw(void *info)
         isb();
         writel_relaxed(control, drvdata->base + TRCPRGCTLR);
 
+        coresight_disclaim_device_unlocked(drvdata->base);
+
         CS_LOCK(drvdata->base);
 
         dev_dbg(drvdata->dev, "cpu: %d disable smp call done\n", drvdata->cpu);
@@ -380,7 +402,7 @@ static void etm4_disable_sysfs(struct coresight_device *csdev)
         spin_unlock(&drvdata->spinlock);
         cpus_read_unlock();
 
-        dev_info(drvdata->dev, "ETM tracing disabled\n");
+        dev_dbg(drvdata->dev, "ETM tracing disabled\n");
 }
 
 static void etm4_disable(struct coresight_device *csdev,
@@ -605,7 +627,7 @@ static void etm4_set_default_config(struct etmv4_config *config)
         config->vinst_ctrl |= BIT(0);
 }
 
-static u64 etm4_get_access_type(struct etmv4_config *config)
+static u64 etm4_get_ns_access_type(struct etmv4_config *config)
 {
         u64 access_type = 0;
 
@@ -616,17 +638,26 @@ static u64 etm4_get_access_type(struct etmv4_config *config)
          *   Bit[13] Exception level 1 - OS
          *   Bit[14] Exception level 2 - Hypervisor
          *   Bit[15] Never implemented
-         *
-         * Always stay away from hypervisor mode.
          */
-        access_type = ETM_EXLEVEL_NS_HYP;
-
-        if (config->mode & ETM_MODE_EXCL_KERN)
-                access_type |= ETM_EXLEVEL_NS_OS;
+        if (!is_kernel_in_hyp_mode()) {
+                /* Stay away from hypervisor mode for non-VHE */
+                access_type =  ETM_EXLEVEL_NS_HYP;
+                if (config->mode & ETM_MODE_EXCL_KERN)
+                        access_type |= ETM_EXLEVEL_NS_OS;
+        } else if (config->mode & ETM_MODE_EXCL_KERN) {
+                access_type = ETM_EXLEVEL_NS_HYP;
+        }
 
         if (config->mode & ETM_MODE_EXCL_USER)
                 access_type |= ETM_EXLEVEL_NS_APP;
 
+        return access_type;
+}
+
+static u64 etm4_get_access_type(struct etmv4_config *config)
+{
+        u64 access_type = etm4_get_ns_access_type(config);
+
         /*
          * EXLEVEL_S, bits[11:8], don't trace anything happening
          * in secure state.
@@ -880,20 +911,10 @@ void etm4_config_trace_mode(struct etmv4_config *config)
 
         addr_acc = config->addr_acc[ETM_DEFAULT_ADDR_COMP];
         /* clear default config */
-        addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS);
+        addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS |
+                      ETM_EXLEVEL_NS_HYP);
 
-        /*
-         * EXLEVEL_NS, bits[15:12]
-         * The Exception levels are:
-         *   Bit[12] Exception level 0 - Application
-         *   Bit[13] Exception level 1 - OS
-         *   Bit[14] Exception level 2 - Hypervisor
-         *   Bit[15] Never implemented
-         */
-        if (mode & ETM_MODE_EXCL_KERN)
-                addr_acc |= ETM_EXLEVEL_NS_OS;
-        else
-                addr_acc |= ETM_EXLEVEL_NS_APP;
+        addr_acc |= etm4_get_ns_access_type(config);
 
         config->addr_acc[ETM_DEFAULT_ADDR_COMP] = addr_acc;
         config->addr_acc[ETM_DEFAULT_ADDR_COMP + 1] = addr_acc;
diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c
index 448145a36675..927925151509 100644
--- a/drivers/hwtracing/coresight/coresight-funnel.c
+++ b/drivers/hwtracing/coresight/coresight-funnel.c
@@ -25,6 +25,7 @@
 #define FUNNEL_HOLDTIME_MASK    0xf00
 #define FUNNEL_HOLDTIME_SHFT    0x8
 #define FUNNEL_HOLDTIME         (0x7 << FUNNEL_HOLDTIME_SHFT)
+#define FUNNEL_ENSx_MASK        0xff
 
 /**
  * struct funnel_drvdata - specifics associated to a funnel component
@@ -42,31 +43,42 @@ struct funnel_drvdata {
         unsigned long           priority;
 };
 
-static void funnel_enable_hw(struct funnel_drvdata *drvdata, int port)
+static int funnel_enable_hw(struct funnel_drvdata *drvdata, int port)
 {
         u32 functl;
+        int rc = 0;
 
         CS_UNLOCK(drvdata->base);
 
         functl = readl_relaxed(drvdata->base + FUNNEL_FUNCTL);
+        /* Claim the device only when we enable the first slave */
+        if (!(functl & FUNNEL_ENSx_MASK)) {
+                rc = coresight_claim_device_unlocked(drvdata->base);
+                if (rc)
+                        goto done;
+        }
+
         functl &= ~FUNNEL_HOLDTIME_MASK;
         functl |= FUNNEL_HOLDTIME;
         functl |= (1 << port);
         writel_relaxed(functl, drvdata->base + FUNNEL_FUNCTL);
         writel_relaxed(drvdata->priority, drvdata->base + FUNNEL_PRICTL);
-
+done:
         CS_LOCK(drvdata->base);
+        return rc;
 }
 
 static int funnel_enable(struct coresight_device *csdev, int inport,
                          int outport)
 {
+        int rc;
         struct funnel_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        funnel_enable_hw(drvdata, inport);
+        rc = funnel_enable_hw(drvdata, inport);
 
-        dev_info(drvdata->dev, "FUNNEL inport %d enabled\n", inport);
-        return 0;
+        if (!rc)
+                dev_dbg(drvdata->dev, "FUNNEL inport %d enabled\n", inport);
+        return rc;
 }
 
 static void funnel_disable_hw(struct funnel_drvdata *drvdata, int inport)
@@ -79,6 +91,10 @@ static void funnel_disable_hw(struct funnel_drvdata *drvdata, int inport)
         functl &= ~(1 << inport);
         writel_relaxed(functl, drvdata->base + FUNNEL_FUNCTL);
 
+        /* Disclaim the device if none of the slaves are now active */
+        if (!(functl & FUNNEL_ENSx_MASK))
+                coresight_disclaim_device_unlocked(drvdata->base);
+
         CS_LOCK(drvdata->base);
 }
 
@@ -89,7 +105,7 @@ static void funnel_disable(struct coresight_device *csdev, int inport,
 
         funnel_disable_hw(drvdata, inport);
 
-        dev_info(drvdata->dev, "FUNNEL inport %d disabled\n", inport);
+        dev_dbg(drvdata->dev, "FUNNEL inport %d disabled\n", inport);
 }
 
 static const struct coresight_ops_link funnel_link_ops = {
diff --git a/drivers/hwtracing/coresight/coresight-priv.h b/drivers/hwtracing/coresight/coresight-priv.h
index 1a6cf3589866..579f34943bf1 100644
--- a/drivers/hwtracing/coresight/coresight-priv.h
+++ b/drivers/hwtracing/coresight/coresight-priv.h
@@ -25,6 +25,13 @@
 #define CORESIGHT_DEVID         0xfc8
 #define CORESIGHT_DEVTYPE       0xfcc
 
+
+/*
+ * Coresight device CLAIM protocol.
+ * See PSCI - ARM DEN 0022D, Section: 6.8.1 Debug and Trace save and restore.
+ */
+#define CORESIGHT_CLAIM_SELF_HOSTED     BIT(1)
+
 #define TIMEOUT_US              100
 #define BMVAL(val, lsb, msb)    ((val & GENMASK(msb, lsb)) >> lsb)
 
@@ -137,7 +144,7 @@ static inline void coresight_write_reg_pair(void __iomem *addr, u64 val,
 }
 
 void coresight_disable_path(struct list_head *path);
-int coresight_enable_path(struct list_head *path, u32 mode);
+int coresight_enable_path(struct list_head *path, u32 mode, void *sink_data);
 struct coresight_device *coresight_get_sink(struct list_head *path);
 struct coresight_device *coresight_get_enabled_sink(bool reset);
 struct list_head *coresight_build_path(struct coresight_device *csdev,
diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c
index 8d2eaaab6c2f..feac98315471 100644
--- a/drivers/hwtracing/coresight/coresight-replicator.c
+++ b/drivers/hwtracing/coresight/coresight-replicator.c
@@ -35,7 +35,7 @@ static int replicator_enable(struct coresight_device *csdev, int inport,
 {
         struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        dev_info(drvdata->dev, "REPLICATOR enabled\n");
+        dev_dbg(drvdata->dev, "REPLICATOR enabled\n");
         return 0;
 }
 
@@ -44,7 +44,7 @@ static void replicator_disable(struct coresight_device *csdev, int inport,
 {
         struct replicator_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
-        dev_info(drvdata->dev, "REPLICATOR disabled\n");
+        dev_dbg(drvdata->dev, "REPLICATOR disabled\n");
 }
 
 static const struct coresight_ops_link replicator_link_ops = {
diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
index c46c70aec1d5..35d6f9709274 100644
--- a/drivers/hwtracing/coresight/coresight-stm.c
+++ b/drivers/hwtracing/coresight/coresight-stm.c
@@ -211,7 +211,7 @@ static int stm_enable(struct coresight_device *csdev,
         stm_enable_hw(drvdata);
         spin_unlock(&drvdata->spinlock);
 
-        dev_info(drvdata->dev, "STM tracing enabled\n");
+        dev_dbg(drvdata->dev, "STM tracing enabled\n");
         return 0;
 }
 
@@ -274,7 +274,7 @@ static void stm_disable(struct coresight_device *csdev,
                 pm_runtime_put(drvdata->dev);
 
                 local_set(&drvdata->mode, CS_MODE_DISABLED);
-                dev_info(drvdata->dev, "STM tracing disabled\n");
+                dev_dbg(drvdata->dev, "STM tracing disabled\n");
         }
 }
 
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
index 0549249f4b39..53fc83b72a49 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -10,8 +10,12 @@
 #include <linux/slab.h>
 #include "coresight-priv.h"
 #include "coresight-tmc.h"
+#include "coresight-etm-perf.h"
 
-static void tmc_etb_enable_hw(struct tmc_drvdata *drvdata)
+static int tmc_set_etf_buffer(struct coresight_device *csdev,
+                              struct perf_output_handle *handle);
+
+static void __tmc_etb_enable_hw(struct tmc_drvdata *drvdata)
 {
         CS_UNLOCK(drvdata->base);
 
@@ -30,33 +34,41 @@ static void tmc_etb_enable_hw(struct tmc_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
+static int tmc_etb_enable_hw(struct tmc_drvdata *drvdata)
+{
+        int rc = coresight_claim_device(drvdata->base);
+
+        if (rc)
+                return rc;
+
+        __tmc_etb_enable_hw(drvdata);
+        return 0;
+}
+
 static void tmc_etb_dump_hw(struct tmc_drvdata *drvdata)
 {
         char *bufp;
         u32 read_data, lost;
-        int i;
 
         /* Check if the buffer wrapped around. */
         lost = readl_relaxed(drvdata->base + TMC_STS) & TMC_STS_FULL;
         bufp = drvdata->buf;
         drvdata->len = 0;
         while (1) {
-                for (i = 0; i < drvdata->memwidth; i++) {
-                        read_data = readl_relaxed(drvdata->base + TMC_RRD);
-                        if (read_data == 0xFFFFFFFF)
-                                goto done;
-                        memcpy(bufp, &read_data, 4);
-                        bufp += 4;
-                        drvdata->len += 4;
-                }
+                read_data = readl_relaxed(drvdata->base + TMC_RRD);
+                if (read_data == 0xFFFFFFFF)
+                        break;
+                memcpy(bufp, &read_data, 4);
+                bufp += 4;
+                drvdata->len += 4;
         }
-done:
+
         if (lost)
                 coresight_insert_barrier_packet(drvdata->buf);
         return;
 }
 
-static void tmc_etb_disable_hw(struct tmc_drvdata *drvdata)
+static void __tmc_etb_disable_hw(struct tmc_drvdata *drvdata)
 {
         CS_UNLOCK(drvdata->base);
 
@@ -72,7 +84,13 @@ static void tmc_etb_disable_hw(struct tmc_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
-static void tmc_etf_enable_hw(struct tmc_drvdata *drvdata)
+static void tmc_etb_disable_hw(struct tmc_drvdata *drvdata)
+{
+        coresight_disclaim_device(drvdata);
+        __tmc_etb_disable_hw(drvdata);
+}
+
+static void __tmc_etf_enable_hw(struct tmc_drvdata *drvdata)
 {
         CS_UNLOCK(drvdata->base);
 
@@ -88,13 +106,24 @@ static void tmc_etf_enable_hw(struct tmc_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
+static int tmc_etf_enable_hw(struct tmc_drvdata *drvdata)
+{
+        int rc = coresight_claim_device(drvdata->base);
+
+        if (rc)
+                return rc;
+
+        __tmc_etf_enable_hw(drvdata);
+        return 0;
+}
+
 static void tmc_etf_disable_hw(struct tmc_drvdata *drvdata)
 {
         CS_UNLOCK(drvdata->base);
 
         tmc_flush_and_stop(drvdata);
         tmc_disable_hw(drvdata);
-
+        coresight_disclaim_device_unlocked(drvdata->base);
         CS_LOCK(drvdata->base);
 }
 
@@ -170,8 +199,12 @@ static int tmc_enable_etf_sink_sysfs(struct coresight_device *csdev)
                 drvdata->buf = buf;
         }
 
-        drvdata->mode = CS_MODE_SYSFS;
-        tmc_etb_enable_hw(drvdata);
+        ret = tmc_etb_enable_hw(drvdata);
+        if (!ret)
+                drvdata->mode = CS_MODE_SYSFS;
+        else
+                /* Free up the buffer if we failed to enable */
+                used = false;
 out:
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
@@ -182,37 +215,40 @@ out:
         return ret;
 }
 
-static int tmc_enable_etf_sink_perf(struct coresight_device *csdev)
+static int tmc_enable_etf_sink_perf(struct coresight_device *csdev, void *data)
 {
         int ret = 0;
         unsigned long flags;
         struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+        struct perf_output_handle *handle = data;
 
         spin_lock_irqsave(&drvdata->spinlock, flags);
-        if (drvdata->reading) {
+        do {
                 ret = -EINVAL;
-                goto out;
-        }
-
-        /*
-         * In Perf mode there can be only one writer per sink.  There
-         * is also no need to continue if the ETB/ETR is already operated
-         * from sysFS.
-         */
-        if (drvdata->mode != CS_MODE_DISABLED) {
-                ret = -EINVAL;
-                goto out;
-        }
+                if (drvdata->reading)
+                        break;
+                /*
+                 * In Perf mode there can be only one writer per sink.  There
+                 * is also no need to continue if the ETB/ETF is already
+                 * operated from sysFS.
+                 */
+                if (drvdata->mode != CS_MODE_DISABLED)
+                        break;
 
-        drvdata->mode = CS_MODE_PERF;
-        tmc_etb_enable_hw(drvdata);
-out:
+                ret = tmc_set_etf_buffer(csdev, handle);
+                if (ret)
+                        break;
+                ret  = tmc_etb_enable_hw(drvdata);
+                if (!ret)
+                        drvdata->mode = CS_MODE_PERF;
+        } while (0);
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
         return ret;
 }
 
-static int tmc_enable_etf_sink(struct coresight_device *csdev, u32 mode)
+static int tmc_enable_etf_sink(struct coresight_device *csdev,
+                               u32 mode, void *data)
 {
         int ret;
         struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
@@ -222,7 +258,7 @@ static int tmc_enable_etf_sink(struct coresight_device *csdev, u32 mode)
                 ret = tmc_enable_etf_sink_sysfs(csdev);
                 break;
         case CS_MODE_PERF:
-                ret = tmc_enable_etf_sink_perf(csdev);
+                ret = tmc_enable_etf_sink_perf(csdev, data);
                 break;
         /* We shouldn't be here */
         default:
@@ -233,7 +269,7 @@ static int tmc_enable_etf_sink(struct coresight_device *csdev, u32 mode)
         if (ret)
                 return ret;
 
-        dev_info(drvdata->dev, "TMC-ETB/ETF enabled\n");
+        dev_dbg(drvdata->dev, "TMC-ETB/ETF enabled\n");
         return 0;
 }
 
@@ -256,12 +292,13 @@ static void tmc_disable_etf_sink(struct coresight_device *csdev)
 
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-        dev_info(drvdata->dev, "TMC-ETB/ETF disabled\n");
+        dev_dbg(drvdata->dev, "TMC-ETB/ETF disabled\n");
 }
 
 static int tmc_enable_etf_link(struct coresight_device *csdev,
                                int inport, int outport)
 {
+        int ret;
         unsigned long flags;
         struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
@@ -271,12 +308,14 @@ static int tmc_enable_etf_link(struct coresight_device *csdev,
                 return -EBUSY;
         }
 
-        tmc_etf_enable_hw(drvdata);
-        drvdata->mode = CS_MODE_SYSFS;
+        ret = tmc_etf_enable_hw(drvdata);
+        if (!ret)
+                drvdata->mode = CS_MODE_SYSFS;
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-        dev_info(drvdata->dev, "TMC-ETF enabled\n");
-        return 0;
+        if (!ret)
+                dev_dbg(drvdata->dev, "TMC-ETF enabled\n");
+        return ret;
 }
 
 static void tmc_disable_etf_link(struct coresight_device *csdev,
@@ -295,7 +334,7 @@ static void tmc_disable_etf_link(struct coresight_device *csdev,
         drvdata->mode = CS_MODE_DISABLED;
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-        dev_info(drvdata->dev, "TMC-ETF disabled\n");
+        dev_dbg(drvdata->dev, "TMC-ETF disabled\n");
 }
 
 static void *tmc_alloc_etf_buffer(struct coresight_device *csdev, int cpu,
@@ -328,12 +367,14 @@ static void tmc_free_etf_buffer(void *config)
 }
 
 static int tmc_set_etf_buffer(struct coresight_device *csdev,
-                              struct perf_output_handle *handle,
-                              void *sink_config)
+                              struct perf_output_handle *handle)
 {
         int ret = 0;
         unsigned long head;
-        struct cs_buffers *buf = sink_config;
+        struct cs_buffers *buf = etm_perf_sink_config(handle);
+
+        if (!buf)
+                return -EINVAL;
 
         /* wrap head around to the amount of space we have */
         head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1);
@@ -349,36 +390,7 @@ static int tmc_set_etf_buffer(struct coresight_device *csdev,
         return ret;
 }
 
-static unsigned long tmc_reset_etf_buffer(struct coresight_device *csdev,
-                                          struct perf_output_handle *handle,
-                                          void *sink_config)
-{
-        long size = 0;
-        struct cs_buffers *buf = sink_config;
-
-        if (buf) {
-                /*
-                 * In snapshot mode ->data_size holds the new address of the
-                 * ring buffer's head.  The size itself is the whole address
-                 * range since we want the latest information.
-                 */
-                if (buf->snapshot)
-                        handle->head = local_xchg(&buf->data_size,
-                                                  buf->nr_pages << PAGE_SHIFT);
-                /*
-                 * Tell the tracer PMU how much we got in this run and if
-                 * something went wrong along the way.  Nobody else can use
-                 * this cs_buffers instance until we are done.  As such
-                 * resetting parameters here and squaring off with the ring
-                 * buffer API in the tracer PMU is fine.
-                 */
-                size = local_xchg(&buf->data_size, 0);
-        }
-
-        return size;
-}
-
-static void tmc_update_etf_buffer(struct coresight_device *csdev,
+static unsigned long tmc_update_etf_buffer(struct coresight_device *csdev,
                                   struct perf_output_handle *handle,
                                   void *sink_config)
 {
@@ -387,17 +399,17 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev,
         const u32 *barrier;
         u32 *buf_ptr;
         u64 read_ptr, write_ptr;
-        u32 status, to_read;
-        unsigned long offset;
+        u32 status;
+        unsigned long offset, to_read;
         struct cs_buffers *buf = sink_config;
         struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
         if (!buf)
-                return;
+                return 0;
 
         /* This shouldn't happen */
         if (WARN_ON_ONCE(drvdata->mode != CS_MODE_PERF))
-                return;
+                return 0;
 
         CS_UNLOCK(drvdata->base);
 
@@ -438,10 +450,10 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev,
                 case TMC_MEM_INTF_WIDTH_32BITS:
                 case TMC_MEM_INTF_WIDTH_64BITS:
                 case TMC_MEM_INTF_WIDTH_128BITS:
-                        mask = GENMASK(31, 5);
+                        mask = GENMASK(31, 4);
                         break;
                 case TMC_MEM_INTF_WIDTH_256BITS:
-                        mask = GENMASK(31, 6);
+                        mask = GENMASK(31, 5);
                         break;
                 }
 
@@ -486,18 +498,14 @@ static void tmc_update_etf_buffer(struct coresight_device *csdev,
                 }
         }
 
-        /*
-         * In snapshot mode all we have to do is communicate to
-         * perf_aux_output_end() the address of the current head.  In full
-         * trace mode the same function expects a size to move rb->aux_head
-         * forward.
-         */
-        if (buf->snapshot)
-                local_set(&buf->data_size, (cur * PAGE_SIZE) + offset);
-        else
-                local_add(to_read, &buf->data_size);
-
+        /* In snapshot mode we have to update the head */
+        if (buf->snapshot) {
+                handle->head = (cur * PAGE_SIZE) + offset;
+                to_read = buf->nr_pages << PAGE_SHIFT;
+        }
         CS_LOCK(drvdata->base);
+
+        return to_read;
 }
 
 static const struct coresight_ops_sink tmc_etf_sink_ops = {
@@ -505,8 +513,6 @@ static const struct coresight_ops_sink tmc_etf_sink_ops = {
         .disable        = tmc_disable_etf_sink,
         .alloc_buffer   = tmc_alloc_etf_buffer,
         .free_buffer    = tmc_free_etf_buffer,
-        .set_buffer     = tmc_set_etf_buffer,
-        .reset_buffer   = tmc_reset_etf_buffer,
         .update_buffer  = tmc_update_etf_buffer,
 };
 
@@ -563,7 +569,7 @@ int tmc_read_prepare_etb(struct tmc_drvdata *drvdata)
 
         /* Disable the TMC if need be */
         if (drvdata->mode == CS_MODE_SYSFS)
-                tmc_etb_disable_hw(drvdata);
+                __tmc_etb_disable_hw(drvdata);
 
         drvdata->reading = true;
 out:
@@ -603,7 +609,7 @@ int tmc_read_unprepare_etb(struct tmc_drvdata *drvdata)
                  * can't be NULL.
                  */
                 memset(drvdata->buf, 0, drvdata->size);
-                tmc_etb_enable_hw(drvdata);
+                __tmc_etb_enable_hw(drvdata);
         } else {
                 /*
                  * The ETB/ETF is not tracing and the buffer was just read.
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
index 2eda5de304c2..f684283890d3 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -10,6 +10,7 @@
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include "coresight-catu.h"
+#include "coresight-etm-perf.h"
 #include "coresight-priv.h"
 #include "coresight-tmc.h"
 
@@ -21,6 +22,28 @@ struct etr_flat_buf {
 };
 
 /*
+ * etr_perf_buffer - Perf buffer used for ETR
+ * @etr_buf             - Actual buffer used by the ETR
+ * @snaphost            - Perf session mode
+ * @head                - handle->head at the beginning of the session.
+ * @nr_pages            - Number of pages in the ring buffer.
+ * @pages               - Array of Pages in the ring buffer.
+ */
+struct etr_perf_buffer {
+        struct etr_buf          *etr_buf;
+        bool                    snapshot;
+        unsigned long           head;
+        int                     nr_pages;
+        void                    **pages;
+};
+
+/* Convert the perf index to an offset within the ETR buffer */
+#define PERF_IDX2OFF(idx, buf)  ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+
+/* Lower limit for ETR hardware buffer */
+#define TMC_ETR_PERF_MIN_BUF_SIZE       SZ_1M
+
+/*
  * The TMC ETR SG has a page size of 4K. The SG table contains pointers
  * to 4KB buffers. However, the OS may use a PAGE_SIZE different from
  * 4K (i.e, 16KB or 64KB). This implies that a single OS page could
@@ -536,7 +559,7 @@ tmc_init_etr_sg_table(struct device *dev, int node,
         sg_table = tmc_alloc_sg_table(dev, node, nr_tpages, nr_dpages, pages);
         if (IS_ERR(sg_table)) {
                 kfree(etr_table);
-                return ERR_PTR(PTR_ERR(sg_table));
+                return ERR_CAST(sg_table);
         }
 
         etr_table->sg_table = sg_table;
@@ -728,12 +751,14 @@ tmc_etr_get_catu_device(struct tmc_drvdata *drvdata)
         return NULL;
 }
 
-static inline void tmc_etr_enable_catu(struct tmc_drvdata *drvdata)
+static inline int tmc_etr_enable_catu(struct tmc_drvdata *drvdata,
+                                      struct etr_buf *etr_buf)
 {
         struct coresight_device *catu = tmc_etr_get_catu_device(drvdata);
 
         if (catu && helper_ops(catu)->enable)
-                helper_ops(catu)->enable(catu, drvdata->etr_buf);
+                return helper_ops(catu)->enable(catu, etr_buf);
+        return 0;
 }
 
 static inline void tmc_etr_disable_catu(struct tmc_drvdata *drvdata)
@@ -895,17 +920,11 @@ static void tmc_sync_etr_buf(struct tmc_drvdata *drvdata)
                 tmc_etr_buf_insert_barrier_packet(etr_buf, etr_buf->offset);
 }
 
-static void tmc_etr_enable_hw(struct tmc_drvdata *drvdata)
+static void __tmc_etr_enable_hw(struct tmc_drvdata *drvdata)
 {
         u32 axictl, sts;
         struct etr_buf *etr_buf = drvdata->etr_buf;
 
-        /*
-         * If this ETR is connected to a CATU, enable it before we turn
-         * this on
-         */
-        tmc_etr_enable_catu(drvdata);
-
         CS_UNLOCK(drvdata->base);
 
         /* Wait for TMCSReady bit to be set */
@@ -924,11 +943,8 @@ static void tmc_etr_enable_hw(struct tmc_drvdata *drvdata)
                 axictl |= TMC_AXICTL_ARCACHE_OS;
         }
 
-        if (etr_buf->mode == ETR_MODE_ETR_SG) {
-                if (WARN_ON(!tmc_etr_has_cap(drvdata, TMC_ETR_SG)))
-                        return;
+        if (etr_buf->mode == ETR_MODE_ETR_SG)
                 axictl |= TMC_AXICTL_SCT_GAT_MODE;
-        }
 
         writel_relaxed(axictl, drvdata->base + TMC_AXICTL);
         tmc_write_dba(drvdata, etr_buf->hwaddr);
@@ -954,19 +970,54 @@ static void tmc_etr_enable_hw(struct tmc_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
+static int tmc_etr_enable_hw(struct tmc_drvdata *drvdata,
+                             struct etr_buf *etr_buf)
+{
+        int rc;
+
+        /* Callers should provide an appropriate buffer for use */
+        if (WARN_ON(!etr_buf))
+                return -EINVAL;
+
+        if ((etr_buf->mode == ETR_MODE_ETR_SG) &&
+            WARN_ON(!tmc_etr_has_cap(drvdata, TMC_ETR_SG)))
+                return -EINVAL;
+
+        if (WARN_ON(drvdata->etr_buf))
+                return -EBUSY;
+
+        /*
+         * If this ETR is connected to a CATU, enable it before we turn
+         * this on.
+         */
+        rc = tmc_etr_enable_catu(drvdata, etr_buf);
+        if (rc)
+                return rc;
+        rc = coresight_claim_device(drvdata->base);
+        if (!rc) {
+                drvdata->etr_buf = etr_buf;
+                __tmc_etr_enable_hw(drvdata);
+        }
+
+        return rc;
+}
+
 /*
  * Return the available trace data in the buffer (starts at etr_buf->offset,
  * limited by etr_buf->len) from @pos, with a maximum limit of @len,
  * also updating the @bufpp on where to find it. Since the trace data
  * starts at anywhere in the buffer, depending on the RRP, we adjust the
  * @len returned to handle buffer wrapping around.
+ *
+ * We are protected here by drvdata->reading != 0, which ensures the
+ * sysfs_buf stays alive.
  */
 ssize_t tmc_etr_get_sysfs_trace(struct tmc_drvdata *drvdata,
                                 loff_t pos, size_t len, char **bufpp)
 {
         s64 offset;
         ssize_t actual = len;
-        struct etr_buf *etr_buf = drvdata->etr_buf;
+        struct etr_buf *etr_buf = drvdata->sysfs_buf;
 
         if (pos + actual > etr_buf->len)
                 actual = etr_buf->len - pos;
@@ -996,10 +1047,17 @@ tmc_etr_free_sysfs_buf(struct etr_buf *buf)
 
 static void tmc_etr_sync_sysfs_buf(struct tmc_drvdata *drvdata)
 {
-        tmc_sync_etr_buf(drvdata);
+        struct etr_buf *etr_buf = drvdata->etr_buf;
+
+        if (WARN_ON(drvdata->sysfs_buf != etr_buf)) {
+                tmc_etr_free_sysfs_buf(drvdata->sysfs_buf);
+                drvdata->sysfs_buf = NULL;
+        } else {
+                tmc_sync_etr_buf(drvdata);
+        }
 }
 
-static void tmc_etr_disable_hw(struct tmc_drvdata *drvdata)
+static void __tmc_etr_disable_hw(struct tmc_drvdata *drvdata)
 {
         CS_UNLOCK(drvdata->base);
 
@@ -1015,8 +1073,16 @@ static void tmc_etr_disable_hw(struct tmc_drvdata *drvdata)
 
         CS_LOCK(drvdata->base);
 
+}
+
+static void tmc_etr_disable_hw(struct tmc_drvdata *drvdata)
+{
+        __tmc_etr_disable_hw(drvdata);
         /* Disable CATU device if this ETR is connected to one */
         tmc_etr_disable_catu(drvdata);
+        coresight_disclaim_device(drvdata->base);
+        /* Reset the ETR buf used by hardware */
+        drvdata->etr_buf = NULL;
 }
 
 static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
@@ -1024,7 +1090,7 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
         int ret = 0;
         unsigned long flags;
         struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
-        struct etr_buf *new_buf = NULL, *free_buf = NULL;
+        struct etr_buf *sysfs_buf = NULL, *new_buf = NULL, *free_buf = NULL;
 
         /*
          * If we are enabling the ETR from disabled state, we need to make
@@ -1035,7 +1101,8 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
          * with the lock released.
          */
         spin_lock_irqsave(&drvdata->spinlock, flags);
-        if (!drvdata->etr_buf || (drvdata->etr_buf->size != drvdata->size)) {
+        sysfs_buf = READ_ONCE(drvdata->sysfs_buf);
+        if (!sysfs_buf || (sysfs_buf->size != drvdata->size)) {
                 spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
                 /* Allocate memory with the locks released */
@@ -1064,14 +1131,15 @@ static int tmc_enable_etr_sink_sysfs(struct coresight_device *csdev)
          * If we don't have a buffer or it doesn't match the requested size,
          * use the buffer allocated above. Otherwise reuse the existing buffer.
          */
-        if (!drvdata->etr_buf ||
-            (new_buf && drvdata->etr_buf->size != new_buf->size)) {
-                free_buf = drvdata->etr_buf;
-                drvdata->etr_buf = new_buf;
+        sysfs_buf = READ_ONCE(drvdata->sysfs_buf);
+        if (!sysfs_buf || (new_buf && sysfs_buf->size != new_buf->size)) {
+                free_buf = sysfs_buf;
+                drvdata->sysfs_buf = new_buf;
         }
 
-        drvdata->mode = CS_MODE_SYSFS;
-        tmc_etr_enable_hw(drvdata);
+        ret = tmc_etr_enable_hw(drvdata, drvdata->sysfs_buf);
+        if (!ret)
+                drvdata->mode = CS_MODE_SYSFS;
 out:
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
@@ -1080,24 +1148,244 @@ out:
                 tmc_etr_free_sysfs_buf(free_buf);
 
         if (!ret)
-                dev_info(drvdata->dev, "TMC-ETR enabled\n");
+                dev_dbg(drvdata->dev, "TMC-ETR enabled\n");
 
         return ret;
 }
 
-static int tmc_enable_etr_sink_perf(struct coresight_device *csdev)
+/*
+ * tmc_etr_setup_perf_buf: Allocate ETR buffer for use by perf.
+ * The size of the hardware buffer is dependent on the size configured
+ * via sysfs and the perf ring buffer size. We prefer to allocate the
+ * largest possible size, scaling down the size by half until it
+ * reaches a minimum limit (1M), beyond which we give up.
+ */
+static struct etr_perf_buffer *
+tmc_etr_setup_perf_buf(struct tmc_drvdata *drvdata, int node, int nr_pages,
+                       void **pages, bool snapshot)
 {
-        /* We don't support perf mode yet ! */
-        return -EINVAL;
+        struct etr_buf *etr_buf;
+        struct etr_perf_buffer *etr_perf;
+        unsigned long size;
+
+        etr_perf = kzalloc_node(sizeof(*etr_perf), GFP_KERNEL, node);
+        if (!etr_perf)
+                return ERR_PTR(-ENOMEM);
+
+        /*
+         * Try to match the perf ring buffer size if it is larger
+         * than the size requested via sysfs.
+         */
+        if ((nr_pages << PAGE_SHIFT) > drvdata->size) {
+                etr_buf = tmc_alloc_etr_buf(drvdata, (nr_pages << PAGE_SHIFT),
+                                            0, node, NULL);
+                if (!IS_ERR(etr_buf))
+                        goto done;
+        }
+
+        /*
+         * Else switch to configured size for this ETR
+         * and scale down until we hit the minimum limit.
+         */
+        size = drvdata->size;
+        do {
+                etr_buf = tmc_alloc_etr_buf(drvdata, size, 0, node, NULL);
+                if (!IS_ERR(etr_buf))
+                        goto done;
+                size /= 2;
+        } while (size >= TMC_ETR_PERF_MIN_BUF_SIZE);
+
+        kfree(etr_perf);
+        return ERR_PTR(-ENOMEM);
+
+done:
+        etr_perf->etr_buf = etr_buf;
+        return etr_perf;
 }
 
-static int tmc_enable_etr_sink(struct coresight_device *csdev, u32 mode)
+
+static void *tmc_alloc_etr_buffer(struct coresight_device *csdev,
+                                  int cpu, void **pages, int nr_pages,
+                                  bool snapshot)
+{
+        struct etr_perf_buffer *etr_perf;
+        struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+
+        if (cpu == -1)
+                cpu = smp_processor_id();
+
+        etr_perf = tmc_etr_setup_perf_buf(drvdata, cpu_to_node(cpu),
+                                          nr_pages, pages, snapshot);
+        if (IS_ERR(etr_perf)) {
+                dev_dbg(drvdata->dev, "Unable to allocate ETR buffer\n");
+                return NULL;
+        }
+
+        etr_perf->snapshot = snapshot;
+        etr_perf->nr_pages = nr_pages;
+        etr_perf->pages = pages;
+
+        return etr_perf;
+}
+
+static void tmc_free_etr_buffer(void *config)
+{
+        struct etr_perf_buffer *etr_perf = config;
+
+        if (etr_perf->etr_buf)
+                tmc_free_etr_buf(etr_perf->etr_buf);
+        kfree(etr_perf);
+}
+
+/*
+ * tmc_etr_sync_perf_buffer: Copy the actual trace data from the hardware
+ * buffer to the perf ring buffer.
+ */
+static void tmc_etr_sync_perf_buffer(struct etr_perf_buffer *etr_perf)
+{
+        long bytes, to_copy;
+        long pg_idx, pg_offset, src_offset;
+        unsigned long head = etr_perf->head;
+        char **dst_pages, *src_buf;
+        struct etr_buf *etr_buf = etr_perf->etr_buf;
+
+        head = etr_perf->head;
+        pg_idx = head >> PAGE_SHIFT;
+        pg_offset = head & (PAGE_SIZE - 1);
+        dst_pages = (char **)etr_perf->pages;
+        src_offset = etr_buf->offset;
+        to_copy = etr_buf->len;
+
+        while (to_copy > 0) {
+                /*
+                 * In one iteration, we can copy minimum of :
+                 *  1) what is available in the source buffer,
+                 *  2) what is available in the source buffer, before it
+                 *     wraps around.
+                 *  3) what is available in the destination page.
+                 * in one iteration.
+                 */
+                bytes = tmc_etr_buf_get_data(etr_buf, src_offset, to_copy,
+                                             &src_buf);
+                if (WARN_ON_ONCE(bytes <= 0))
+                        break;
+                bytes = min(bytes, (long)(PAGE_SIZE - pg_offset));
+
+                memcpy(dst_pages[pg_idx] + pg_offset, src_buf, bytes);
+
+                to_copy -= bytes;
+
+                /* Move destination pointers */
+                pg_offset += bytes;
+                if (pg_offset == PAGE_SIZE) {
+                        pg_offset = 0;
+                        if (++pg_idx == etr_perf->nr_pages)
+                                pg_idx = 0;
+                }
+
+                /* Move source pointers */
+                src_offset += bytes;
+                if (src_offset >= etr_buf->size)
+                        src_offset -= etr_buf->size;
+        }
+}
+
+/*
+ * tmc_update_etr_buffer : Update the perf ring buffer with the
+ * available trace data. We use software double buffering at the moment.
+ *
+ * TODO: Add support for reusing the perf ring buffer.
+ */
+static unsigned long
+tmc_update_etr_buffer(struct coresight_device *csdev,
+                      struct perf_output_handle *handle,
+                      void *config)
+{
+        bool lost = false;
+        unsigned long flags, size = 0;
+        struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+        struct etr_perf_buffer *etr_perf = config;
+        struct etr_buf *etr_buf = etr_perf->etr_buf;
+
+        spin_lock_irqsave(&drvdata->spinlock, flags);
+        if (WARN_ON(drvdata->perf_data != etr_perf)) {
+                lost = true;
+                spin_unlock_irqrestore(&drvdata->spinlock, flags);
+                goto out;
+        }
+
+        CS_UNLOCK(drvdata->base);
+
+        tmc_flush_and_stop(drvdata);
+        tmc_sync_etr_buf(drvdata);
+
+        CS_LOCK(drvdata->base);
+        /* Reset perf specific data */
+        drvdata->perf_data = NULL;
+        spin_unlock_irqrestore(&drvdata->spinlock, flags);
+
+        size = etr_buf->len;
+        tmc_etr_sync_perf_buffer(etr_perf);
+
+        /*
+         * Update handle->head in snapshot mode. Also update the size to the
+         * hardware buffer size if there was an overflow.
+         */
+        if (etr_perf->snapshot) {
+                handle->head += size;
+                if (etr_buf->full)
+                        size = etr_buf->size;
+        }
+
+        lost |= etr_buf->full;
+out:
+        if (lost)
+                perf_aux_output_flag(handle, PERF_AUX_FLAG_TRUNCATED);
+        return size;
+}
+
+static int tmc_enable_etr_sink_perf(struct coresight_device *csdev, void *data)
+{
+        int rc = 0;
+        unsigned long flags;
+        struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
+        struct perf_output_handle *handle = data;
+        struct etr_perf_buffer *etr_perf = etm_perf_sink_config(handle);
+
+        spin_lock_irqsave(&drvdata->spinlock, flags);
+        /*
+         * There can be only one writer per sink in perf mode. If the sink
+         * is already open in SYSFS mode, we can't use it.
+         */
+        if (drvdata->mode != CS_MODE_DISABLED || WARN_ON(drvdata->perf_data)) {
+                rc = -EBUSY;
+                goto unlock_out;
+        }
+
+        if (WARN_ON(!etr_perf || !etr_perf->etr_buf)) {
+                rc = -EINVAL;
+                goto unlock_out;
+        }
+
+        etr_perf->head = PERF_IDX2OFF(handle->head, etr_perf);
+        drvdata->perf_data = etr_perf;
+        rc = tmc_etr_enable_hw(drvdata, etr_perf->etr_buf);
+        if (!rc)
+                drvdata->mode = CS_MODE_PERF;
+
+unlock_out:
+        spin_unlock_irqrestore(&drvdata->spinlock, flags);
+        return rc;
+}
+
+static int tmc_enable_etr_sink(struct coresight_device *csdev,
+                               u32 mode, void *data)
 {
         switch (mode) {
         case CS_MODE_SYSFS:
                 return tmc_enable_etr_sink_sysfs(csdev);
         case CS_MODE_PERF:
-                return tmc_enable_etr_sink_perf(csdev);
+                return tmc_enable_etr_sink_perf(csdev, data);
         }
 
         /* We shouldn't be here */
@@ -1123,12 +1411,15 @@ static void tmc_disable_etr_sink(struct coresight_device *csdev)
 
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
-        dev_info(drvdata->dev, "TMC-ETR disabled\n");
+        dev_dbg(drvdata->dev, "TMC-ETR disabled\n");
 }
 
 static const struct coresight_ops_sink tmc_etr_sink_ops = {
         .enable         = tmc_enable_etr_sink,
         .disable        = tmc_disable_etr_sink,
+        .alloc_buffer   = tmc_alloc_etr_buffer,
+        .update_buffer  = tmc_update_etr_buffer,
+        .free_buffer    = tmc_free_etr_buffer,
 };
 
 const struct coresight_ops tmc_etr_cs_ops = {
@@ -1150,21 +1441,19 @@ int tmc_read_prepare_etr(struct tmc_drvdata *drvdata)
                 goto out;
         }
 
-        /* Don't interfere if operated from Perf */
-        if (drvdata->mode == CS_MODE_PERF) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        /* If drvdata::etr_buf is NULL the trace data has been read already */
-        if (drvdata->etr_buf == NULL) {
+        /*
+         * We can safely allow reads even if the ETR is operating in PERF mode,
+         * since the sysfs session is captured in mode specific data.
+         * If drvdata::sysfs_data is NULL the trace data has been read already.
+         */
+        if (!drvdata->sysfs_buf) {
                 ret = -EINVAL;
                 goto out;
         }
 
-        /* Disable the TMC if need be */
+        /* Disable the TMC if we are trying to read from a running session. */
         if (drvdata->mode == CS_MODE_SYSFS)
-                tmc_etr_disable_hw(drvdata);
+                __tmc_etr_disable_hw(drvdata);
 
         drvdata->reading = true;
 out:
@@ -1176,7 +1465,7 @@ out:
 int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata)
 {
         unsigned long flags;
-        struct etr_buf *etr_buf = NULL;
+        struct etr_buf *sysfs_buf = NULL;
 
         /* config types are set a boot time and never change */
         if (WARN_ON_ONCE(drvdata->config_type != TMC_CONFIG_TYPE_ETR))
@@ -1191,22 +1480,22 @@ int tmc_read_unprepare_etr(struct tmc_drvdata *drvdata)
                  * buffer. Since the tracer is still enabled drvdata::buf can't
                  * be NULL.
                  */
-                tmc_etr_enable_hw(drvdata);
+                __tmc_etr_enable_hw(drvdata);
         } else {
                 /*
                  * The ETR is not tracing and the buffer was just read.
                  * As such prepare to free the trace buffer.
                  */
-                etr_buf =  drvdata->etr_buf;
-                drvdata->etr_buf = NULL;
+                sysfs_buf = drvdata->sysfs_buf;
+                drvdata->sysfs_buf = NULL;
         }
 
         drvdata->reading = false;
         spin_unlock_irqrestore(&drvdata->spinlock, flags);
 
         /* Free allocated memory out side of the spinlock */
-        if (etr_buf)
-                tmc_free_etr_buf(etr_buf);
+        if (sysfs_buf)
+                tmc_etr_free_sysfs_buf(sysfs_buf);
 
         return 0;
 }
diff --git a/drivers/hwtracing/coresight/coresight-tmc.c b/drivers/hwtracing/coresight/coresight-tmc.c
index 1b817ec1192c..ea249f0bcd73 100644
--- a/drivers/hwtracing/coresight/coresight-tmc.c
+++ b/drivers/hwtracing/coresight/coresight-tmc.c
@@ -81,7 +81,7 @@ static int tmc_read_prepare(struct tmc_drvdata *drvdata)
         }
 
         if (!ret)
-                dev_info(drvdata->dev, "TMC read start\n");
+                dev_dbg(drvdata->dev, "TMC read start\n");
 
         return ret;
 }
@@ -103,7 +103,7 @@ static int tmc_read_unprepare(struct tmc_drvdata *drvdata)
         }
 
         if (!ret)
-                dev_info(drvdata->dev, "TMC read end\n");
+                dev_dbg(drvdata->dev, "TMC read end\n");
 
         return ret;
 }
diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
index 7027bd60c4cc..487c53701e9c 100644
--- a/drivers/hwtracing/coresight/coresight-tmc.h
+++ b/drivers/hwtracing/coresight/coresight-tmc.h
@@ -170,6 +170,8 @@ struct etr_buf {
  * @trigger_cntr: amount of words to store after a trigger.
  * @etr_caps:   Bitmask of capabilities of the TMC ETR, inferred from the
  *              device configuration register (DEVID)
+ * @perf_data:  PERF buffer for ETR.
+ * @sysfs_data: SYSFS buffer for ETR.
  */
 struct tmc_drvdata {
         void __iomem            *base;
@@ -189,6 +191,8 @@ struct tmc_drvdata {
         enum tmc_mem_intf_width memwidth;
         u32                     trigger_cntr;
         u32                     etr_caps;
+        struct etr_buf          *sysfs_buf;
+        void                    *perf_data;
 };
 
 struct etr_buf_operations {
diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c
index 459ef930d98c..b2f72a1fa402 100644
--- a/drivers/hwtracing/coresight/coresight-tpiu.c
+++ b/drivers/hwtracing/coresight/coresight-tpiu.c
@@ -68,13 +68,13 @@ static void tpiu_enable_hw(struct tpiu_drvdata *drvdata)
         CS_LOCK(drvdata->base);
 }
 
-static int tpiu_enable(struct coresight_device *csdev, u32 mode)
+static int tpiu_enable(struct coresight_device *csdev, u32 mode, void *__unused)
 {
         struct tpiu_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
 
         tpiu_enable_hw(drvdata);
 
-        dev_info(drvdata->dev, "TPIU enabled\n");
+        dev_dbg(drvdata->dev, "TPIU enabled\n");
         return 0;
 }
 
@@ -100,7 +100,7 @@ static void tpiu_disable(struct coresight_device *csdev)
 
         tpiu_disable_hw(drvdata);
 
-        dev_info(drvdata->dev, "TPIU disabled\n");
+        dev_dbg(drvdata->dev, "TPIU disabled\n");
 }
 
 static const struct coresight_ops_sink tpiu_sink_ops = {
diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c
index 3e07fd335f8c..2b0df1a0a8df 100644
--- a/drivers/hwtracing/coresight/coresight.c
+++ b/drivers/hwtracing/coresight/coresight.c
@@ -128,16 +128,105 @@ static int coresight_find_link_outport(struct coresight_device *csdev,
         return -ENODEV;
 }
 
-static int coresight_enable_sink(struct coresight_device *csdev, u32 mode)
+static inline u32 coresight_read_claim_tags(void __iomem *base)
+{
+        return readl_relaxed(base + CORESIGHT_CLAIMCLR);
+}
+
+static inline bool coresight_is_claimed_self_hosted(void __iomem *base)
+{
+        return coresight_read_claim_tags(base) == CORESIGHT_CLAIM_SELF_HOSTED;
+}
+
+static inline bool coresight_is_claimed_any(void __iomem *base)
+{
+        return coresight_read_claim_tags(base) != 0;
+}
+
+static inline void coresight_set_claim_tags(void __iomem *base)
+{
+        writel_relaxed(CORESIGHT_CLAIM_SELF_HOSTED, base + CORESIGHT_CLAIMSET);
+        isb();
+}
+
+static inline void coresight_clear_claim_tags(void __iomem *base)
+{
+        writel_relaxed(CORESIGHT_CLAIM_SELF_HOSTED, base + CORESIGHT_CLAIMCLR);
+        isb();
+}
+
+/*
+ * coresight_claim_device_unlocked : Claim the device for self-hosted usage
+ * to prevent an external tool from touching this device. As per PSCI
+ * standards, section "Preserving the execution context" => "Debug and Trace
+ * save and Restore", DBGCLAIM[1] is reserved for Self-hosted debug/trace and
+ * DBGCLAIM[0] is reserved for external tools.
+ *
+ * Called with CS_UNLOCKed for the component.
+ * Returns : 0 on success
+ */
+int coresight_claim_device_unlocked(void __iomem *base)
+{
+        if (coresight_is_claimed_any(base))
+                return -EBUSY;
+
+        coresight_set_claim_tags(base);
+        if (coresight_is_claimed_self_hosted(base))
+                return 0;
+        /* There was a race setting the tags, clean up and fail */
+        coresight_clear_claim_tags(base);
+        return -EBUSY;
+}
+
+int coresight_claim_device(void __iomem *base)
+{
+        int rc;
+
+        CS_UNLOCK(base);
+        rc = coresight_claim_device_unlocked(base);
+        CS_LOCK(base);
+
+        return rc;
+}
+
+/*
+ * coresight_disclaim_device_unlocked : Clear the claim tags for the device.
+ * Called with CS_UNLOCKed for the component.
+ */
+void coresight_disclaim_device_unlocked(void __iomem *base)
+{
+
+        if (coresight_is_claimed_self_hosted(base))
+                coresight_clear_claim_tags(base);
+        else
+                /*
+                 * The external agent may have not honoured our claim
+                 * and has manipulated it. Or something else has seriously
+                 * gone wrong in our driver.
+                 */
+                WARN_ON_ONCE(1);
+}
+
+void coresight_disclaim_device(void __iomem *base)
+{
+        CS_UNLOCK(base);
+        coresight_disclaim_device_unlocked(base);
+        CS_LOCK(base);
+}
+
+static int coresight_enable_sink(struct coresight_device *csdev,
+                                 u32 mode, void *data)
 {
         int ret;
 
-        if (!csdev->enable) {
-                if (sink_ops(csdev)->enable) {
-                        ret = sink_ops(csdev)->enable(csdev, mode);
-                        if (ret)
-                                return ret;
-                }
+        /*
+         * We need to make sure the "new" session is compatible with the
+         * existing "mode" of operation.
+         */
+        if (sink_ops(csdev)->enable) {
+                ret = sink_ops(csdev)->enable(csdev, mode, data);
+                if (ret)
+                        return ret;
                 csdev->enable = true;
         }
 
@@ -184,8 +273,10 @@ static int coresight_enable_link(struct coresight_device *csdev,
         if (atomic_inc_return(&csdev->refcnt[refport]) == 1) {
                 if (link_ops(csdev)->enable) {
                         ret = link_ops(csdev)->enable(csdev, inport, outport);
-                        if (ret)
+                        if (ret) {
+                                atomic_dec(&csdev->refcnt[refport]);
                                 return ret;
+                        }
                 }
         }
 
@@ -274,13 +365,21 @@ static bool coresight_disable_source(struct coresight_device *csdev)
         return !csdev->enable;
 }
 
-void coresight_disable_path(struct list_head *path)
+/*
+ * coresight_disable_path_from : Disable components in the given path beyond
+ * @nd in the list. If @nd is NULL, all the components, except the SOURCE are
+ * disabled.
+ */
+static void coresight_disable_path_from(struct list_head *path,
+                                        struct coresight_node *nd)
 {
         u32 type;
-        struct coresight_node *nd;
         struct coresight_device *csdev, *parent, *child;
 
-        list_for_each_entry(nd, path, link) {
+        if (!nd)
+                nd = list_first_entry(path, struct coresight_node, link);
+
+        list_for_each_entry_continue(nd, path, link) {
                 csdev = nd->csdev;
                 type = csdev->type;
 
@@ -300,7 +399,12 @@ void coresight_disable_path(struct list_head *path)
                         coresight_disable_sink(csdev);
                         break;
                 case CORESIGHT_DEV_TYPE_SOURCE:
-                        /* sources are disabled from either sysFS or Perf */
+                        /*
+                         * We skip the first node in the path assuming that it
+                         * is the source. So we don't expect a source device in
+                         * the middle of a path.
+                         */
+                        WARN_ON(1);
                         break;
                 case CORESIGHT_DEV_TYPE_LINK:
                         parent = list_prev_entry(nd, link)->csdev;
@@ -313,7 +417,12 @@ void coresight_disable_path(struct list_head *path)
         }
 }
 
-int coresight_enable_path(struct list_head *path, u32 mode)
+void coresight_disable_path(struct list_head *path)
+{
+        coresight_disable_path_from(path, NULL);
+}
+
+int coresight_enable_path(struct list_head *path, u32 mode, void *sink_data)
 {
 
         int ret = 0;
@@ -338,9 +447,15 @@ int coresight_enable_path(struct list_head *path, u32 mode)
 
                 switch (type) {
                 case CORESIGHT_DEV_TYPE_SINK:
-                        ret = coresight_enable_sink(csdev, mode);
+                        ret = coresight_enable_sink(csdev, mode, sink_data);
+                        /*
+                         * Sink is the first component turned on. If we
+                         * failed to enable the sink, there are no components
+                         * that need disabling. Disabling the path here
+                         * would mean we could disrupt an existing session.
+                         */
                         if (ret)
-                                goto err;
+                                goto out;
                         break;
                 case CORESIGHT_DEV_TYPE_SOURCE:
                         /* sources are enabled from either sysFS or Perf */
@@ -360,7 +475,7 @@ int coresight_enable_path(struct list_head *path, u32 mode)
 out:
         return ret;
 err:
-        coresight_disable_path(path);
+        coresight_disable_path_from(path, nd);
         goto out;
 }
 
@@ -635,7 +750,7 @@ int coresight_enable(struct coresight_device *csdev)
                 goto out;
         }
 
-        ret = coresight_enable_path(path, CS_MODE_SYSFS);
+        ret = coresight_enable_path(path, CS_MODE_SYSFS, NULL);
         if (ret)
                 goto err_path;
 
@@ -995,18 +1110,16 @@ postcore_initcall(coresight_init);
 
 struct coresight_device *coresight_register(struct coresight_desc *desc)
 {
-        int i;
         int ret;
         int link_subtype;
         int nr_refcnts = 1;
         atomic_t *refcnts = NULL;
         struct coresight_device *csdev;
-        struct coresight_connection *conns = NULL;
 
         csdev = kzalloc(sizeof(*csdev), GFP_KERNEL);
         if (!csdev) {
                 ret = -ENOMEM;
-                goto err_kzalloc_csdev;
+                goto err_out;
         }
 
         if (desc->type == CORESIGHT_DEV_TYPE_LINK ||
@@ -1022,7 +1135,7 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
         refcnts = kcalloc(nr_refcnts, sizeof(*refcnts), GFP_KERNEL);
         if (!refcnts) {
                 ret = -ENOMEM;
-                goto err_kzalloc_refcnts;
+                goto err_free_csdev;
         }
 
         csdev->refcnt = refcnts;
@@ -1030,22 +1143,7 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
         csdev->nr_inport = desc->pdata->nr_inport;
         csdev->nr_outport = desc->pdata->nr_outport;
 
-        /* Initialise connections if there is at least one outport */
-        if (csdev->nr_outport) {
-                conns = kcalloc(csdev->nr_outport, sizeof(*conns), GFP_KERNEL);
-                if (!conns) {
-                        ret = -ENOMEM;
-                        goto err_kzalloc_conns;
-                }
-
-                for (i = 0; i < csdev->nr_outport; i++) {
-                        conns[i].outport = desc->pdata->outports[i];
-                        conns[i].child_name = desc->pdata->child_names[i];
-                        conns[i].child_port = desc->pdata->child_ports[i];
-                }
-        }
-
-        csdev->conns = conns;
+        csdev->conns = desc->pdata->conns;
 
         csdev->type = desc->type;
         csdev->subtype = desc->subtype;
@@ -1062,7 +1160,11 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
         ret = device_register(&csdev->dev);
         if (ret) {
                 put_device(&csdev->dev);
-                goto err_kzalloc_csdev;
+                /*
+                 * All resources are free'd explicitly via
+                 * coresight_device_release(), triggered from put_device().
+                 */
+                goto err_out;
         }
 
         mutex_lock(&coresight_mutex);
@@ -1074,11 +1176,9 @@ struct coresight_device *coresight_register(struct coresight_desc *desc)
 
         return csdev;
 
-err_kzalloc_conns:
-        kfree(refcnts);
-err_kzalloc_refcnts:
+err_free_csdev:
         kfree(csdev);
-err_kzalloc_csdev:
+err_out:
         return ERR_PTR(ret);
 }
 EXPORT_SYMBOL_GPL(coresight_register);
diff --git a/drivers/hwtracing/coresight/of_coresight.c b/drivers/hwtracing/coresight/of_coresight.c
index 6880bee195c8..89092f83567e 100644
--- a/drivers/hwtracing/coresight/of_coresight.c
+++ b/drivers/hwtracing/coresight/of_coresight.c
@@ -45,8 +45,13 @@ of_coresight_get_endpoint_device(struct device_node *endpoint)
                                endpoint, of_dev_node_match);
 }
 
-static void of_coresight_get_ports(const struct device_node *node,
-                                   int *nr_inport, int *nr_outport)
+static inline bool of_coresight_legacy_ep_is_input(struct device_node *ep)
+{
+        return of_property_read_bool(ep, "slave-mode");
+}
+
+static void of_coresight_get_ports_legacy(const struct device_node *node,
+                                          int *nr_inport, int *nr_outport)
 {
         struct device_node *ep = NULL;
         int in = 0, out = 0;
@@ -56,7 +61,7 @@ static void of_coresight_get_ports(const struct device_node *node,
                 if (!ep)
                         break;
 
-                if (of_property_read_bool(ep, "slave-mode"))
+                if (of_coresight_legacy_ep_is_input(ep))
                         in++;
                 else
                         out++;
@@ -67,32 +72,77 @@ static void of_coresight_get_ports(const struct device_node *node,
         *nr_outport = out;
 }
 
+static struct device_node *of_coresight_get_port_parent(struct device_node *ep)
+{
+        struct device_node *parent = of_graph_get_port_parent(ep);
+
+        /*
+         * Skip one-level up to the real device node, if we
+         * are using the new bindings.
+         */
+        if (!of_node_cmp(parent->name, "in-ports") ||
+            !of_node_cmp(parent->name, "out-ports"))
+                parent = of_get_next_parent(parent);
+
+        return parent;
+}
+
+static inline struct device_node *
+of_coresight_get_input_ports_node(const struct device_node *node)
+{
+        return of_get_child_by_name(node, "in-ports");
+}
+
+static inline struct device_node *
+of_coresight_get_output_ports_node(const struct device_node *node)
+{
+        return of_get_child_by_name(node, "out-ports");
+}
+
+static inline int
+of_coresight_count_ports(struct device_node *port_parent)
+{
+        int i = 0;
+        struct device_node *ep = NULL;
+
+        while ((ep = of_graph_get_next_endpoint(port_parent, ep)))
+                i++;
+        return i;
+}
+
+static void of_coresight_get_ports(const struct device_node *node,
+                                   int *nr_inport, int *nr_outport)
+{
+        struct device_node *input_ports = NULL, *output_ports = NULL;
+
+        input_ports = of_coresight_get_input_ports_node(node);
+        output_ports = of_coresight_get_output_ports_node(node);
+
+        if (input_ports || output_ports) {
+                if (input_ports) {
+                        *nr_inport = of_coresight_count_ports(input_ports);
+                        of_node_put(input_ports);
+                }
+                if (output_ports) {
+                        *nr_outport = of_coresight_count_ports(output_ports);
+                        of_node_put(output_ports);
+                }
+        } else {
+                /* Fall back to legacy DT bindings parsing */
+                of_coresight_get_ports_legacy(node, nr_inport, nr_outport);
+        }
+}
+
 static int of_coresight_alloc_memory(struct device *dev,
                         struct coresight_platform_data *pdata)
 {
-        /* List of output port on this component */
-        pdata->outports = devm_kcalloc(dev,
-                                       pdata->nr_outport,
-                                       sizeof(*pdata->outports),
-                                       GFP_KERNEL);
-        if (!pdata->outports)
-                return -ENOMEM;
-
-        /* Children connected to this component via @outports */
-        pdata->child_names = devm_kcalloc(dev,
-                                          pdata->nr_outport,
-                                          sizeof(*pdata->child_names),
-                                          GFP_KERNEL);
-        if (!pdata->child_names)
-                return -ENOMEM;
-
-        /* Port number on the child this component is connected to */
-        pdata->child_ports = devm_kcalloc(dev,
-                                          pdata->nr_outport,
-                                          sizeof(*pdata->child_ports),
-                                          GFP_KERNEL);
-        if (!pdata->child_ports)
-                return -ENOMEM;
+        if (pdata->nr_outport) {
+                pdata->conns = devm_kzalloc(dev, pdata->nr_outport *
+                                            sizeof(*pdata->conns),
+                                            GFP_KERNEL);
+                if (!pdata->conns)
+                        return -ENOMEM;
+        }
 
         return 0;
 }
@@ -114,17 +164,78 @@ int of_coresight_get_cpu(const struct device_node *node)
 }
 EXPORT_SYMBOL_GPL(of_coresight_get_cpu);
 
+/*
+ * of_coresight_parse_endpoint : Parse the given output endpoint @ep
+ * and fill the connection information in @conn
+ *
+ * Parses the local port, remote device name and the remote port.
+ *
+ * Returns :
+ *       1      - If the parsing is successful and a connection record
+ *                was created for an output connection.
+ *       0      - If the parsing completed without any fatal errors.
+ *      -Errno  - Fatal error, abort the scanning.
+ */
+static int of_coresight_parse_endpoint(struct device *dev,
+                                       struct device_node *ep,
+                                       struct coresight_connection *conn)
+{
+        int ret = 0;
+        struct of_endpoint endpoint, rendpoint;
+        struct device_node *rparent = NULL;
+        struct device_node *rep = NULL;
+        struct device *rdev = NULL;
+
+        do {
+                /* Parse the local port details */
+                if (of_graph_parse_endpoint(ep, &endpoint))
+                        break;
+                /*
+                 * Get a handle on the remote endpoint and the device it is
+                 * attached to.
+                 */
+                rep = of_graph_get_remote_endpoint(ep);
+                if (!rep)
+                        break;
+                rparent = of_coresight_get_port_parent(rep);
+                if (!rparent)
+                        break;
+                if (of_graph_parse_endpoint(rep, &rendpoint))
+                        break;
+
+                /* If the remote device is not available, defer probing */
+                rdev = of_coresight_get_endpoint_device(rparent);
+                if (!rdev) {
+                        ret = -EPROBE_DEFER;
+                        break;
+                }
+
+                conn->outport = endpoint.port;
+                conn->child_name = devm_kstrdup(dev,
+                                                dev_name(rdev),
+                                                GFP_KERNEL);
+                conn->child_port = rendpoint.port;
+                /* Connection record updated */
+                ret = 1;
+        } while (0);
+
+        of_node_put(rparent);
+        of_node_put(rep);
+        put_device(rdev);
+
+        return ret;
+}
+
 struct coresight_platform_data *
 of_get_coresight_platform_data(struct device *dev,
                                const struct device_node *node)
 {
-        int i = 0, ret = 0;
+        int ret = 0;
         struct coresight_platform_data *pdata;
-        struct of_endpoint endpoint, rendpoint;
-        struct device *rdev;
+        struct coresight_connection *conn;
         struct device_node *ep = NULL;
-        struct device_node *rparent = NULL;
-        struct device_node *rport = NULL;
+        const struct device_node *parent = NULL;
+        bool legacy_binding = false;
 
         pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
         if (!pdata)
@@ -132,63 +243,54 @@ of_get_coresight_platform_data(struct device *dev,
 
         /* Use device name as sysfs handle */
         pdata->name = dev_name(dev);
+        pdata->cpu = of_coresight_get_cpu(node);
 
         /* Get the number of input and output port for this component */
         of_coresight_get_ports(node, &pdata->nr_inport, &pdata->nr_outport);
 
-        if (pdata->nr_outport) {
-                ret = of_coresight_alloc_memory(dev, pdata);
-                if (ret)
-                        return ERR_PTR(ret);
-
-                /* Iterate through each port to discover topology */
-                do {
-                        /* Get a handle on a port */
-                        ep = of_graph_get_next_endpoint(node, ep);
-                        if (!ep)
-                                break;
-
-                        /*
-                         * No need to deal with input ports, processing for as
-                         * processing for output ports will deal with them.
-                         */
-                        if (of_find_property(ep, "slave-mode", NULL))
-                                continue;
-
-                        /* Get a handle on the local endpoint */
-                        ret = of_graph_parse_endpoint(ep, &endpoint);
-
-                        if (ret)
-                                continue;
-
-                        /* The local out port number */
-                        pdata->outports[i] = endpoint.port;
-
-                        /*
-                         * Get a handle on the remote port and parent
-                         * attached to it.
-                         */
-                        rparent = of_graph_get_remote_port_parent(ep);
-                        rport = of_graph_get_remote_port(ep);
-
-                        if (!rparent || !rport)
-                                continue;
+        /* If there are no output connections, we are done */
+        if (!pdata->nr_outport)
+                return pdata;
 
-                        if (of_graph_parse_endpoint(rport, &rendpoint))
-                                continue;
+        ret = of_coresight_alloc_memory(dev, pdata);
+        if (ret)
+                return ERR_PTR(ret);
 
-                        rdev = of_coresight_get_endpoint_device(rparent);
-                        if (!rdev)
-                                return ERR_PTR(-EPROBE_DEFER);
-
-                        pdata->child_names[i] = dev_name(rdev);
-                        pdata->child_ports[i] = rendpoint.id;
-
-                        i++;
-                } while (ep);
+        parent = of_coresight_get_output_ports_node(node);
+        /*
+         * If the DT uses obsoleted bindings, the ports are listed
+         * under the device and we need to filter out the input
+         * ports.
+         */
+        if (!parent) {
+                legacy_binding = true;
+                parent = node;
+                dev_warn_once(dev, "Uses obsolete Coresight DT bindings\n");
         }
 
-        pdata->cpu = of_coresight_get_cpu(node);
+        conn = pdata->conns;
+
+        /* Iterate through each output port to discover topology */
+        while ((ep = of_graph_get_next_endpoint(parent, ep))) {
+                /*
+                 * Legacy binding mixes input/output ports under the
+                 * same parent. So, skip the input ports if we are dealing
+                 * with legacy binding, as they processed with their
+                 * connected output ports.
+                 */
+                if (legacy_binding && of_coresight_legacy_ep_is_input(ep))
+                        continue;
+
+                ret = of_coresight_parse_endpoint(dev, ep, conn);
+                switch (ret) {
+                case 1:
+                        conn++;         /* Fall through */
+                case 0:
+                        break;
+                default:
+                        return ERR_PTR(ret);
+                }
+        }
 
         return pdata;
 }
diff --git a/drivers/hwtracing/stm/Kconfig b/drivers/hwtracing/stm/Kconfig
index 723e2d90083d..752dd66742bf 100644
--- a/drivers/hwtracing/stm/Kconfig
+++ b/drivers/hwtracing/stm/Kconfig
@@ -11,6 +11,35 @@ config STM
 
 if STM
 
+config STM_PROTO_BASIC
+        tristate "Basic STM framing protocol driver"
+        default CONFIG_STM
+        help
+          This is a simple framing protocol for sending data over STM
+          devices. This was the protocol that the STM framework used
+          exclusively until the MIPI SyS-T support was added. Use this
+          driver for compatibility with your existing STM setup.
+
+          The receiving side only needs to be able to decode the MIPI
+          STP protocol in order to extract the data.
+
+          If you want to be able to use the basic protocol or want the
+          backwards compatibility for your existing setup, say Y.
+
+config STM_PROTO_SYS_T
+        tristate "MIPI SyS-T STM framing protocol driver"
+        default CONFIG_STM
+        help
+          This is an implementation of MIPI SyS-T protocol to be used
+          over the STP transport. In addition to the data payload, it
+          also carries additional metadata for time correlation, better
+          means of trace source identification, etc.
+
+          The receiving side must be able to decode this protocol in
+          addition to the MIPI STP, in order to extract the data.
+
+          If you don't know what this is, say N.
+
 config STM_DUMMY
         tristate "Dummy STM driver"
         help
diff --git a/drivers/hwtracing/stm/Makefile b/drivers/hwtracing/stm/Makefile
index effc19e5190f..1692fcd29277 100644
--- a/drivers/hwtracing/stm/Makefile
+++ b/drivers/hwtracing/stm/Makefile
@@ -3,6 +3,12 @@ obj-$(CONFIG_STM)	+= stm_core.o
 
 stm_core-y              := core.o policy.o
 
+obj-$(CONFIG_STM_PROTO_BASIC) += stm_p_basic.o
+obj-$(CONFIG_STM_PROTO_SYS_T) += stm_p_sys-t.o
+
+stm_p_basic-y           := p_basic.o
+stm_p_sys-t-y           := p_sys-t.o
+
 obj-$(CONFIG_STM_DUMMY) += dummy_stm.o
 
 obj-$(CONFIG_STM_SOURCE_CONSOLE)        += stm_console.o
diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index 10bcb5d73f90..93ce3aa740a9 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c
@@ -293,15 +293,15 @@ static int stm_output_assign(struct stm_device *stm, unsigned int width,
         if (width > stm->data->sw_nchannels)
                 return -EINVAL;
 
-        if (policy_node) {
-                stp_policy_node_get_ranges(policy_node,
-                                           &midx, &mend, &cidx, &cend);
-        } else {
-                midx = stm->data->sw_start;
-                cidx = 0;
-                mend = stm->data->sw_end;
-                cend = stm->data->sw_nchannels - 1;
-        }
+        /* We no longer accept policy_node==NULL here */
+        if (WARN_ON_ONCE(!policy_node))
+                return -EINVAL;
+
+        /*
+         * Also, the caller holds reference to policy_node, so it won't
+         * disappear on us.
+         */
+        stp_policy_node_get_ranges(policy_node, &midx, &mend, &cidx, &cend);
 
         spin_lock(&stm->mc_lock);
         spin_lock(&output->lock);
@@ -316,11 +316,26 @@ static int stm_output_assign(struct stm_device *stm, unsigned int width,
         output->master = midx;
         output->channel = cidx;
         output->nr_chans = width;
+        if (stm->pdrv->output_open) {
+                void *priv = stp_policy_node_priv(policy_node);
+
+                if (WARN_ON_ONCE(!priv))
+                        goto unlock;
+
+                /* configfs subsys mutex is held by the caller */
+                ret = stm->pdrv->output_open(priv, output);
+                if (ret)
+                        goto unlock;
+        }
+
         stm_output_claim(stm, output);
         dev_dbg(&stm->dev, "assigned %u:%u (+%u)\n", midx, cidx, width);
 
         ret = 0;
 unlock:
+        if (ret)
+                output->nr_chans = 0;
+
         spin_unlock(&output->lock);
         spin_unlock(&stm->mc_lock);
 
@@ -333,6 +348,8 @@ static void stm_output_free(struct stm_device *stm, struct stm_output *output)
         spin_lock(&output->lock);
         if (output->nr_chans)
                 stm_output_disclaim(stm, output);
+        if (stm->pdrv && stm->pdrv->output_close)
+                stm->pdrv->output_close(output);
         spin_unlock(&output->lock);
         spin_unlock(&stm->mc_lock);
 }
@@ -349,6 +366,127 @@ static int major_match(struct device *dev, const void *data)
         return MAJOR(dev->devt) == major;
 }
 
+/*
+ * Framing protocol management
+ * Modules can implement STM protocol drivers and (un-)register them
+ * with the STM class framework.
+ */
+static struct list_head stm_pdrv_head;
+static struct mutex stm_pdrv_mutex;
+
+struct stm_pdrv_entry {
+        struct list_head                        entry;
+        const struct stm_protocol_driver        *pdrv;
+        const struct config_item_type           *node_type;
+};
+
+static const struct stm_pdrv_entry *
+__stm_lookup_protocol(const char *name)
+{
+        struct stm_pdrv_entry *pe;
+
+        /*
+         * If no name is given (NULL or ""), fall back to "p_basic".
+         */
+        if (!name || !*name)
+                name = "p_basic";
+
+        list_for_each_entry(pe, &stm_pdrv_head, entry) {
+                if (!strcmp(name, pe->pdrv->name))
+                        return pe;
+        }
+
+        return NULL;
+}
+
+int stm_register_protocol(const struct stm_protocol_driver *pdrv)
+{
+        struct stm_pdrv_entry *pe = NULL;
+        int ret = -ENOMEM;
+
+        mutex_lock(&stm_pdrv_mutex);
+
+        if (__stm_lookup_protocol(pdrv->name)) {
+                ret = -EEXIST;
+                goto unlock;
+        }
+
+        pe = kzalloc(sizeof(*pe), GFP_KERNEL);
+        if (!pe)
+                goto unlock;
+
+        if (pdrv->policy_attr) {
+                pe->node_type = get_policy_node_type(pdrv->policy_attr);
+                if (!pe->node_type)
+                        goto unlock;
+        }
+
+        list_add_tail(&pe->entry, &stm_pdrv_head);
+        pe->pdrv = pdrv;
+
+        ret = 0;
+unlock:
+        mutex_unlock(&stm_pdrv_mutex);
+
+        if (ret)
+                kfree(pe);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(stm_register_protocol);
+
+void stm_unregister_protocol(const struct stm_protocol_driver *pdrv)
+{
+        struct stm_pdrv_entry *pe, *iter;
+
+        mutex_lock(&stm_pdrv_mutex);
+
+        list_for_each_entry_safe(pe, iter, &stm_pdrv_head, entry) {
+                if (pe->pdrv == pdrv) {
+                        list_del(&pe->entry);
+
+                        if (pe->node_type) {
+                                kfree(pe->node_type->ct_attrs);
+                                kfree(pe->node_type);
+                        }
+                        kfree(pe);
+                        break;
+                }
+        }
+
+        mutex_unlock(&stm_pdrv_mutex);
+}
+EXPORT_SYMBOL_GPL(stm_unregister_protocol);
+
+static bool stm_get_protocol(const struct stm_protocol_driver *pdrv)
+{
+        return try_module_get(pdrv->owner);
+}
+
+void stm_put_protocol(const struct stm_protocol_driver *pdrv)
+{
+        module_put(pdrv->owner);
+}
+
+int stm_lookup_protocol(const char *name,
+                        const struct stm_protocol_driver **pdrv,
+                        const struct config_item_type **node_type)
+{
+        const struct stm_pdrv_entry *pe;
+
+        mutex_lock(&stm_pdrv_mutex);
+
+        pe = __stm_lookup_protocol(name);
+        if (pe && pe->pdrv && stm_get_protocol(pe->pdrv)) {
+                *pdrv = pe->pdrv;
+                *node_type = pe->node_type;
+        }
+
+        mutex_unlock(&stm_pdrv_mutex);
+
+        return pe ? 0 : -ENOENT;
+}
+
 static int stm_char_open(struct inode *inode, struct file *file)
 {
         struct stm_file *stmf;
@@ -405,42 +543,81 @@ static int stm_char_release(struct inode *inode, struct file *file)
         return 0;
 }
 
-static int stm_file_assign(struct stm_file *stmf, char *id, unsigned int width)
+static int
+stm_assign_first_policy(struct stm_device *stm, struct stm_output *output,
+                        char **ids, unsigned int width)
 {
-        struct stm_device *stm = stmf->stm;
-        int ret;
+        struct stp_policy_node *pn;
+        int err, n;
 
-        stmf->policy_node = stp_policy_node_lookup(stm, id);
+        /*
+         * On success, stp_policy_node_lookup() will return holding the
+         * configfs subsystem mutex, which is then released in
+         * stp_policy_node_put(). This allows the pdrv->output_open() in
+         * stm_output_assign() to serialize against the attribute accessors.
+         */
+        for (n = 0, pn = NULL; ids[n] && !pn; n++)
+                pn = stp_policy_node_lookup(stm, ids[n]);
 
-        ret = stm_output_assign(stm, width, stmf->policy_node, &stmf->output);
+        if (!pn)
+                return -EINVAL;
 
-        if (stmf->policy_node)
-                stp_policy_node_put(stmf->policy_node);
+        err = stm_output_assign(stm, width, pn, output);
 
-        return ret;
+        stp_policy_node_put(pn);
+
+        return err;
 }
 
-static ssize_t notrace stm_write(struct stm_data *data, unsigned int master,
-                          unsigned int channel, const char *buf, size_t count)
+/**
+ * stm_data_write() - send the given payload as data packets
+ * @data:       stm driver's data
+ * @m:          STP master
+ * @c:          STP channel
+ * @ts_first:   timestamp the first packet
+ * @buf:        data payload buffer
+ * @count:      data payload size
+ */
+ssize_t notrace stm_data_write(struct stm_data *data, unsigned int m,
+                               unsigned int c, bool ts_first, const void *buf,
+                               size_t count)
 {
-        unsigned int flags = STP_PACKET_TIMESTAMPED;
-        const unsigned char *p = buf, nil = 0;
-        size_t pos;
+        unsigned int flags = ts_first ? STP_PACKET_TIMESTAMPED : 0;
         ssize_t sz;
+        size_t pos;
 
-        for (pos = 0, p = buf; count > pos; pos += sz, p += sz) {
+        for (pos = 0, sz = 0; pos < count; pos += sz) {
                 sz = min_t(unsigned int, count - pos, 8);
-                sz = data->packet(data, master, channel, STP_PACKET_DATA, flags,
-                                  sz, p);
-                flags = 0;
-
-                if (sz < 0)
+                sz = data->packet(data, m, c, STP_PACKET_DATA, flags, sz,
+                                  &((u8 *)buf)[pos]);
+                if (sz <= 0)
                         break;
+
+                if (ts_first) {
+                        flags = 0;
+                        ts_first = false;
+                }
         }
 
-        data->packet(data, master, channel, STP_PACKET_FLAG, 0, 0, &nil);
+        return sz < 0 ? sz : pos;
+}
+EXPORT_SYMBOL_GPL(stm_data_write);
+
+static ssize_t notrace
+stm_write(struct stm_device *stm, struct stm_output *output,
+          unsigned int chan, const char *buf, size_t count)
+{
+        int err;
+
+        /* stm->pdrv is serialized against policy_mutex */
+        if (!stm->pdrv)
+                return -ENODEV;
+
+        err = stm->pdrv->write(stm->data, output, chan, buf, count);
+        if (err < 0)
+                return err;
 
-        return pos;
+        return err;
 }
 
 static ssize_t stm_char_write(struct file *file, const char __user *buf,
@@ -455,16 +632,21 @@ static ssize_t stm_char_write(struct file *file, const char __user *buf,
                 count = PAGE_SIZE - 1;
 
         /*
-         * if no m/c have been assigned to this writer up to this
-         * point, use "default" policy entry
+         * If no m/c have been assigned to this writer up to this
+         * point, try to use the task name and "default" policy entries.
          */
         if (!stmf->output.nr_chans) {
-                err = stm_file_assign(stmf, "default", 1);
+                char comm[sizeof(current->comm)];
+                char *ids[] = { comm, "default", NULL };
+
+                get_task_comm(comm, current);
+
+                err = stm_assign_first_policy(stmf->stm, &stmf->output, ids, 1);
                 /*
                  * EBUSY means that somebody else just assigned this
                  * output, which is just fine for write()
                  */
-                if (err && err != -EBUSY)
+                if (err)
                         return err;
         }
 
@@ -480,8 +662,7 @@ static ssize_t stm_char_write(struct file *file, const char __user *buf,
 
         pm_runtime_get_sync(&stm->dev);
 
-        count = stm_write(stm->data, stmf->output.master, stmf->output.channel,
-                          kbuf, count);
+        count = stm_write(stm, &stmf->output, 0, kbuf, count);
 
         pm_runtime_mark_last_busy(&stm->dev);
         pm_runtime_put_autosuspend(&stm->dev);
@@ -550,6 +731,7 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg)
 {
         struct stm_device *stm = stmf->stm;
         struct stp_policy_id *id;
+        char *ids[] = { NULL, NULL };
         int ret = -EINVAL;
         u32 size;
 
@@ -582,7 +764,9 @@ static int stm_char_policy_set_ioctl(struct stm_file *stmf, void __user *arg)
             id->width > PAGE_SIZE / stm->data->sw_mmiosz)
                 goto err_free;
 
-        ret = stm_file_assign(stmf, id->id, id->width);
+        ids[0] = id->id;
+        ret = stm_assign_first_policy(stmf->stm, &stmf->output, ids,
+                                      id->width);
         if (ret)
                 goto err_free;
 
@@ -818,8 +1002,8 @@ EXPORT_SYMBOL_GPL(stm_unregister_device);
 static int stm_source_link_add(struct stm_source_device *src,
                                struct stm_device *stm)
 {
-        char *id;
-        int err;
+        char *ids[] = { NULL, "default", NULL };
+        int err = -ENOMEM;
 
         mutex_lock(&stm->link_mutex);
         spin_lock(&stm->link_lock);
@@ -833,19 +1017,13 @@ static int stm_source_link_add(struct stm_source_device *src,
         spin_unlock(&stm->link_lock);
         mutex_unlock(&stm->link_mutex);
 
-        id = kstrdup(src->data->name, GFP_KERNEL);
-        if (id) {
-                src->policy_node =
-                        stp_policy_node_lookup(stm, id);
-
-                kfree(id);
-        }
-
-        err = stm_output_assign(stm, src->data->nr_chans,
-                                src->policy_node, &src->output);
+        ids[0] = kstrdup(src->data->name, GFP_KERNEL);
+        if (!ids[0])
+                goto fail_detach;
 
-        if (src->policy_node)
-                stp_policy_node_put(src->policy_node);
+        err = stm_assign_first_policy(stm, &src->output, ids,
+                                      src->data->nr_chans);
+        kfree(ids[0]);
 
         if (err)
                 goto fail_detach;
@@ -1134,9 +1312,7 @@ int notrace stm_source_write(struct stm_source_data *data,
 
         stm = srcu_dereference(src->link, &stm_source_srcu);
         if (stm)
-                count = stm_write(stm->data, src->output.master,
-                                  src->output.channel + chan,
-                                  buf, count);
+                count = stm_write(stm, &src->output, chan, buf, count);
         else
                 count = -ENODEV;
 
@@ -1163,7 +1339,15 @@ static int __init stm_core_init(void)
                 goto err_src;
 
         init_srcu_struct(&stm_source_srcu);
+        INIT_LIST_HEAD(&stm_pdrv_head);
+        mutex_init(&stm_pdrv_mutex);
 
+        /*
+         * So as to not confuse existing users with a requirement
+         * to load yet another module, do it here.
+         */
+        if (IS_ENABLED(CONFIG_STM_PROTO_BASIC))
+                (void)request_module_nowait("stm_p_basic");
         stm_core_up++;
 
         return 0;
diff --git a/drivers/hwtracing/stm/heartbeat.c b/drivers/hwtracing/stm/heartbeat.c
index 7db42395e131..3e7df1c0477f 100644
--- a/drivers/hwtracing/stm/heartbeat.c
+++ b/drivers/hwtracing/stm/heartbeat.c
@@ -76,7 +76,7 @@ static int stm_heartbeat_init(void)
                         goto fail_unregister;
 
                 stm_heartbeat[i].data.nr_chans  = 1;
-                stm_heartbeat[i].data.link              = stm_heartbeat_link;
+                stm_heartbeat[i].data.link      = stm_heartbeat_link;
                 stm_heartbeat[i].data.unlink    = stm_heartbeat_unlink;
                 hrtimer_init(&stm_heartbeat[i].hrtimer, CLOCK_MONOTONIC,
                              HRTIMER_MODE_ABS);
diff --git a/drivers/hwtracing/stm/p_basic.c b/drivers/hwtracing/stm/p_basic.c
new file mode 100644
index 000000000000..8980a6a5fd6c
--- /dev/null
+++ b/drivers/hwtracing/stm/p_basic.c
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Basic framing protocol for STM devices.
+ * Copyright (c) 2018, Intel Corporation.
+ */
+
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/stm.h>
+#include "stm.h"
+
+static ssize_t basic_write(struct stm_data *data, struct stm_output *output,
+                           unsigned int chan, const char *buf, size_t count)
+{
+        unsigned int c = output->channel + chan;
+        unsigned int m = output->master;
+        const unsigned char nil = 0;
+        ssize_t sz;
+
+        sz = stm_data_write(data, m, c, true, buf, count);
+        if (sz > 0)
+                data->packet(data, m, c, STP_PACKET_FLAG, 0, 0, &nil);
+
+        return sz;
+}
+
+static const struct stm_protocol_driver basic_pdrv = {
+        .owner  = THIS_MODULE,
+        .name   = "p_basic",
+        .write  = basic_write,
+};
+
+static int basic_stm_init(void)
+{
+        return stm_register_protocol(&basic_pdrv);
+}
+
+static void basic_stm_exit(void)
+{
+        stm_unregister_protocol(&basic_pdrv);
+}
+
+module_init(basic_stm_init);
+module_exit(basic_stm_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Basic STM framing protocol driver");
+MODULE_AUTHOR("Alexander Shishkin <alexander.shishkin@linux.intel.com>");
diff --git a/drivers/hwtracing/stm/p_sys-t.c b/drivers/hwtracing/stm/p_sys-t.c
new file mode 100644
index 000000000000..b178a5495b67
--- /dev/null
+++ b/drivers/hwtracing/stm/p_sys-t.c
@@ -0,0 +1,382 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * MIPI SyS-T framing protocol for STM devices.
+ * Copyright (c) 2018, Intel Corporation.
+ */
+
+#include <linux/configfs.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/uuid.h>
+#include <linux/stm.h>
+#include "stm.h"
+
+enum sys_t_message_type {
+        MIPI_SYST_TYPE_BUILD    = 0,
+        MIPI_SYST_TYPE_SHORT32,
+        MIPI_SYST_TYPE_STRING,
+        MIPI_SYST_TYPE_CATALOG,
+        MIPI_SYST_TYPE_RAW      = 6,
+        MIPI_SYST_TYPE_SHORT64,
+        MIPI_SYST_TYPE_CLOCK,
+};
+
+enum sys_t_message_severity {
+        MIPI_SYST_SEVERITY_MAX  = 0,
+        MIPI_SYST_SEVERITY_FATAL,
+        MIPI_SYST_SEVERITY_ERROR,
+        MIPI_SYST_SEVERITY_WARNING,
+        MIPI_SYST_SEVERITY_INFO,
+        MIPI_SYST_SEVERITY_USER1,
+        MIPI_SYST_SEVERITY_USER2,
+        MIPI_SYST_SEVERITY_DEBUG,
+};
+
+enum sys_t_message_build_subtype {
+        MIPI_SYST_BUILD_ID_COMPACT32 = 0,
+        MIPI_SYST_BUILD_ID_COMPACT64,
+        MIPI_SYST_BUILD_ID_LONG,
+};
+
+enum sys_t_message_clock_subtype {
+        MIPI_SYST_CLOCK_TRANSPORT_SYNC = 1,
+};
+
+enum sys_t_message_string_subtype {
+        MIPI_SYST_STRING_GENERIC        = 1,
+        MIPI_SYST_STRING_FUNCTIONENTER,
+        MIPI_SYST_STRING_FUNCTIONEXIT,
+        MIPI_SYST_STRING_INVALIDPARAM   = 5,
+        MIPI_SYST_STRING_ASSERT         = 7,
+        MIPI_SYST_STRING_PRINTF_32      = 11,
+        MIPI_SYST_STRING_PRINTF_64      = 12,
+};
+
+#define MIPI_SYST_TYPE(t)               ((u32)(MIPI_SYST_TYPE_ ## t))
+#define MIPI_SYST_SEVERITY(s)           ((u32)(MIPI_SYST_SEVERITY_ ## s) << 4)
+#define MIPI_SYST_OPT_LOC               BIT(8)
+#define MIPI_SYST_OPT_LEN               BIT(9)
+#define MIPI_SYST_OPT_CHK               BIT(10)
+#define MIPI_SYST_OPT_TS                BIT(11)
+#define MIPI_SYST_UNIT(u)               ((u32)(u) << 12)
+#define MIPI_SYST_ORIGIN(o)             ((u32)(o) << 16)
+#define MIPI_SYST_OPT_GUID              BIT(23)
+#define MIPI_SYST_SUBTYPE(s)            ((u32)(MIPI_SYST_ ## s) << 24)
+#define MIPI_SYST_UNITLARGE(u)          (MIPI_SYST_UNIT(u & 0xf) | \
+                                         MIPI_SYST_ORIGIN(u >> 4))
+#define MIPI_SYST_TYPES(t, s)           (MIPI_SYST_TYPE(t) | \
+                                         MIPI_SYST_SUBTYPE(t ## _ ## s))
+
+#define DATA_HEADER     (MIPI_SYST_TYPES(STRING, GENERIC)       | \
+                         MIPI_SYST_SEVERITY(INFO)               | \
+                         MIPI_SYST_OPT_GUID)
+
+#define CLOCK_SYNC_HEADER       (MIPI_SYST_TYPES(CLOCK, TRANSPORT_SYNC) | \
+                                 MIPI_SYST_SEVERITY(MAX))
+
+struct sys_t_policy_node {
+        uuid_t          uuid;
+        bool            do_len;
+        unsigned long   ts_interval;
+        unsigned long   clocksync_interval;
+};
+
+struct sys_t_output {
+        struct sys_t_policy_node        node;
+        unsigned long   ts_jiffies;
+        unsigned long   clocksync_jiffies;
+};
+
+static void sys_t_policy_node_init(void *priv)
+{
+        struct sys_t_policy_node *pn = priv;
+
+        generate_random_uuid(pn->uuid.b);
+}
+
+static int sys_t_output_open(void *priv, struct stm_output *output)
+{
+        struct sys_t_policy_node *pn = priv;
+        struct sys_t_output *opriv;
+
+        opriv = kzalloc(sizeof(*opriv), GFP_ATOMIC);
+        if (!opriv)
+                return -ENOMEM;
+
+        memcpy(&opriv->node, pn, sizeof(opriv->node));
+        output->pdrv_private = opriv;
+
+        return 0;
+}
+
+static void sys_t_output_close(struct stm_output *output)
+{
+        kfree(output->pdrv_private);
+}
+
+static ssize_t sys_t_policy_uuid_show(struct config_item *item,
+                                      char *page)
+{
+        struct sys_t_policy_node *pn = to_pdrv_policy_node(item);
+
+        return sprintf(page, "%pU\n", &pn->uuid);
+}
+
+static ssize_t
+sys_t_policy_uuid_store(struct config_item *item, const char *page,
+                        size_t count)
+{
+        struct mutex *mutexp = &item->ci_group->cg_subsys->su_mutex;
+        struct sys_t_policy_node *pn = to_pdrv_policy_node(item);
+        int ret;
+
+        mutex_lock(mutexp);
+        ret = uuid_parse(page, &pn->uuid);
+        mutex_unlock(mutexp);
+
+        return ret < 0 ? ret : count;
+}
+
+CONFIGFS_ATTR(sys_t_policy_, uuid);
+
+static ssize_t sys_t_policy_do_len_show(struct config_item *item,
+                                      char *page)
+{
+        struct sys_t_policy_node *pn = to_pdrv_policy_node(item);
+
+        return sprintf(page, "%d\n", pn->do_len);
+}
+
+static ssize_t
+sys_t_policy_do_len_store(struct config_item *item, const char *page,
+                        size_t count)
+{
+        struct mutex *mutexp = &item->ci_group->cg_subsys->su_mutex;
+        struct sys_t_policy_node *pn = to_pdrv_policy_node(item);
+        int ret;
+
+        mutex_lock(mutexp);
+        ret = kstrtobool(page, &pn->do_len);
+        mutex_unlock(mutexp);
+
+        return ret ? ret : count;
+}
+
+CONFIGFS_ATTR(sys_t_policy_, do_len);
+
+static ssize_t sys_t_policy_ts_interval_show(struct config_item *item,
+                                             char *page)
+{
+        struct sys_t_policy_node *pn = to_pdrv_policy_node(item);
+
+        return sprintf(page, "%u\n", jiffies_to_msecs(pn->ts_interval));
+}
+
+static ssize_t
+sys_t_policy_ts_interval_store(struct config_item *item, const char *page,
+                               size_t count)
+{
+        struct mutex *mutexp = &item->ci_group->cg_subsys->su_mutex;
+        struct sys_t_policy_node *pn = to_pdrv_policy_node(item);
+        unsigned int ms;
+        int ret;
+
+        mutex_lock(mutexp);
+        ret = kstrtouint(page, 10, &ms);
+        mutex_unlock(mutexp);
+
+        if (!ret) {
+                pn->ts_interval = msecs_to_jiffies(ms);
+                return count;
+        }
+
+        return ret;
+}
+
+CONFIGFS_ATTR(sys_t_policy_, ts_interval);
+
+static ssize_t sys_t_policy_clocksync_interval_show(struct config_item *item,
+                                                    char *page)
+{
+        struct sys_t_policy_node *pn = to_pdrv_policy_node(item);
+
+        return sprintf(page, "%u\n", jiffies_to_msecs(pn->clocksync_interval));
+}
+
+static ssize_t
+sys_t_policy_clocksync_interval_store(struct config_item *item,
+                                      const char *page, size_t count)
+{
+        struct mutex *mutexp = &item->ci_group->cg_subsys->su_mutex;
+        struct sys_t_policy_node *pn = to_pdrv_policy_node(item);
+        unsigned int ms;
+        int ret;
+
+        mutex_lock(mutexp);
+        ret = kstrtouint(page, 10, &ms);
+        mutex_unlock(mutexp);
+
+        if (!ret) {
+                pn->clocksync_interval = msecs_to_jiffies(ms);
+                return count;
+        }
+
+        return ret;
+}
+
+CONFIGFS_ATTR(sys_t_policy_, clocksync_interval);
+
+static struct configfs_attribute *sys_t_policy_attrs[] = {
+        &sys_t_policy_attr_uuid,
+        &sys_t_policy_attr_do_len,
+        &sys_t_policy_attr_ts_interval,
+        &sys_t_policy_attr_clocksync_interval,
+        NULL,
+};
+
+static inline bool sys_t_need_ts(struct sys_t_output *op)
+{
+        if (op->node.ts_interval &&
+            time_after(op->ts_jiffies + op->node.ts_interval, jiffies)) {
+                op->ts_jiffies = jiffies;
+
+                return true;
+        }
+
+        return false;
+}
+
+static bool sys_t_need_clock_sync(struct sys_t_output *op)
+{
+        if (op->node.clocksync_interval &&
+            time_after(op->clocksync_jiffies + op->node.clocksync_interval,
+                       jiffies)) {
+                op->clocksync_jiffies = jiffies;
+
+                return true;
+        }
+
+        return false;
+}
+
+static ssize_t
+sys_t_clock_sync(struct stm_data *data, unsigned int m, unsigned int c)
+{
+        u32 header = CLOCK_SYNC_HEADER;
+        const unsigned char nil = 0;
+        u64 payload[2]; /* Clock value and frequency */
+        ssize_t sz;
+
+        sz = data->packet(data, m, c, STP_PACKET_DATA, STP_PACKET_TIMESTAMPED,
+                          4, (u8 *)&header);
+        if (sz <= 0)
+                return sz;
+
+        payload[0] = ktime_get_real_ns();
+        payload[1] = NSEC_PER_SEC;
+        sz = stm_data_write(data, m, c, false, &payload, sizeof(payload));
+        if (sz <= 0)
+                return sz;
+
+        data->packet(data, m, c, STP_PACKET_FLAG, 0, 0, &nil);
+
+        return sizeof(header) + sizeof(payload);
+}
+
+static ssize_t sys_t_write(struct stm_data *data, struct stm_output *output,
+                           unsigned int chan, const char *buf, size_t count)
+{
+        struct sys_t_output *op = output->pdrv_private;
+        unsigned int c = output->channel + chan;
+        unsigned int m = output->master;
+        const unsigned char nil = 0;
+        u32 header = DATA_HEADER;
+        ssize_t sz;
+
+        /* We require an existing policy node to proceed */
+        if (!op)
+                return -EINVAL;
+
+        if (sys_t_need_clock_sync(op)) {
+                sz = sys_t_clock_sync(data, m, c);
+                if (sz <= 0)
+                        return sz;
+        }
+
+        if (op->node.do_len)
+                header |= MIPI_SYST_OPT_LEN;
+        if (sys_t_need_ts(op))
+                header |= MIPI_SYST_OPT_TS;
+
+        /*
+         * STP framing rules for SyS-T frames:
+         *   * the first packet of the SyS-T frame is timestamped;
+         *   * the last packet is a FLAG.
+         */
+        /* Message layout: HEADER / GUID / [LENGTH /][TIMESTAMP /] DATA */
+        /* HEADER */
+        sz = data->packet(data, m, c, STP_PACKET_DATA, STP_PACKET_TIMESTAMPED,
+                          4, (u8 *)&header);
+        if (sz <= 0)
+                return sz;
+
+        /* GUID */
+        sz = stm_data_write(data, m, c, false, op->node.uuid.b, UUID_SIZE);
+        if (sz <= 0)
+                return sz;
+
+        /* [LENGTH] */
+        if (op->node.do_len) {
+                u16 length = count;
+
+                sz = data->packet(data, m, c, STP_PACKET_DATA, 0, 2,
+                                  (u8 *)&length);
+                if (sz <= 0)
+                        return sz;
+        }
+
+        /* [TIMESTAMP] */
+        if (header & MIPI_SYST_OPT_TS) {
+                u64 ts = ktime_get_real_ns();
+
+                sz = stm_data_write(data, m, c, false, &ts, sizeof(ts));
+                if (sz <= 0)
+                        return sz;
+        }
+
+        /* DATA */
+        sz = stm_data_write(data, m, c, false, buf, count);
+        if (sz > 0)
+                data->packet(data, m, c, STP_PACKET_FLAG, 0, 0, &nil);
+
+        return sz;
+}
+
+static const struct stm_protocol_driver sys_t_pdrv = {
+        .owner                  = THIS_MODULE,
+        .name                   = "p_sys-t",
+        .priv_sz                = sizeof(struct sys_t_policy_node),
+        .write                  = sys_t_write,
+        .policy_attr            = sys_t_policy_attrs,
+        .policy_node_init       = sys_t_policy_node_init,
+        .output_open            = sys_t_output_open,
+        .output_close           = sys_t_output_close,
+};
+
+static int sys_t_stm_init(void)
+{
+        return stm_register_protocol(&sys_t_pdrv);
+}
+
+static void sys_t_stm_exit(void)
+{
+        stm_unregister_protocol(&sys_t_pdrv);
+}
+
+module_init(sys_t_stm_init);
+module_exit(sys_t_stm_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("MIPI SyS-T STM framing protocol driver");
+MODULE_AUTHOR("Alexander Shishkin <alexander.shishkin@linux.intel.com>");
diff --git a/drivers/hwtracing/stm/policy.c b/drivers/hwtracing/stm/policy.c
index 3fd07e275b34..0910ec807187 100644
--- a/drivers/hwtracing/stm/policy.c
+++ b/drivers/hwtracing/stm/policy.c
@@ -33,8 +33,18 @@ struct stp_policy_node {
         unsigned int            last_master;
         unsigned int            first_channel;
         unsigned int            last_channel;
+        /* this is the one that's exposed to the attributes */
+        unsigned char           priv[0];
 };
 
+void *stp_policy_node_priv(struct stp_policy_node *pn)
+{
+        if (!pn)
+                return NULL;
+
+        return pn->priv;
+}
+
 static struct configfs_subsystem stp_policy_subsys;
 
 void stp_policy_node_get_ranges(struct stp_policy_node *policy_node,
@@ -68,6 +78,14 @@ to_stp_policy_node(struct config_item *item)
                 NULL;
 }
 
+void *to_pdrv_policy_node(struct config_item *item)
+{
+        struct stp_policy_node *node = to_stp_policy_node(item);
+
+        return stp_policy_node_priv(node);
+}
+EXPORT_SYMBOL_GPL(to_pdrv_policy_node);
+
 static ssize_t
 stp_policy_node_masters_show(struct config_item *item, char *page)
 {
@@ -163,7 +181,9 @@ unlock:
 
 static void stp_policy_node_release(struct config_item *item)
 {
-        kfree(to_stp_policy_node(item));
+        struct stp_policy_node *node = to_stp_policy_node(item);
+
+        kfree(node);
 }
 
 static struct configfs_item_operations stp_policy_node_item_ops = {
@@ -182,10 +202,34 @@ static struct configfs_attribute *stp_policy_node_attrs[] = {
 static const struct config_item_type stp_policy_type;
 static const struct config_item_type stp_policy_node_type;
 
+const struct config_item_type *
+get_policy_node_type(struct configfs_attribute **attrs)
+{
+        struct config_item_type *type;
+        struct configfs_attribute **merged;
+
+        type = kmemdup(&stp_policy_node_type, sizeof(stp_policy_node_type),
+                       GFP_KERNEL);
+        if (!type)
+                return NULL;
+
+        merged = memcat_p(stp_policy_node_attrs, attrs);
+        if (!merged) {
+                kfree(type);
+                return NULL;
+        }
+
+        type->ct_attrs = merged;
+
+        return type;
+}
+
 static struct config_group *
 stp_policy_node_make(struct config_group *group, const char *name)
 {
+        const struct config_item_type *type = &stp_policy_node_type;
         struct stp_policy_node *policy_node, *parent_node;
+        const struct stm_protocol_driver *pdrv;
         struct stp_policy *policy;
 
         if (group->cg_item.ci_type == &stp_policy_type) {
@@ -199,12 +243,20 @@ stp_policy_node_make(struct config_group *group, const char *name)
         if (!policy->stm)
                 return ERR_PTR(-ENODEV);
 
-        policy_node = kzalloc(sizeof(struct stp_policy_node), GFP_KERNEL);
+        pdrv = policy->stm->pdrv;
+        policy_node =
+                kzalloc(offsetof(struct stp_policy_node, priv[pdrv->priv_sz]),
+                        GFP_KERNEL);
         if (!policy_node)
                 return ERR_PTR(-ENOMEM);
 
-        config_group_init_type_name(&policy_node->group, name,
-                                    &stp_policy_node_type);
+        if (pdrv->policy_node_init)
+                pdrv->policy_node_init((void *)policy_node->priv);
+
+        if (policy->stm->pdrv_node_type)
+                type = policy->stm->pdrv_node_type;
+
+        config_group_init_type_name(&policy_node->group, name, type);
 
         policy_node->policy = policy;
 
@@ -254,8 +306,25 @@ static ssize_t stp_policy_device_show(struct config_item *item,
 
 CONFIGFS_ATTR_RO(stp_policy_, device);
 
+static ssize_t stp_policy_protocol_show(struct config_item *item,
+                                        char *page)
+{
+        struct stp_policy *policy = to_stp_policy(item);
+        ssize_t count;
+
+        count = sprintf(page, "%s\n",
+                        (policy && policy->stm) ?
+                        policy->stm->pdrv->name :
+                        "<none>");
+
+        return count;
+}
+
+CONFIGFS_ATTR_RO(stp_policy_, protocol);
+
 static struct configfs_attribute *stp_policy_attrs[] = {
         &stp_policy_attr_device,
+        &stp_policy_attr_protocol,
         NULL,
 };
 
@@ -276,6 +345,7 @@ void stp_policy_unbind(struct stp_policy *policy)
         stm->policy = NULL;
         policy->stm = NULL;
 
+        stm_put_protocol(stm->pdrv);
         stm_put_device(stm);
 }
 
@@ -311,11 +381,14 @@ static const struct config_item_type stp_policy_type = {
 };
 
 static struct config_group *
-stp_policies_make(struct config_group *group, const char *name)
+stp_policy_make(struct config_group *group, const char *name)
 {
+        const struct config_item_type *pdrv_node_type;
+        const struct stm_protocol_driver *pdrv;
+        char *devname, *proto, *p;
         struct config_group *ret;
         struct stm_device *stm;
-        char *devname, *p;
+        int err;
 
         devname = kasprintf(GFP_KERNEL, "%s", name);
         if (!devname)
@@ -326,6 +399,7 @@ stp_policies_make(struct config_group *group, const char *name)
          * <device_name> is the name of an existing stm device; may
          *               contain dots;
          * <policy_name> is an arbitrary string; may not contain dots
+         * <device_name>:<protocol_name>.<policy_name>
          */
         p = strrchr(devname, '.');
         if (!p) {
@@ -335,11 +409,28 @@ stp_policies_make(struct config_group *group, const char *name)
 
         *p = '\0';
 
+        /*
+         * look for ":<protocol_name>":
+         *  + no protocol suffix: fall back to whatever is available;
+         *  + unknown protocol: fail the whole thing
+         */
+        proto = strrchr(devname, ':');
+        if (proto)
+                *proto++ = '\0';
+
         stm = stm_find_device(devname);
+        if (!stm) {
+                kfree(devname);
+                return ERR_PTR(-ENODEV);
+        }
+
+        err = stm_lookup_protocol(proto, &pdrv, &pdrv_node_type);
         kfree(devname);
 
-        if (!stm)
+        if (err) {
+                stm_put_device(stm);
                 return ERR_PTR(-ENODEV);
+        }
 
         mutex_lock(&stm->policy_mutex);
         if (stm->policy) {
@@ -349,31 +440,37 @@ stp_policies_make(struct config_group *group, const char *name)
 
         stm->policy = kzalloc(sizeof(*stm->policy), GFP_KERNEL);
         if (!stm->policy) {
-                ret = ERR_PTR(-ENOMEM);
-                goto unlock_policy;
+                mutex_unlock(&stm->policy_mutex);
+                stm_put_protocol(pdrv);
+                stm_put_device(stm);
+                return ERR_PTR(-ENOMEM);
         }
 
         config_group_init_type_name(&stm->policy->group, name,
                                     &stp_policy_type);
-        stm->policy->stm = stm;
 
+        stm->pdrv = pdrv;
+        stm->pdrv_node_type = pdrv_node_type;
+        stm->policy->stm = stm;
         ret = &stm->policy->group;
 
 unlock_policy:
         mutex_unlock(&stm->policy_mutex);
 
-        if (IS_ERR(ret))
+        if (IS_ERR(ret)) {
+                stm_put_protocol(stm->pdrv);
                 stm_put_device(stm);
+        }
 
         return ret;
 }
 
-static struct configfs_group_operations stp_policies_group_ops = {
-        .make_group     = stp_policies_make,
+static struct configfs_group_operations stp_policy_root_group_ops = {
+        .make_group     = stp_policy_make,
 };
 
-static const struct config_item_type stp_policies_type = {
-        .ct_group_ops   = &stp_policies_group_ops,
+static const struct config_item_type stp_policy_root_type = {
+        .ct_group_ops   = &stp_policy_root_group_ops,
         .ct_owner       = THIS_MODULE,
 };
 
@@ -381,7 +478,7 @@ static struct configfs_subsystem stp_policy_subsys = {
         .su_group = {
                 .cg_item = {
                         .ci_namebuf     = "stp-policy",
-                        .ci_type        = &stp_policies_type,
+                        .ci_type        = &stp_policy_root_type,
                 },
         },
 };
@@ -392,7 +489,7 @@ static struct configfs_subsystem stp_policy_subsys = {
 static struct stp_policy_node *
 __stp_policy_node_lookup(struct stp_policy *policy, char *s)
 {
-        struct stp_policy_node *policy_node, *ret;
+        struct stp_policy_node *policy_node, *ret = NULL;
         struct list_head *head = &policy->group.cg_children;
         struct config_item *item;
         char *start, *end = s;
@@ -400,10 +497,6 @@ __stp_policy_node_lookup(struct stp_policy *policy, char *s)
         if (list_empty(head))
                 return NULL;
 
-        /* return the first entry if everything else fails */
-        item = list_entry(head->next, struct config_item, ci_entry);
-        ret = to_stp_policy_node(item);
-
 next:
         for (;;) {
                 start = strsep(&end, "/");
@@ -449,25 +542,25 @@ stp_policy_node_lookup(struct stm_device *stm, char *s)
 
         if (policy_node)
                 config_item_get(&policy_node->group.cg_item);
-        mutex_unlock(&stp_policy_subsys.su_mutex);
+        else
+                mutex_unlock(&stp_policy_subsys.su_mutex);
 
         return policy_node;
 }
 
 void stp_policy_node_put(struct stp_policy_node *policy_node)
 {
+        lockdep_assert_held(&stp_policy_subsys.su_mutex);
+
+        mutex_unlock(&stp_policy_subsys.su_mutex);
         config_item_put(&policy_node->group.cg_item);
 }
 
 int __init stp_configfs_init(void)
 {
-        int err;
-
         config_group_init(&stp_policy_subsys.su_group);
         mutex_init(&stp_policy_subsys.su_mutex);
-        err = configfs_register_subsystem(&stp_policy_subsys);
-
-        return err;
+        return configfs_register_subsystem(&stp_policy_subsys);
 }
 
 void __exit stp_configfs_exit(void)
diff --git a/drivers/hwtracing/stm/stm.h b/drivers/hwtracing/stm/stm.h
index 923571adc6f4..3569439d53bb 100644
--- a/drivers/hwtracing/stm/stm.h
+++ b/drivers/hwtracing/stm/stm.h
@@ -10,20 +10,17 @@
 #ifndef _STM_STM_H_
 #define _STM_STM_H_
 
+#include <linux/configfs.h>
+
 struct stp_policy;
 struct stp_policy_node;
+struct stm_protocol_driver;
 
-struct stp_policy_node *
-stp_policy_node_lookup(struct stm_device *stm, char *s);
-void stp_policy_node_put(struct stp_policy_node *policy_node);
-void stp_policy_unbind(struct stp_policy *policy);
-
-void stp_policy_node_get_ranges(struct stp_policy_node *policy_node,
-                                unsigned int *mstart, unsigned int *mend,
-                                unsigned int *cstart, unsigned int *cend);
 int stp_configfs_init(void);
 void stp_configfs_exit(void);
 
+void *stp_policy_node_priv(struct stp_policy_node *pn);
+
 struct stp_master {
         unsigned int    nr_free;
         unsigned long   chan_map[0];
@@ -40,6 +37,9 @@ struct stm_device {
         struct mutex            link_mutex;
         spinlock_t              link_lock;
         struct list_head        link_list;
+        /* framing protocol in use */
+        const struct stm_protocol_driver        *pdrv;
+        const struct config_item_type           *pdrv_node_type;
         /* master allocation */
         spinlock_t              mc_lock;
         struct stp_master       *masters[0];
@@ -48,16 +48,28 @@ struct stm_device {
 #define to_stm_device(_d)                               \
         container_of((_d), struct stm_device, dev)
 
+struct stp_policy_node *
+stp_policy_node_lookup(struct stm_device *stm, char *s);
+void stp_policy_node_put(struct stp_policy_node *policy_node);
+void stp_policy_unbind(struct stp_policy *policy);
+
+void stp_policy_node_get_ranges(struct stp_policy_node *policy_node,
+                                unsigned int *mstart, unsigned int *mend,
+                                unsigned int *cstart, unsigned int *cend);
+
+const struct config_item_type *
+get_policy_node_type(struct configfs_attribute **attrs);
+
 struct stm_output {
         spinlock_t              lock;
         unsigned int            master;
         unsigned int            channel;
         unsigned int            nr_chans;
+        void                    *pdrv_private;
 };
 
 struct stm_file {
         struct stm_device       *stm;
-        struct stp_policy_node  *policy_node;
         struct stm_output       output;
 };
 
@@ -71,11 +83,35 @@ struct stm_source_device {
         struct stm_device __rcu *link;
         struct list_head        link_entry;
         /* one output per stm_source device */
-        struct stp_policy_node  *policy_node;
         struct stm_output       output;
 };
 
 #define to_stm_source_device(_d)                                \
         container_of((_d), struct stm_source_device, dev)
 
+void *to_pdrv_policy_node(struct config_item *item);
+
+struct stm_protocol_driver {
+        struct module   *owner;
+        const char      *name;
+        ssize_t         (*write)(struct stm_data *data,
+                                 struct stm_output *output, unsigned int chan,
+                                 const char *buf, size_t count);
+        void            (*policy_node_init)(void *arg);
+        int             (*output_open)(void *priv, struct stm_output *output);
+        void            (*output_close)(struct stm_output *output);
+        ssize_t         priv_sz;
+        struct configfs_attribute       **policy_attr;
+};
+
+int stm_register_protocol(const struct stm_protocol_driver *pdrv);
+void stm_unregister_protocol(const struct stm_protocol_driver *pdrv);
+int stm_lookup_protocol(const char *name,
+                        const struct stm_protocol_driver **pdrv,
+                        const struct config_item_type **type);
+void stm_put_protocol(const struct stm_protocol_driver *pdrv);
+ssize_t stm_data_write(struct stm_data *data, unsigned int m,
+                       unsigned int c, bool ts_first, const void *buf,
+                       size_t count);
+
 #endif /* _STM_STM_H_ */
diff --git a/drivers/misc/ad525x_dpot-i2c.c b/drivers/misc/ad525x_dpot-i2c.c
index 4f832002d116..1827c69959fb 100644
--- a/drivers/misc/ad525x_dpot-i2c.c
+++ b/drivers/misc/ad525x_dpot-i2c.c
@@ -114,6 +114,6 @@ static struct i2c_driver ad_dpot_i2c_driver = {
 
 module_i2c_driver(ad_dpot_i2c_driver);
 
-MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_AUTHOR("Michael Hennerich <michael.hennerich@analog.com>");
 MODULE_DESCRIPTION("digital potentiometer I2C bus driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/misc/ad525x_dpot-spi.c b/drivers/misc/ad525x_dpot-spi.c
index 39a7f517ee7e..0383ec153725 100644
--- a/drivers/misc/ad525x_dpot-spi.c
+++ b/drivers/misc/ad525x_dpot-spi.c
@@ -140,7 +140,7 @@ static struct spi_driver ad_dpot_spi_driver = {
 
 module_spi_driver(ad_dpot_spi_driver);
 
-MODULE_AUTHOR("Michael Hennerich <hennerich@blackfin.uclinux.org>");
+MODULE_AUTHOR("Michael Hennerich <michael.hennerich@analog.com>");
 MODULE_DESCRIPTION("digital potentiometer SPI bus driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("spi:ad_dpot");
diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
index bc591b7168db..a0afadefcc49 100644
--- a/drivers/misc/ad525x_dpot.c
+++ b/drivers/misc/ad525x_dpot.c
@@ -1,7 +1,7 @@
 /*
  * ad525x_dpot: Driver for the Analog Devices digital potentiometers
  * Copyright (c) 2009-2010 Analog Devices, Inc.
- * Author: Michael Hennerich <hennerich@blackfin.uclinux.org>
+ * Author: Michael Hennerich <michael.hennerich@analog.com>
  *
  * DEVID                #Wipers         #Positions      Resistor Options (kOhm)
  * AD5258               1               64              1, 10, 50, 100
@@ -64,7 +64,7 @@
  * Author: Chris Verges <chrisv@cyberswitching.com>
  *
  * derived from ad5252.c
- * Copyright (c) 2006-2011 Michael Hennerich <hennerich@blackfin.uclinux.org>
+ * Copyright (c) 2006-2011 Michael Hennerich <michael.hennerich@analog.com>
  *
  * Licensed under the GPL-2 or later.
  */
@@ -760,6 +760,6 @@ EXPORT_SYMBOL(ad_dpot_remove);
 
 
 MODULE_AUTHOR("Chris Verges <chrisv@cyberswitching.com>, "
-              "Michael Hennerich <hennerich@blackfin.uclinux.org>");
+              "Michael Hennerich <michael.hennerich@analog.com>");
 MODULE_DESCRIPTION("Digital potentiometer driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/misc/apds990x.c b/drivers/misc/apds990x.c
index ed9412d750b7..24876c615c3c 100644
--- a/drivers/misc/apds990x.c
+++ b/drivers/misc/apds990x.c
@@ -188,7 +188,6 @@ struct apds990x_chip {
 #define APDS_LUX_DEFAULT_RATE           200
 
 static const u8 again[] = {1, 8, 16, 120}; /* ALS gain steps */
-static const u8 ir_currents[]   = {100, 50, 25, 12}; /* IRled currents in mA */
 
 /* Following two tables must match i.e 10Hz rate means 1 as persistence value */
 static const u16 arates_hz[] = {10, 5, 2, 1};
diff --git a/drivers/misc/bh1770glc.c b/drivers/misc/bh1770glc.c
index 9c62bf064f77..17e81ce9925b 100644
--- a/drivers/misc/bh1770glc.c
+++ b/drivers/misc/bh1770glc.c
@@ -180,9 +180,6 @@ static const char reg_vleds[] = "Vleds";
 static const s16 prox_rates_hz[] = {100, 50, 33, 25, 14, 10, 5, 2};
 static const s16 prox_rates_ms[] = {10, 20, 30, 40, 70, 100, 200, 500};
 
-/* Supported IR-led currents in mA */
-static const u8 prox_curr_ma[] = {5, 10, 20, 50, 100, 150, 200};
-
 /*
  * Supported stand alone rates in ms from chip data sheet
  * {100, 200, 500, 1000, 2000};
diff --git a/drivers/misc/cxl/flash.c b/drivers/misc/cxl/flash.c
index 43917898fb9a..4d6836f19489 100644
--- a/drivers/misc/cxl/flash.c
+++ b/drivers/misc/cxl/flash.c
@@ -92,8 +92,8 @@ static int update_property(struct device_node *dn, const char *name,
 
         val = (u32 *)new_prop->value;
         rc = cxl_update_properties(dn, new_prop);
-        pr_devel("%s: update property (%s, length: %i, value: %#x)\n",
-                  dn->name, name, vd, be32_to_cpu(*val));
+        pr_devel("%pOFn: update property (%s, length: %i, value: %#x)\n",
+                  dn, name, vd, be32_to_cpu(*val));
 
         if (rc) {
                 kfree(new_prop->name);
diff --git a/drivers/misc/cxl/guest.c b/drivers/misc/cxl/guest.c
index 3bc0c15d4d85..5d28d9e454f5 100644
--- a/drivers/misc/cxl/guest.c
+++ b/drivers/misc/cxl/guest.c
@@ -1018,8 +1018,6 @@ err1:
 
 void cxl_guest_remove_afu(struct cxl_afu *afu)
 {
-        pr_devel("in %s - AFU(%d)\n", __func__, afu->slice);
-
         if (!afu)
                 return;
 
diff --git a/drivers/misc/echo/echo.c b/drivers/misc/echo/echo.c
index 8a5adc0d2e88..3ebe5d75ad6a 100644
--- a/drivers/misc/echo/echo.c
+++ b/drivers/misc/echo/echo.c
@@ -381,7 +381,7 @@ int16_t oslec_update(struct oslec_state *ec, int16_t tx, int16_t rx)
          */
         ec->factor = 0;
         ec->shift = 0;
-        if ((ec->nonupdate_dwell == 0)) {
+        if (!ec->nonupdate_dwell) {
                 int p, logp, shift;
 
                 /* Determine:
diff --git a/drivers/misc/eeprom/Kconfig b/drivers/misc/eeprom/Kconfig
index 68a1ac929917..fe7a1d27a017 100644
--- a/drivers/misc/eeprom/Kconfig
+++ b/drivers/misc/eeprom/Kconfig
@@ -111,4 +111,15 @@ config EEPROM_IDT_89HPESX
           This driver can also be built as a module. If so, the module
           will be called idt_89hpesx.
 
+config EEPROM_EE1004
+        tristate "SPD EEPROMs on DDR4 memory modules"
+        depends on I2C && SYSFS
+        help
+          Enable this driver to get read support to SPD EEPROMs following
+          the JEDEC EE1004 standard. These are typically found on DDR4
+          SDRAM memory modules.
+
+          This driver can also be built as a module.  If so, the module
+          will be called ee1004.
+
 endmenu
diff --git a/drivers/misc/eeprom/Makefile b/drivers/misc/eeprom/Makefile
index 2aab60ef3e3e..a9b4b6579b75 100644
--- a/drivers/misc/eeprom/Makefile
+++ b/drivers/misc/eeprom/Makefile
@@ -7,3 +7,4 @@ obj-$(CONFIG_EEPROM_93CX6)	+= eeprom_93cx6.o
 obj-$(CONFIG_EEPROM_93XX46)     += eeprom_93xx46.o
 obj-$(CONFIG_EEPROM_DIGSY_MTC_CFG) += digsy_mtc_eeprom.o
 obj-$(CONFIG_EEPROM_IDT_89HPESX) += idt_89hpesx.o
+obj-$(CONFIG_EEPROM_EE1004)     += ee1004.o
diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c
index 840afb398f9e..99de6939cd5a 100644
--- a/drivers/misc/eeprom/at25.c
+++ b/drivers/misc/eeprom/at25.c
@@ -366,7 +366,7 @@ static int at25_probe(struct spi_device *spi)
         at25->nvmem_config.word_size = 1;
         at25->nvmem_config.size = chip.byte_len;
 
-        at25->nvmem = nvmem_register(&at25->nvmem_config);
+        at25->nvmem = devm_nvmem_register(&spi->dev, &at25->nvmem_config);
         if (IS_ERR(at25->nvmem))
                 return PTR_ERR(at25->nvmem);
 
@@ -379,16 +379,6 @@ static int at25_probe(struct spi_device *spi)
         return 0;
 }
 
-static int at25_remove(struct spi_device *spi)
-{
-        struct at25_data        *at25;
-
-        at25 = spi_get_drvdata(spi);
-        nvmem_unregister(at25->nvmem);
-
-        return 0;
-}
-
 /*-------------------------------------------------------------------------*/
 
 static const struct of_device_id at25_of_match[] = {
@@ -403,7 +393,6 @@ static struct spi_driver at25_driver = {
                 .of_match_table = at25_of_match,
         },
         .probe          = at25_probe,
-        .remove         = at25_remove,
 };
 
 module_spi_driver(at25_driver);
diff --git a/drivers/misc/eeprom/ee1004.c b/drivers/misc/eeprom/ee1004.c
new file mode 100644
index 000000000000..276c1690ea1b
--- /dev/null
+++ b/drivers/misc/eeprom/ee1004.c
@@ -0,0 +1,281 @@
+/*
+ * ee1004 - driver for DDR4 SPD EEPROMs
+ *
+ * Copyright (C) 2017 Jean Delvare
+ *
+ * Based on the at24 driver:
+ * Copyright (C) 2005-2007 David Brownell
+ * Copyright (C) 2008 Wolfram Sang, Pengutronix
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/i2c.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/mutex.h>
+
+/*
+ * DDR4 memory modules use special EEPROMs following the Jedec EE1004
+ * specification. These are 512-byte EEPROMs using a single I2C address
+ * in the 0x50-0x57 range for data. One of two 256-byte page is selected
+ * by writing a command to I2C address 0x36 or 0x37 on the same I2C bus.
+ *
+ * Therefore we need to request these 2 additional addresses, and serialize
+ * access to all such EEPROMs with a single mutex.
+ *
+ * We assume it is safe to read up to 32 bytes at once from these EEPROMs.
+ * We use SMBus access even if I2C is available, these EEPROMs are small
+ * enough, and reading from them infrequent enough, that we favor simplicity
+ * over performance.
+ */
+
+#define EE1004_ADDR_SET_PAGE            0x36
+#define EE1004_EEPROM_SIZE              512
+#define EE1004_PAGE_SIZE                256
+#define EE1004_PAGE_SHIFT               8
+
+/*
+ * Mutex protects ee1004_set_page and ee1004_dev_count, and must be held
+ * from page selection to end of read.
+ */
+static DEFINE_MUTEX(ee1004_bus_lock);
+static struct i2c_client *ee1004_set_page[2];
+static unsigned int ee1004_dev_count;
+static int ee1004_current_page;
+
+static const struct i2c_device_id ee1004_ids[] = {
+        { "ee1004", 0 },
+        { }
+};
+MODULE_DEVICE_TABLE(i2c, ee1004_ids);
+
+/*-------------------------------------------------------------------------*/
+
+static ssize_t ee1004_eeprom_read(struct i2c_client *client, char *buf,
+                                  unsigned int offset, size_t count)
+{
+        int status;
+
+        if (count > I2C_SMBUS_BLOCK_MAX)
+                count = I2C_SMBUS_BLOCK_MAX;
+        /* Can't cross page boundaries */
+        if (unlikely(offset + count > EE1004_PAGE_SIZE))
+                count = EE1004_PAGE_SIZE - offset;
+
+        status = i2c_smbus_read_i2c_block_data_or_emulated(client, offset,
+                                                           count, buf);
+        dev_dbg(&client->dev, "read %zu@%d --> %d\n", count, offset, status);
+
+        return status;
+}
+
+static ssize_t ee1004_read(struct file *filp, struct kobject *kobj,
+                           struct bin_attribute *bin_attr,
+                           char *buf, loff_t off, size_t count)
+{
+        struct device *dev = kobj_to_dev(kobj);
+        struct i2c_client *client = to_i2c_client(dev);
+        size_t requested = count;
+        int page;
+
+        if (unlikely(!count))
+                return count;
+
+        page = off >> EE1004_PAGE_SHIFT;
+        if (unlikely(page > 1))
+                return 0;
+        off &= (1 << EE1004_PAGE_SHIFT) - 1;
+
+        /*
+         * Read data from chip, protecting against concurrent access to
+         * other EE1004 SPD EEPROMs on the same adapter.
+         */
+        mutex_lock(&ee1004_bus_lock);
+
+        while (count) {
+                int status;
+
+                /* Select page */
+                if (page != ee1004_current_page) {
+                        /* Data is ignored */
+                        status = i2c_smbus_write_byte(ee1004_set_page[page],
+                                                      0x00);
+                        if (status < 0) {
+                                dev_err(dev, "Failed to select page %d (%d)\n",
+                                        page, status);
+                                mutex_unlock(&ee1004_bus_lock);
+                                return status;
+                        }
+                        dev_dbg(dev, "Selected page %d\n", page);
+                        ee1004_current_page = page;
+                }
+
+                status = ee1004_eeprom_read(client, buf, off, count);
+                if (status < 0) {
+                        mutex_unlock(&ee1004_bus_lock);
+                        return status;
+                }
+                buf += status;
+                off += status;
+                count -= status;
+
+                if (off == EE1004_PAGE_SIZE) {
+                        page++;
+                        off = 0;
+                }
+        }
+
+        mutex_unlock(&ee1004_bus_lock);
+
+        return requested;
+}
+
+static const struct bin_attribute eeprom_attr = {
+        .attr = {
+                .name = "eeprom",
+                .mode = 0444,
+        },
+        .size = EE1004_EEPROM_SIZE,
+        .read = ee1004_read,
+};
+
+static int ee1004_probe(struct i2c_client *client,
+                        const struct i2c_device_id *id)
+{
+        int err, cnr = 0;
+        const char *slow = NULL;
+
+        /* Make sure we can operate on this adapter */
+        if (!i2c_check_functionality(client->adapter,
+                                     I2C_FUNC_SMBUS_READ_BYTE |
+                                     I2C_FUNC_SMBUS_READ_I2C_BLOCK)) {
+                if (i2c_check_functionality(client->adapter,
+                                     I2C_FUNC_SMBUS_READ_BYTE |
+                                     I2C_FUNC_SMBUS_READ_WORD_DATA))
+                        slow = "word";
+                else if (i2c_check_functionality(client->adapter,
+                                     I2C_FUNC_SMBUS_READ_BYTE |
+                                     I2C_FUNC_SMBUS_READ_BYTE_DATA))
+                        slow = "byte";
+                else
+                        return -EPFNOSUPPORT;
+        }
+
+        /* Use 2 dummy devices for page select command */
+        mutex_lock(&ee1004_bus_lock);
+        if (++ee1004_dev_count == 1) {
+                for (cnr = 0; cnr < 2; cnr++) {
+                        ee1004_set_page[cnr] = i2c_new_dummy(client->adapter,
+                                                EE1004_ADDR_SET_PAGE + cnr);
+                        if (!ee1004_set_page[cnr]) {
+                                dev_err(&client->dev,
+                                        "address 0x%02x unavailable\n",
+                                        EE1004_ADDR_SET_PAGE + cnr);
+                                err = -EADDRINUSE;
+                                goto err_clients;
+                        }
+                }
+        } else if (i2c_adapter_id(client->adapter) !=
+                   i2c_adapter_id(ee1004_set_page[0]->adapter)) {
+                dev_err(&client->dev,
+                        "Driver only supports devices on a single I2C bus\n");
+                err = -EOPNOTSUPP;
+                goto err_clients;
+        }
+
+        /* Remember current page to avoid unneeded page select */
+        err = i2c_smbus_read_byte(ee1004_set_page[0]);
+        if (err == -ENXIO) {
+                /* Nack means page 1 is selected */
+                ee1004_current_page = 1;
+        } else if (err < 0) {
+                /* Anything else is a real error, bail out */
+                goto err_clients;
+        } else {
+                /* Ack means page 0 is selected, returned value meaningless */
+                ee1004_current_page = 0;
+        }
+        dev_dbg(&client->dev, "Currently selected page: %d\n",
+                ee1004_current_page);
+        mutex_unlock(&ee1004_bus_lock);
+
+        /* Create the sysfs eeprom file */
+        err = sysfs_create_bin_file(&client->dev.kobj, &eeprom_attr);
+        if (err)
+                goto err_clients_lock;
+
+        dev_info(&client->dev,
+                 "%u byte EE1004-compliant SPD EEPROM, read-only\n",
+                 EE1004_EEPROM_SIZE);
+        if (slow)
+                dev_notice(&client->dev,
+                           "Falling back to %s reads, performance will suffer\n",
+                           slow);
+
+        return 0;
+
+ err_clients_lock:
+        mutex_lock(&ee1004_bus_lock);
+ err_clients:
+        if (--ee1004_dev_count == 0) {
+                for (cnr--; cnr >= 0; cnr--) {
+                        i2c_unregister_device(ee1004_set_page[cnr]);
+                        ee1004_set_page[cnr] = NULL;
+                }
+        }
+        mutex_unlock(&ee1004_bus_lock);
+
+        return err;
+}
+
+static int ee1004_remove(struct i2c_client *client)
+{
+        int i;
+
+        sysfs_remove_bin_file(&client->dev.kobj, &eeprom_attr);
+
+        /* Remove page select clients if this is the last device */
+        mutex_lock(&ee1004_bus_lock);
+        if (--ee1004_dev_count == 0) {
+                for (i = 0; i < 2; i++) {
+                        i2c_unregister_device(ee1004_set_page[i]);
+                        ee1004_set_page[i] = NULL;
+                }
+        }
+        mutex_unlock(&ee1004_bus_lock);
+
+        return 0;
+}
+
+/*-------------------------------------------------------------------------*/
+
+static struct i2c_driver ee1004_driver = {
+        .driver = {
+                .name = "ee1004",
+        },
+        .probe = ee1004_probe,
+        .remove = ee1004_remove,
+        .id_table = ee1004_ids,
+};
+
+static int __init ee1004_init(void)
+{
+        return i2c_add_driver(&ee1004_driver);
+}
+module_init(ee1004_init);
+
+static void __exit ee1004_exit(void)
+{
+        i2c_del_driver(&ee1004_driver);
+}
+module_exit(ee1004_exit);
+
+MODULE_DESCRIPTION("Driver for EE1004-compliant DDR4 SPD EEPROMs");
+MODULE_AUTHOR("Jean Delvare");
+MODULE_LICENSE("GPL");
diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
index 38766968bfa2..c6dd9ad9bf7b 100644
--- a/drivers/misc/eeprom/eeprom_93xx46.c
+++ b/drivers/misc/eeprom/eeprom_93xx46.c
@@ -439,7 +439,7 @@ static int eeprom_93xx46_probe(struct spi_device *spi)
                 return -ENODEV;
         }
 
-        edev = kzalloc(sizeof(*edev), GFP_KERNEL);
+        edev = devm_kzalloc(&spi->dev, sizeof(*edev), GFP_KERNEL);
         if (!edev)
                 return -ENOMEM;
 
@@ -449,8 +449,7 @@ static int eeprom_93xx46_probe(struct spi_device *spi)
                 edev->addrlen = 6;
         else {
                 dev_err(&spi->dev, "unspecified address type\n");
-                err = -EINVAL;
-                goto fail;
+                return -EINVAL;
         }
 
         mutex_init(&edev->lock);
@@ -473,11 +472,9 @@ static int eeprom_93xx46_probe(struct spi_device *spi)
         edev->nvmem_config.word_size = 1;
         edev->nvmem_config.size = edev->size;
 
-        edev->nvmem = nvmem_register(&edev->nvmem_config);
-        if (IS_ERR(edev->nvmem)) {
-                err = PTR_ERR(edev->nvmem);
-                goto fail;
-        }
+        edev->nvmem = devm_nvmem_register(&spi->dev, &edev->nvmem_config);
+        if (IS_ERR(edev->nvmem))
+                return PTR_ERR(edev->nvmem);
 
         dev_info(&spi->dev, "%d-bit eeprom %s\n",
                 (pd->flags & EE_ADDR8) ? 8 : 16,
@@ -490,21 +487,15 @@ static int eeprom_93xx46_probe(struct spi_device *spi)
 
         spi_set_drvdata(spi, edev);
         return 0;
-fail:
-        kfree(edev);
-        return err;
 }
 
 static int eeprom_93xx46_remove(struct spi_device *spi)
 {
         struct eeprom_93xx46_dev *edev = spi_get_drvdata(spi);
 
-        nvmem_unregister(edev->nvmem);
-
         if (!(edev->pdata->flags & EE_READONLY))
                 device_remove_file(&spi->dev, &dev_attr_erase);
 
-        kfree(edev);
         return 0;
 }
 
diff --git a/drivers/misc/genwqe/card_base.c b/drivers/misc/genwqe/card_base.c
index c7cd3675bcd1..d137d0fab9bf 100644
--- a/drivers/misc/genwqe/card_base.c
+++ b/drivers/misc/genwqe/card_base.c
@@ -24,7 +24,6 @@
  * controlled from here.
  */
 
-#include <linux/module.h>
 #include <linux/types.h>
 #include <linux/pci.h>
 #include <linux/err.h>
diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
index 656449cb4476..9a65bd9d6152 100644
--- a/drivers/misc/genwqe/card_ddcb.c
+++ b/drivers/misc/genwqe/card_ddcb.c
@@ -27,7 +27,6 @@
  */
 
 #include <linux/types.h>
-#include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/pci.h>
diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
index 8679e0bd8ec2..3fcb9a2fe1c9 100644
--- a/drivers/misc/genwqe/card_utils.c
+++ b/drivers/misc/genwqe/card_utils.c
@@ -23,14 +23,12 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/dma-mapping.h>
 #include <linux/sched.h>
 #include <linux/vmalloc.h>
 #include <linux/page-flags.h>
 #include <linux/scatterlist.h>
 #include <linux/hugetlb.h>
 #include <linux/iommu.h>
-#include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/ctype.h>
@@ -298,7 +296,7 @@ static int genwqe_sgl_size(int num_pages)
 int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
                           void __user *user_addr, size_t user_size, int write)
 {
-        int rc;
+        int ret = -ENOMEM;
         struct pci_dev *pci_dev = cd->pci_dev;
 
         sgl->fpage_offs = offset_in_page((unsigned long)user_addr);
@@ -318,7 +316,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
         if (get_order(sgl->sgl_size) > MAX_ORDER) {
                 dev_err(&pci_dev->dev,
                         "[%s] err: too much memory requested!\n", __func__);
-                return -ENOMEM;
+                return ret;
         }
 
         sgl->sgl = __genwqe_alloc_consistent(cd, sgl->sgl_size,
@@ -326,7 +324,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
         if (sgl->sgl == NULL) {
                 dev_err(&pci_dev->dev,
                         "[%s] err: no memory available!\n", __func__);
-                return -ENOMEM;
+                return ret;
         }
 
         /* Only use buffering on incomplete pages */
@@ -339,7 +337,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
                 /* Sync with user memory */
                 if (copy_from_user(sgl->fpage + sgl->fpage_offs,
                                    user_addr, sgl->fpage_size)) {
-                        rc = -EFAULT;
+                        ret = -EFAULT;
                         goto err_out;
                 }
         }
@@ -352,7 +350,7 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
                 /* Sync with user memory */
                 if (copy_from_user(sgl->lpage, user_addr + user_size -
                                    sgl->lpage_size, sgl->lpage_size)) {
-                        rc = -EFAULT;
+                        ret = -EFAULT;
                         goto err_out2;
                 }
         }
@@ -374,7 +372,8 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
         sgl->sgl = NULL;
         sgl->sgl_dma_addr = 0;
         sgl->sgl_size = 0;
-        return -ENOMEM;
+
+        return ret;
 }
 
 int genwqe_setup_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c
index 6193270e7b3d..de20bdaa148d 100644
--- a/drivers/misc/kgdbts.c
+++ b/drivers/misc/kgdbts.c
@@ -985,6 +985,12 @@ static void kgdbts_run_tests(void)
         int nmi_sleep = 0;
         int i;
 
+        verbose = 0;
+        if (strstr(config, "V1"))
+                verbose = 1;
+        if (strstr(config, "V2"))
+                verbose = 2;
+
         ptr = strchr(config, 'F');
         if (ptr)
                 fork_test = simple_strtol(ptr + 1, NULL, 10);
@@ -1068,13 +1074,6 @@ static int kgdbts_option_setup(char *opt)
                 return -ENOSPC;
         }
         strcpy(config, opt);
-
-        verbose = 0;
-        if (strstr(config, "V1"))
-                verbose = 1;
-        if (strstr(config, "V2"))
-                verbose = 2;
-
         return 0;
 }
 
@@ -1086,9 +1085,6 @@ static int configure_kgdbts(void)
 
         if (!strlen(config) || isspace(config[0]))
                 goto noconfig;
-        err = kgdbts_option_setup(config);
-        if (err)
-                goto noconfig;
 
         final_ack = 0;
         run_plant_and_detach_test(1);
diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
index 389475b25bb7..d5a0e7f1813b 100644
--- a/drivers/misc/lkdtm/usercopy.c
+++ b/drivers/misc/lkdtm/usercopy.c
@@ -18,7 +18,7 @@
  * hardened usercopy checks by added "unconst" to all the const copies,
  * and making sure "cache_size" isn't optimized into a const.
  */
-static volatile size_t unconst = 0;
+static volatile size_t unconst;
 static volatile size_t cache_size = 1024;
 static struct kmem_cache *whitelist_cache;
 
diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c
index a6f41f96f2a1..80215c312f0e 100644
--- a/drivers/misc/mei/bus-fixup.c
+++ b/drivers/misc/mei/bus-fixup.c
@@ -17,7 +17,6 @@
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/module.h>
-#include <linux/moduleparam.h>
 #include <linux/device.h>
 #include <linux/slab.h>
 #include <linux/uuid.h>
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 4d77a6ae183a..87281b3695e6 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -599,10 +599,10 @@ static __poll_t mei_poll(struct file *file, poll_table *wait)
                         mei_cl_read_start(cl, mei_cl_mtu(cl), file);
         }
 
-        if (req_events & (POLLOUT | POLLWRNORM)) {
+        if (req_events & (EPOLLOUT | EPOLLWRNORM)) {
                 poll_wait(file, &cl->tx_wait, wait);
                 if (cl->tx_cb_queued < dev->tx_queue_limit)
-                        mask |= POLLOUT | POLLWRNORM;
+                        mask |= EPOLLOUT | EPOLLWRNORM;
         }
 
 out:
diff --git a/drivers/misc/mic/scif/scif_dma.c b/drivers/misc/mic/scif/scif_dma.c
index 6369aeaa7056..18b8ed57c4ac 100644
--- a/drivers/misc/mic/scif/scif_dma.c
+++ b/drivers/misc/mic/scif/scif_dma.c
@@ -1035,8 +1035,6 @@ scif_rma_list_dma_copy_unaligned(struct scif_copy_work *work,
                         }
                         dma_async_issue_pending(chan);
                 }
-                if (ret < 0)
-                        goto err;
                 offset += loop_len;
                 temp += loop_len;
                 temp_phys += loop_len;
@@ -1553,9 +1551,8 @@ static int scif_rma_list_dma_copy_wrapper(struct scif_endpt *epd,
         int src_cache_off, dst_cache_off;
         s64 src_offset = work->src_offset, dst_offset = work->dst_offset;
         u8 *temp = NULL;
-        bool src_local = true, dst_local = false;
+        bool src_local = true;
         struct scif_dma_comp_cb *comp_cb;
-        dma_addr_t src_dma_addr, dst_dma_addr;
         int err;
 
         if (is_dma_copy_aligned(chan->device, 1, 1, 1))
@@ -1569,12 +1566,8 @@ static int scif_rma_list_dma_copy_wrapper(struct scif_endpt *epd,
 
         if (work->loopback)
                 return scif_rma_list_cpu_copy(work);
-        src_dma_addr = __scif_off_to_dma_addr(work->src_window, src_offset);
-        dst_dma_addr = __scif_off_to_dma_addr(work->dst_window, dst_offset);
         src_local = work->src_window->type == SCIF_WINDOW_SELF;
-        dst_local = work->dst_window->type == SCIF_WINDOW_SELF;
 
-        dst_local = dst_local;
         /* Allocate dma_completion cb */
         comp_cb = kzalloc(sizeof(*comp_cb), GFP_KERNEL);
         if (!comp_cb)
diff --git a/drivers/misc/mic/scif/scif_fence.c b/drivers/misc/mic/scif/scif_fence.c
index cac3bcc308a7..7bb929f05d85 100644
--- a/drivers/misc/mic/scif/scif_fence.c
+++ b/drivers/misc/mic/scif/scif_fence.c
@@ -272,7 +272,7 @@ static int _scif_prog_signal(scif_epd_t epd, dma_addr_t dst, u64 val)
 dma_fail:
         if (!x100)
                 dma_pool_free(ep->remote_dev->signal_pool, status,
-                              status->src_dma_addr);
+                              src - offsetof(struct scif_status, val));
 alloc_fail:
         return err;
 }
diff --git a/drivers/misc/sgi-gru/grukservices.c b/drivers/misc/sgi-gru/grukservices.c
index 030769018461..4b23d586fc3f 100644
--- a/drivers/misc/sgi-gru/grukservices.c
+++ b/drivers/misc/sgi-gru/grukservices.c
@@ -634,7 +634,7 @@ static int send_noop_message(void *cb, struct gru_message_queue_desc *mqd,
                         break;
                 case CBSS_PAGE_OVERFLOW:
                         STAT(mesq_noop_page_overflow);
-                        /* fallthru */
+                        /* fall through */
                 default:
                         BUG();
                 }
@@ -792,7 +792,7 @@ static int send_message_failure(void *cb, struct gru_message_queue_desc *mqd,
                 break;
         case CBSS_PAGE_OVERFLOW:
                 STAT(mesq_page_overflow);
-                /* fallthru */
+                /* fall through */
         default:
                 BUG();
         }
diff --git a/drivers/misc/sgi-xp/xpc_channel.c b/drivers/misc/sgi-xp/xpc_channel.c
index 05a890ce2ab8..8e6607fc8a67 100644
--- a/drivers/misc/sgi-xp/xpc_channel.c
+++ b/drivers/misc/sgi-xp/xpc_channel.c
@@ -28,7 +28,7 @@ xpc_process_connect(struct xpc_channel *ch, unsigned long *irq_flags)
 {
         enum xp_retval ret;
 
-        DBUG_ON(!spin_is_locked(&ch->lock));
+        lockdep_assert_held(&ch->lock);
 
         if (!(ch->flags & XPC_C_OPENREQUEST) ||
             !(ch->flags & XPC_C_ROPENREQUEST)) {
@@ -82,7 +82,7 @@ xpc_process_disconnect(struct xpc_channel *ch, unsigned long *irq_flags)
         struct xpc_partition *part = &xpc_partitions[ch->partid];
         u32 channel_was_connected = (ch->flags & XPC_C_WASCONNECTED);
 
-        DBUG_ON(!spin_is_locked(&ch->lock));
+        lockdep_assert_held(&ch->lock);
 
         if (!(ch->flags & XPC_C_DISCONNECTING))
                 return;
@@ -755,7 +755,7 @@ xpc_disconnect_channel(const int line, struct xpc_channel *ch,
 {
         u32 channel_was_connected = (ch->flags & XPC_C_CONNECTED);
 
-        DBUG_ON(!spin_is_locked(&ch->lock));
+        lockdep_assert_held(&ch->lock);
 
         if (ch->flags & (XPC_C_DISCONNECTING | XPC_C_DISCONNECTED))
                 return;
diff --git a/drivers/misc/sgi-xp/xpc_partition.c b/drivers/misc/sgi-xp/xpc_partition.c
index 0c3ef6f1df54..3eba1c420cc0 100644
--- a/drivers/misc/sgi-xp/xpc_partition.c
+++ b/drivers/misc/sgi-xp/xpc_partition.c
@@ -98,8 +98,7 @@ xpc_get_rsvd_page_pa(int nasid)
                         len = L1_CACHE_ALIGN(len);
 
                 if (len > buf_len) {
-                        if (buf_base != NULL)
-                                kfree(buf_base);
+                        kfree(buf_base);
                         buf_len = L1_CACHE_ALIGN(len);
                         buf = xpc_kmalloc_cacheline_aligned(buf_len, GFP_KERNEL,
                                                             &buf_base);
diff --git a/drivers/misc/sgi-xp/xpc_sn2.c b/drivers/misc/sgi-xp/xpc_sn2.c
index 5a12d2a54049..0ae69b9390ce 100644
--- a/drivers/misc/sgi-xp/xpc_sn2.c
+++ b/drivers/misc/sgi-xp/xpc_sn2.c
@@ -1671,7 +1671,7 @@ xpc_teardown_msg_structures_sn2(struct xpc_channel *ch)
 {
         struct xpc_channel_sn2 *ch_sn2 = &ch->sn.sn2;
 
-        DBUG_ON(!spin_is_locked(&ch->lock));
+        lockdep_assert_held(&ch->lock);
 
         ch_sn2->remote_msgqueue_pa = 0;
 
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index 340b44d9e8cf..0441abe87880 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -1183,7 +1183,7 @@ xpc_teardown_msg_structures_uv(struct xpc_channel *ch)
 {
         struct xpc_channel_uv *ch_uv = &ch->sn.uv;
 
-        DBUG_ON(!spin_is_locked(&ch->lock));
+        lockdep_assert_held(&ch->lock);
 
         kfree(ch_uv->cached_notify_gru_mq_desc);
         ch_uv->cached_notify_gru_mq_desc = NULL;
diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
index 74b183baf044..80d8cbe8c01a 100644
--- a/drivers/misc/sram.c
+++ b/drivers/misc/sram.c
@@ -323,10 +323,8 @@ static int sram_reserve_regions(struct sram_dev *sram, struct resource *res)
                 cur_start = block->start + block->size;
         }
 
- err_chunks:
-        if (child)
-                of_node_put(child);
-
+err_chunks:
+        of_node_put(child);
         kfree(rblocks);
 
         return ret;
diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
index 2543ef1ece17..9b0b3fa4f836 100644
--- a/drivers/misc/vmw_balloon.c
+++ b/drivers/misc/vmw_balloon.c
@@ -25,6 +25,9 @@
 #include <linux/workqueue.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/rwsem.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
 #include <linux/vmw_vmci_defs.h>
 #include <linux/vmw_vmci_api.h>
 #include <asm/hypervisor.h>
@@ -37,20 +40,20 @@ MODULE_ALIAS("vmware_vmmemctl");
 MODULE_LICENSE("GPL");
 
 /*
- * Use __GFP_HIGHMEM to allow pages from HIGHMEM zone. We don't
- * allow wait (__GFP_RECLAIM) for NOSLEEP page allocations. Use
- * __GFP_NOWARN, to suppress page allocation failure warnings.
+ * Use __GFP_HIGHMEM to allow pages from HIGHMEM zone. We don't allow wait
+ * (__GFP_RECLAIM) for huge page allocations. Use __GFP_NOWARN, to suppress page
+ * allocation failure warnings. Disallow access to emergency low-memory pools.
  */
-#define VMW_PAGE_ALLOC_NOSLEEP          (__GFP_HIGHMEM|__GFP_NOWARN)
+#define VMW_HUGE_PAGE_ALLOC_FLAGS       (__GFP_HIGHMEM|__GFP_NOWARN|    \
+                                         __GFP_NOMEMALLOC)
 
 /*
- * Use GFP_HIGHUSER when executing in a separate kernel thread
- * context and allocation can sleep.  This is less stressful to
- * the guest memory system, since it allows the thread to block
- * while memory is reclaimed, and won't take pages from emergency
- * low-memory pools.
+ * Use __GFP_HIGHMEM to allow pages from HIGHMEM zone. We allow lightweight
+ * reclamation (__GFP_NORETRY). Use __GFP_NOWARN, to suppress page allocation
+ * failure warnings. Disallow access to emergency low-memory pools.
  */
-#define VMW_PAGE_ALLOC_CANSLEEP         (GFP_HIGHUSER)
+#define VMW_PAGE_ALLOC_FLAGS            (__GFP_HIGHMEM|__GFP_NOWARN|    \
+                                         __GFP_NOMEMALLOC|__GFP_NORETRY)
 
 /* Maximum number of refused pages we accumulate during inflation cycle */
 #define VMW_BALLOON_MAX_REFUSED         16
@@ -77,225 +80,420 @@ enum vmwballoon_capabilities {
                                         | VMW_BALLOON_BATCHED_2M_CMDS \
                                         | VMW_BALLOON_SIGNALLED_WAKEUP_CMD)
 
-#define VMW_BALLOON_2M_SHIFT            (9)
-#define VMW_BALLOON_NUM_PAGE_SIZES      (2)
+#define VMW_BALLOON_2M_ORDER            (PMD_SHIFT - PAGE_SHIFT)
 
-/*
- * Backdoor commands availability:
- *
- * START, GET_TARGET and GUEST_ID are always available,
- *
- * VMW_BALLOON_BASIC_CMDS:
- *      LOCK and UNLOCK commands,
- * VMW_BALLOON_BATCHED_CMDS:
- *      BATCHED_LOCK and BATCHED_UNLOCK commands.
- * VMW BALLOON_BATCHED_2M_CMDS:
- *      BATCHED_2M_LOCK and BATCHED_2M_UNLOCK commands,
- * VMW VMW_BALLOON_SIGNALLED_WAKEUP_CMD:
- *      VMW_BALLOON_CMD_VMCI_DOORBELL_SET command.
- */
-#define VMW_BALLOON_CMD_START                   0
-#define VMW_BALLOON_CMD_GET_TARGET              1
-#define VMW_BALLOON_CMD_LOCK                    2
-#define VMW_BALLOON_CMD_UNLOCK                  3
-#define VMW_BALLOON_CMD_GUEST_ID                4
-#define VMW_BALLOON_CMD_BATCHED_LOCK            6
-#define VMW_BALLOON_CMD_BATCHED_UNLOCK          7
-#define VMW_BALLOON_CMD_BATCHED_2M_LOCK         8
-#define VMW_BALLOON_CMD_BATCHED_2M_UNLOCK       9
-#define VMW_BALLOON_CMD_VMCI_DOORBELL_SET       10
-
-
-/* error codes */
-#define VMW_BALLOON_SUCCESS                     0
-#define VMW_BALLOON_FAILURE                     -1
-#define VMW_BALLOON_ERROR_CMD_INVALID           1
-#define VMW_BALLOON_ERROR_PPN_INVALID           2
-#define VMW_BALLOON_ERROR_PPN_LOCKED            3
-#define VMW_BALLOON_ERROR_PPN_UNLOCKED          4
-#define VMW_BALLOON_ERROR_PPN_PINNED            5
-#define VMW_BALLOON_ERROR_PPN_NOTNEEDED         6
-#define VMW_BALLOON_ERROR_RESET                 7
-#define VMW_BALLOON_ERROR_BUSY                  8
+enum vmballoon_page_size_type {
+        VMW_BALLOON_4K_PAGE,
+        VMW_BALLOON_2M_PAGE,
+        VMW_BALLOON_LAST_SIZE = VMW_BALLOON_2M_PAGE
+};
 
-#define VMW_BALLOON_SUCCESS_WITH_CAPABILITIES   (0x03000000)
+#define VMW_BALLOON_NUM_PAGE_SIZES      (VMW_BALLOON_LAST_SIZE + 1)
 
-/* Batch page description */
+static const char * const vmballoon_page_size_names[] = {
+        [VMW_BALLOON_4K_PAGE]                   = "4k",
+        [VMW_BALLOON_2M_PAGE]                   = "2M"
+};
 
-/*
- * Layout of a page in the batch page:
+enum vmballoon_op {
+        VMW_BALLOON_INFLATE,
+        VMW_BALLOON_DEFLATE
+};
+
+enum vmballoon_op_stat_type {
+        VMW_BALLOON_OP_STAT,
+        VMW_BALLOON_OP_FAIL_STAT
+};
+
+#define VMW_BALLOON_OP_STAT_TYPES       (VMW_BALLOON_OP_FAIL_STAT + 1)
+
+/**
+ * enum vmballoon_cmd_type - backdoor commands.
  *
- * +-------------+----------+--------+
- * |             |          |        |
- * | Page number | Reserved | Status |
- * |             |          |        |
- * +-------------+----------+--------+
- * 64  PAGE_SHIFT          6         0
+ * Availability of the commands is as followed:
  *
- * The reserved field should be set to 0.
+ * %VMW_BALLOON_CMD_START, %VMW_BALLOON_CMD_GET_TARGET and
+ * %VMW_BALLOON_CMD_GUEST_ID are always available.
+ *
+ * If the host reports %VMW_BALLOON_BASIC_CMDS are supported then
+ * %VMW_BALLOON_CMD_LOCK and %VMW_BALLOON_CMD_UNLOCK commands are available.
+ *
+ * If the host reports %VMW_BALLOON_BATCHED_CMDS are supported then
+ * %VMW_BALLOON_CMD_BATCHED_LOCK and VMW_BALLOON_CMD_BATCHED_UNLOCK commands
+ * are available.
+ *
+ * If the host reports %VMW_BALLOON_BATCHED_2M_CMDS are supported then
+ * %VMW_BALLOON_CMD_BATCHED_2M_LOCK and %VMW_BALLOON_CMD_BATCHED_2M_UNLOCK
+ * are supported.
+ *
+ * If the host reports  VMW_BALLOON_SIGNALLED_WAKEUP_CMD is supported then
+ * VMW_BALLOON_CMD_VMCI_DOORBELL_SET command is supported.
+ *
+ * @VMW_BALLOON_CMD_START: Communicating supported version with the hypervisor.
+ * @VMW_BALLOON_CMD_GET_TARGET: Gets the balloon target size.
+ * @VMW_BALLOON_CMD_LOCK: Informs the hypervisor about a ballooned page.
+ * @VMW_BALLOON_CMD_UNLOCK: Informs the hypervisor about a page that is about
+ *                          to be deflated from the balloon.
+ * @VMW_BALLOON_CMD_GUEST_ID: Informs the hypervisor about the type of OS that
+ *                            runs in the VM.
+ * @VMW_BALLOON_CMD_BATCHED_LOCK: Inform the hypervisor about a batch of
+ *                                ballooned pages (up to 512).
+ * @VMW_BALLOON_CMD_BATCHED_UNLOCK: Inform the hypervisor about a batch of
+ *                                pages that are about to be deflated from the
+ *                                balloon (up to 512).
+ * @VMW_BALLOON_CMD_BATCHED_2M_LOCK: Similar to @VMW_BALLOON_CMD_BATCHED_LOCK
+ *                                   for 2MB pages.
+ * @VMW_BALLOON_CMD_BATCHED_2M_UNLOCK: Similar to
+ *                                     @VMW_BALLOON_CMD_BATCHED_UNLOCK for 2MB
+ *                                     pages.
+ * @VMW_BALLOON_CMD_VMCI_DOORBELL_SET: A command to set doorbell notification
+ *                                     that would be invoked when the balloon
+ *                                     size changes.
+ * @VMW_BALLOON_CMD_LAST: Value of the last command.
  */
-#define VMW_BALLOON_BATCH_MAX_PAGES     (PAGE_SIZE / sizeof(u64))
-#define VMW_BALLOON_BATCH_STATUS_MASK   ((1UL << 5) - 1)
-#define VMW_BALLOON_BATCH_PAGE_MASK     (~((1UL << PAGE_SHIFT) - 1))
-
-struct vmballoon_batch_page {
-        u64 pages[VMW_BALLOON_BATCH_MAX_PAGES];
+enum vmballoon_cmd_type {
+        VMW_BALLOON_CMD_START,
+        VMW_BALLOON_CMD_GET_TARGET,
+        VMW_BALLOON_CMD_LOCK,
+        VMW_BALLOON_CMD_UNLOCK,
+        VMW_BALLOON_CMD_GUEST_ID,
+        /* No command 5 */
+        VMW_BALLOON_CMD_BATCHED_LOCK = 6,
+        VMW_BALLOON_CMD_BATCHED_UNLOCK,
+        VMW_BALLOON_CMD_BATCHED_2M_LOCK,
+        VMW_BALLOON_CMD_BATCHED_2M_UNLOCK,
+        VMW_BALLOON_CMD_VMCI_DOORBELL_SET,
+        VMW_BALLOON_CMD_LAST = VMW_BALLOON_CMD_VMCI_DOORBELL_SET,
 };
 
-static u64 vmballoon_batch_get_pa(struct vmballoon_batch_page *batch, int idx)
-{
-        return batch->pages[idx] & VMW_BALLOON_BATCH_PAGE_MASK;
-}
+#define VMW_BALLOON_CMD_NUM     (VMW_BALLOON_CMD_LAST + 1)
+
+enum vmballoon_error_codes {
+        VMW_BALLOON_SUCCESS,
+        VMW_BALLOON_ERROR_CMD_INVALID,
+        VMW_BALLOON_ERROR_PPN_INVALID,
+        VMW_BALLOON_ERROR_PPN_LOCKED,
+        VMW_BALLOON_ERROR_PPN_UNLOCKED,
+        VMW_BALLOON_ERROR_PPN_PINNED,
+        VMW_BALLOON_ERROR_PPN_NOTNEEDED,
+        VMW_BALLOON_ERROR_RESET,
+        VMW_BALLOON_ERROR_BUSY
+};
 
-static int vmballoon_batch_get_status(struct vmballoon_batch_page *batch,
-                                int idx)
-{
-        return (int)(batch->pages[idx] & VMW_BALLOON_BATCH_STATUS_MASK);
-}
+#define VMW_BALLOON_SUCCESS_WITH_CAPABILITIES   (0x03000000)
 
-static void vmballoon_batch_set_pa(struct vmballoon_batch_page *batch, int idx,
-                                u64 pa)
-{
-        batch->pages[idx] = pa;
-}
+#define VMW_BALLOON_CMD_WITH_TARGET_MASK                        \
+        ((1UL << VMW_BALLOON_CMD_GET_TARGET)            |       \
+         (1UL << VMW_BALLOON_CMD_LOCK)                  |       \
+         (1UL << VMW_BALLOON_CMD_UNLOCK)                |       \
+         (1UL << VMW_BALLOON_CMD_BATCHED_LOCK)          |       \
+         (1UL << VMW_BALLOON_CMD_BATCHED_UNLOCK)        |       \
+         (1UL << VMW_BALLOON_CMD_BATCHED_2M_LOCK)       |       \
+         (1UL << VMW_BALLOON_CMD_BATCHED_2M_UNLOCK))
+
+static const char * const vmballoon_cmd_names[] = {
+        [VMW_BALLOON_CMD_START]                 = "start",
+        [VMW_BALLOON_CMD_GET_TARGET]            = "target",
+        [VMW_BALLOON_CMD_LOCK]                  = "lock",
+        [VMW_BALLOON_CMD_UNLOCK]                = "unlock",
+        [VMW_BALLOON_CMD_GUEST_ID]              = "guestType",
+        [VMW_BALLOON_CMD_BATCHED_LOCK]          = "batchLock",
+        [VMW_BALLOON_CMD_BATCHED_UNLOCK]        = "batchUnlock",
+        [VMW_BALLOON_CMD_BATCHED_2M_LOCK]       = "2m-lock",
+        [VMW_BALLOON_CMD_BATCHED_2M_UNLOCK]     = "2m-unlock",
+        [VMW_BALLOON_CMD_VMCI_DOORBELL_SET]     = "doorbellSet"
+};
 
+enum vmballoon_stat_page {
+        VMW_BALLOON_PAGE_STAT_ALLOC,
+        VMW_BALLOON_PAGE_STAT_ALLOC_FAIL,
+        VMW_BALLOON_PAGE_STAT_REFUSED_ALLOC,
+        VMW_BALLOON_PAGE_STAT_REFUSED_FREE,
+        VMW_BALLOON_PAGE_STAT_FREE,
+        VMW_BALLOON_PAGE_STAT_LAST = VMW_BALLOON_PAGE_STAT_FREE
+};
 
-#define VMWARE_BALLOON_CMD(cmd, arg1, arg2, result)             \
-({                                                              \
-        unsigned long __status, __dummy1, __dummy2, __dummy3;   \
-        __asm__ __volatile__ ("inl %%dx" :                      \
-                "=a"(__status),                                 \
-                "=c"(__dummy1),                                 \
-                "=d"(__dummy2),                                 \
-                "=b"(result),                                   \
-                "=S" (__dummy3) :                               \
-                "0"(VMW_BALLOON_HV_MAGIC),                      \
-                "1"(VMW_BALLOON_CMD_##cmd),                     \
-                "2"(VMW_BALLOON_HV_PORT),                       \
-                "3"(arg1),                                      \
-                "4" (arg2) :                                    \
-                "memory");                                      \
-        if (VMW_BALLOON_CMD_##cmd == VMW_BALLOON_CMD_START)     \
-                result = __dummy1;                              \
-        result &= -1UL;                                         \
-        __status & -1UL;                                        \
-})
+#define VMW_BALLOON_PAGE_STAT_NUM       (VMW_BALLOON_PAGE_STAT_LAST + 1)
 
-#ifdef CONFIG_DEBUG_FS
-struct vmballoon_stats {
-        unsigned int timer;
-        unsigned int doorbell;
-
-        /* allocation statistics */
-        unsigned int alloc[VMW_BALLOON_NUM_PAGE_SIZES];
-        unsigned int alloc_fail[VMW_BALLOON_NUM_PAGE_SIZES];
-        unsigned int sleep_alloc;
-        unsigned int sleep_alloc_fail;
-        unsigned int refused_alloc[VMW_BALLOON_NUM_PAGE_SIZES];
-        unsigned int refused_free[VMW_BALLOON_NUM_PAGE_SIZES];
-        unsigned int free[VMW_BALLOON_NUM_PAGE_SIZES];
-
-        /* monitor operations */
-        unsigned int lock[VMW_BALLOON_NUM_PAGE_SIZES];
-        unsigned int lock_fail[VMW_BALLOON_NUM_PAGE_SIZES];
-        unsigned int unlock[VMW_BALLOON_NUM_PAGE_SIZES];
-        unsigned int unlock_fail[VMW_BALLOON_NUM_PAGE_SIZES];
-        unsigned int target;
-        unsigned int target_fail;
-        unsigned int start;
-        unsigned int start_fail;
-        unsigned int guest_type;
-        unsigned int guest_type_fail;
-        unsigned int doorbell_set;
-        unsigned int doorbell_unset;
+enum vmballoon_stat_general {
+        VMW_BALLOON_STAT_TIMER,
+        VMW_BALLOON_STAT_DOORBELL,
+        VMW_BALLOON_STAT_RESET,
+        VMW_BALLOON_STAT_LAST = VMW_BALLOON_STAT_RESET
 };
 
-#define STATS_INC(stat) (stat)++
-#else
-#define STATS_INC(stat)
-#endif
+#define VMW_BALLOON_STAT_NUM            (VMW_BALLOON_STAT_LAST + 1)
 
-struct vmballoon;
 
-struct vmballoon_ops {
-        void (*add_page)(struct vmballoon *b, int idx, struct page *p);
-        int (*lock)(struct vmballoon *b, unsigned int num_pages,
-                        bool is_2m_pages, unsigned int *target);
-        int (*unlock)(struct vmballoon *b, unsigned int num_pages,
-                        bool is_2m_pages, unsigned int *target);
+static DEFINE_STATIC_KEY_TRUE(vmw_balloon_batching);
+static DEFINE_STATIC_KEY_FALSE(balloon_stat_enabled);
+
+struct vmballoon_ctl {
+        struct list_head pages;
+        struct list_head refused_pages;
+        unsigned int n_refused_pages;
+        unsigned int n_pages;
+        enum vmballoon_page_size_type page_size;
+        enum vmballoon_op op;
 };
 
 struct vmballoon_page_size {
         /* list of reserved physical pages */
         struct list_head pages;
-
-        /* transient list of non-balloonable pages */
-        struct list_head refused_pages;
-        unsigned int n_refused_pages;
 };
 
+/**
+ * struct vmballoon_batch_entry - a batch entry for lock or unlock.
+ *
+ * @status: the status of the operation, which is written by the hypervisor.
+ * @reserved: reserved for future use. Must be set to zero.
+ * @pfn: the physical frame number of the page to be locked or unlocked.
+ */
+struct vmballoon_batch_entry {
+        u64 status : 5;
+        u64 reserved : PAGE_SHIFT - 5;
+        u64 pfn : 52;
+} __packed;
+
 struct vmballoon {
         struct vmballoon_page_size page_sizes[VMW_BALLOON_NUM_PAGE_SIZES];
 
-        /* supported page sizes. 1 == 4k pages only, 2 == 4k and 2m pages */
-        unsigned supported_page_sizes;
+        /**
+         * @max_page_size: maximum supported page size for ballooning.
+         *
+         * Protected by @conf_sem
+         */
+        enum vmballoon_page_size_type max_page_size;
+
+        /**
+         * @size: balloon actual size in basic page size (frames).
+         *
+         * While we currently do not support size which is bigger than 32-bit,
+         * in preparation for future support, use 64-bits.
+         */
+        atomic64_t size;
 
-        /* balloon size in pages */
-        unsigned int size;
-        unsigned int target;
+        /**
+         * @target: balloon target size in basic page size (frames).
+         *
+         * We do not protect the target under the assumption that setting the
+         * value is always done through a single write. If this assumption ever
+         * breaks, we would have to use X_ONCE for accesses, and suffer the less
+         * optimized code. Although we may read stale target value if multiple
+         * accesses happen at once, the performance impact should be minor.
+         */
+        unsigned long target;
 
-        /* reset flag */
+        /**
+         * @reset_required: reset flag
+         *
+         * Setting this flag may introduce races, but the code is expected to
+         * handle them gracefully. In the worst case, another operation will
+         * fail as reset did not take place. Clearing the flag is done while
+         * holding @conf_sem for write.
+         */
         bool reset_required;
 
+        /**
+         * @capabilities: hypervisor balloon capabilities.
+         *
+         * Protected by @conf_sem.
+         */
         unsigned long capabilities;
 
-        struct vmballoon_batch_page *batch_page;
+        /**
+         * @batch_page: pointer to communication batch page.
+         *
+         * When batching is used, batch_page points to a page, which holds up to
+         * %VMW_BALLOON_BATCH_MAX_PAGES entries for locking or unlocking.
+         */
+        struct vmballoon_batch_entry *batch_page;
+
+        /**
+         * @batch_max_pages: maximum pages that can be locked/unlocked.
+         *
+         * Indicates the number of pages that the hypervisor can lock or unlock
+         * at once, according to whether batching is enabled. If batching is
+         * disabled, only a single page can be locked/unlock on each operation.
+         *
+         * Protected by @conf_sem.
+         */
         unsigned int batch_max_pages;
-        struct page *page;
 
-        const struct vmballoon_ops *ops;
+        /**
+         * @page: page to be locked/unlocked by the hypervisor
+         *
+         * @page is only used when batching is disabled and a single page is
+         * reclaimed on each iteration.
+         *
+         * Protected by @comm_lock.
+         */
+        struct page *page;
 
-#ifdef CONFIG_DEBUG_FS
         /* statistics */
-        struct vmballoon_stats stats;
+        struct vmballoon_stats *stats;
 
+#ifdef CONFIG_DEBUG_FS
         /* debugfs file exporting statistics */
         struct dentry *dbg_entry;
 #endif
 
-        struct sysinfo sysinfo;
-
         struct delayed_work dwork;
 
+        /**
+         * @vmci_doorbell.
+         *
+         * Protected by @conf_sem.
+         */
         struct vmci_handle vmci_doorbell;
+
+        /**
+         * @conf_sem: semaphore to protect the configuration and the statistics.
+         */
+        struct rw_semaphore conf_sem;
+
+        /**
+         * @comm_lock: lock to protect the communication with the host.
+         *
+         * Lock ordering: @conf_sem -> @comm_lock .
+         */
+        spinlock_t comm_lock;
 };
 
 static struct vmballoon balloon;
 
+struct vmballoon_stats {
+        /* timer / doorbell operations */
+        atomic64_t general_stat[VMW_BALLOON_STAT_NUM];
+
+        /* allocation statistics for huge and small pages */
+        atomic64_t
+               page_stat[VMW_BALLOON_PAGE_STAT_NUM][VMW_BALLOON_NUM_PAGE_SIZES];
+
+        /* Monitor operations: total operations, and failures */
+        atomic64_t ops[VMW_BALLOON_CMD_NUM][VMW_BALLOON_OP_STAT_TYPES];
+};
+
+static inline bool is_vmballoon_stats_on(void)
+{
+        return IS_ENABLED(CONFIG_DEBUG_FS) &&
+                static_branch_unlikely(&balloon_stat_enabled);
+}
+
+static inline void vmballoon_stats_op_inc(struct vmballoon *b, unsigned int op,
+                                          enum vmballoon_op_stat_type type)
+{
+        if (is_vmballoon_stats_on())
+                atomic64_inc(&b->stats->ops[op][type]);
+}
+
+static inline void vmballoon_stats_gen_inc(struct vmballoon *b,
+                                           enum vmballoon_stat_general stat)
+{
+        if (is_vmballoon_stats_on())
+                atomic64_inc(&b->stats->general_stat[stat]);
+}
+
+static inline void vmballoon_stats_gen_add(struct vmballoon *b,
+                                           enum vmballoon_stat_general stat,
+                                           unsigned int val)
+{
+        if (is_vmballoon_stats_on())
+                atomic64_add(val, &b->stats->general_stat[stat]);
+}
+
+static inline void vmballoon_stats_page_inc(struct vmballoon *b,
+                                            enum vmballoon_stat_page stat,
+                                            enum vmballoon_page_size_type size)
+{
+        if (is_vmballoon_stats_on())
+                atomic64_inc(&b->stats->page_stat[stat][size]);
+}
+
+static inline void vmballoon_stats_page_add(struct vmballoon *b,
+                                            enum vmballoon_stat_page stat,
+                                            enum vmballoon_page_size_type size,
+                                            unsigned int val)
+{
+        if (is_vmballoon_stats_on())
+                atomic64_add(val, &b->stats->page_stat[stat][size]);
+}
+
+static inline unsigned long
+__vmballoon_cmd(struct vmballoon *b, unsigned long cmd, unsigned long arg1,
+                unsigned long arg2, unsigned long *result)
+{
+        unsigned long status, dummy1, dummy2, dummy3, local_result;
+
+        vmballoon_stats_op_inc(b, cmd, VMW_BALLOON_OP_STAT);
+
+        asm volatile ("inl %%dx" :
+                "=a"(status),
+                "=c"(dummy1),
+                "=d"(dummy2),
+                "=b"(local_result),
+                "=S"(dummy3) :
+                "0"(VMW_BALLOON_HV_MAGIC),
+                "1"(cmd),
+                "2"(VMW_BALLOON_HV_PORT),
+                "3"(arg1),
+                "4"(arg2) :
+                "memory");
+
+        /* update the result if needed */
+        if (result)
+                *result = (cmd == VMW_BALLOON_CMD_START) ? dummy1 :
+                                                           local_result;
+
+        /* update target when applicable */
+        if (status == VMW_BALLOON_SUCCESS &&
+            ((1ul << cmd) & VMW_BALLOON_CMD_WITH_TARGET_MASK))
+                WRITE_ONCE(b->target, local_result);
+
+        if (status != VMW_BALLOON_SUCCESS &&
+            status != VMW_BALLOON_SUCCESS_WITH_CAPABILITIES) {
+                vmballoon_stats_op_inc(b, cmd, VMW_BALLOON_OP_FAIL_STAT);
+                pr_debug("%s: %s [0x%lx,0x%lx) failed, returned %ld\n",
+                         __func__, vmballoon_cmd_names[cmd], arg1, arg2,
+                         status);
+        }
+
+        /* mark reset required accordingly */
+        if (status == VMW_BALLOON_ERROR_RESET)
+                b->reset_required = true;
+
+        return status;
+}
+
+static __always_inline unsigned long
+vmballoon_cmd(struct vmballoon *b, unsigned long cmd, unsigned long arg1,
+              unsigned long arg2)
+{
+        unsigned long dummy;
+
+        return __vmballoon_cmd(b, cmd, arg1, arg2, &dummy);
+}
+
 /*
  * Send "start" command to the host, communicating supported version
  * of the protocol.
  */
-static bool vmballoon_send_start(struct vmballoon *b, unsigned long req_caps)
+static int vmballoon_send_start(struct vmballoon *b, unsigned long req_caps)
 {
-        unsigned long status, capabilities, dummy = 0;
-        bool success;
-
-        STATS_INC(b->stats.start);
+        unsigned long status, capabilities;
 
-        status = VMWARE_BALLOON_CMD(START, req_caps, dummy, capabilities);
+        status = __vmballoon_cmd(b, VMW_BALLOON_CMD_START, req_caps, 0,
+                                 &capabilities);
 
         switch (status) {
         case VMW_BALLOON_SUCCESS_WITH_CAPABILITIES:
                 b->capabilities = capabilities;
-                success = true;
                 break;
         case VMW_BALLOON_SUCCESS:
                 b->capabilities = VMW_BALLOON_BASIC_CMDS;
-                success = true;
                 break;
         default:
-                success = false;
+                return -EIO;
         }
 
         /*
@@ -303,626 +501,693 @@ static bool vmballoon_send_start(struct vmballoon *b, unsigned long req_caps)
          * reason disabled, do not use 2MB pages, since otherwise the legacy
          * mechanism is used with 2MB pages, causing a failure.
          */
+        b->max_page_size = VMW_BALLOON_4K_PAGE;
         if ((b->capabilities & VMW_BALLOON_BATCHED_2M_CMDS) &&
             (b->capabilities & VMW_BALLOON_BATCHED_CMDS))
-                b->supported_page_sizes = 2;
-        else
-                b->supported_page_sizes = 1;
-
-        if (!success) {
-                pr_debug("%s - failed, hv returns %ld\n", __func__, status);
-                STATS_INC(b->stats.start_fail);
-        }
-        return success;
-}
+                b->max_page_size = VMW_BALLOON_2M_PAGE;
 
-static bool vmballoon_check_status(struct vmballoon *b, unsigned long status)
-{
-        switch (status) {
-        case VMW_BALLOON_SUCCESS:
-                return true;
 
-        case VMW_BALLOON_ERROR_RESET:
-                b->reset_required = true;
-                /* fall through */
-
-        default:
-                return false;
-        }
+        return 0;
 }
 
-/*
+/**
+ * vmballoon_send_guest_id - communicate guest type to the host.
+ *
+ * @b: pointer to the balloon.
+ *
  * Communicate guest type to the host so that it can adjust ballooning
  * algorithm to the one most appropriate for the guest. This command
  * is normally issued after sending "start" command and is part of
  * standard reset sequence.
+ *
+ * Return: zero on success or appropriate error code.
  */
-static bool vmballoon_send_guest_id(struct vmballoon *b)
+static int vmballoon_send_guest_id(struct vmballoon *b)
 {
-        unsigned long status, dummy = 0;
-
-        status = VMWARE_BALLOON_CMD(GUEST_ID, VMW_BALLOON_GUEST_ID, dummy,
-                                dummy);
-
-        STATS_INC(b->stats.guest_type);
+        unsigned long status;
 
-        if (vmballoon_check_status(b, status))
-                return true;
+        status = vmballoon_cmd(b, VMW_BALLOON_CMD_GUEST_ID,
+                               VMW_BALLOON_GUEST_ID, 0);
 
-        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
-        STATS_INC(b->stats.guest_type_fail);
-        return false;
+        return status == VMW_BALLOON_SUCCESS ? 0 : -EIO;
 }
 
-static u16 vmballoon_page_size(bool is_2m_page)
+/**
+ * vmballoon_page_order() - return the order of the page
+ * @page_size: the size of the page.
+ *
+ * Return: the allocation order.
+ */
+static inline
+unsigned int vmballoon_page_order(enum vmballoon_page_size_type page_size)
 {
-        if (is_2m_page)
-                return 1 << VMW_BALLOON_2M_SHIFT;
+        return page_size == VMW_BALLOON_2M_PAGE ? VMW_BALLOON_2M_ORDER : 0;
+}
 
-        return 1;
+/**
+ * vmballoon_page_in_frames() - returns the number of frames in a page.
+ * @page_size: the size of the page.
+ *
+ * Return: the number of 4k frames.
+ */
+static inline unsigned int
+vmballoon_page_in_frames(enum vmballoon_page_size_type page_size)
+{
+        return 1 << vmballoon_page_order(page_size);
 }
 
-/*
- * Retrieve desired balloon size from the host.
+/**
+ * vmballoon_send_get_target() - Retrieve desired balloon size from the host.
+ *
+ * @b: pointer to the balloon.
+ *
+ * Return: zero on success, EINVAL if limit does not fit in 32-bit, as required
+ * by the host-guest protocol and EIO if an error occurred in communicating with
+ * the host.
  */
-static bool vmballoon_send_get_target(struct vmballoon *b, u32 *new_target)
+static int vmballoon_send_get_target(struct vmballoon *b)
 {
         unsigned long status;
-        unsigned long target;
         unsigned long limit;
-        unsigned long dummy = 0;
-        u32 limit32;
 
-        /*
-         * si_meminfo() is cheap. Moreover, we want to provide dynamic
-         * max balloon size later. So let us call si_meminfo() every
-         * iteration.
-         */
-        si_meminfo(&b->sysinfo);
-        limit = b->sysinfo.totalram;
+        limit = totalram_pages;
 
         /* Ensure limit fits in 32-bits */
-        limit32 = (u32)limit;
-        if (limit != limit32)
-                return false;
-
-        /* update stats */
-        STATS_INC(b->stats.target);
+        if (limit != (u32)limit)
+                return -EINVAL;
 
-        status = VMWARE_BALLOON_CMD(GET_TARGET, limit, dummy, target);
-        if (vmballoon_check_status(b, status)) {
-                *new_target = target;
-                return true;
-        }
+        status = vmballoon_cmd(b, VMW_BALLOON_CMD_GET_TARGET, limit, 0);
 
-        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
-        STATS_INC(b->stats.target_fail);
-        return false;
+        return status == VMW_BALLOON_SUCCESS ? 0 : -EIO;
 }
 
-/*
- * Notify the host about allocated page so that host can use it without
- * fear that guest will need it. Host may reject some pages, we need to
- * check the return value and maybe submit a different page.
+/**
+ * vmballoon_alloc_page_list - allocates a list of pages.
+ *
+ * @b: pointer to the balloon.
+ * @ctl: pointer for the %struct vmballoon_ctl, which defines the operation.
+ * @req_n_pages: the number of requested pages.
+ *
+ * Tries to allocate @req_n_pages. Add them to the list of balloon pages in
+ * @ctl.pages and updates @ctl.n_pages to reflect the number of pages.
+ *
+ * Return: zero on success or error code otherwise.
  */
-static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn,
-                                unsigned int *hv_status, unsigned int *target)
+static int vmballoon_alloc_page_list(struct vmballoon *b,
+                                     struct vmballoon_ctl *ctl,
+                                     unsigned int req_n_pages)
 {
-        unsigned long status, dummy = 0;
-        u32 pfn32;
-
-        pfn32 = (u32)pfn;
-        if (pfn32 != pfn)
-                return -EINVAL;
-
-        STATS_INC(b->stats.lock[false]);
+        struct page *page;
+        unsigned int i;
 
-        *hv_status = status = VMWARE_BALLOON_CMD(LOCK, pfn, dummy, *target);
-        if (vmballoon_check_status(b, status))
-                return 0;
+        for (i = 0; i < req_n_pages; i++) {
+                if (ctl->page_size == VMW_BALLOON_2M_PAGE)
+                        page = alloc_pages(VMW_HUGE_PAGE_ALLOC_FLAGS,
+                                           VMW_BALLOON_2M_ORDER);
+                else
+                        page = alloc_page(VMW_PAGE_ALLOC_FLAGS);
 
-        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
-        STATS_INC(b->stats.lock_fail[false]);
-        return -EIO;
-}
+                /* Update statistics */
+                vmballoon_stats_page_inc(b, VMW_BALLOON_PAGE_STAT_ALLOC,
+                                         ctl->page_size);
 
-static int vmballoon_send_batched_lock(struct vmballoon *b,
-                unsigned int num_pages, bool is_2m_pages, unsigned int *target)
-{
-        unsigned long status;
-        unsigned long pfn = PHYS_PFN(virt_to_phys(b->batch_page));
+                if (page) {
+                        /* Success. Add the page to the list and continue. */
+                        list_add(&page->lru, &ctl->pages);
+                        continue;
+                }
 
-        STATS_INC(b->stats.lock[is_2m_pages]);
+                /* Allocation failed. Update statistics and stop. */
+                vmballoon_stats_page_inc(b, VMW_BALLOON_PAGE_STAT_ALLOC_FAIL,
+                                         ctl->page_size);
+                break;
+        }
 
-        if (is_2m_pages)
-                status = VMWARE_BALLOON_CMD(BATCHED_2M_LOCK, pfn, num_pages,
-                                *target);
-        else
-                status = VMWARE_BALLOON_CMD(BATCHED_LOCK, pfn, num_pages,
-                                *target);
+        ctl->n_pages = i;
 
-        if (vmballoon_check_status(b, status))
-                return 0;
-
-        pr_debug("%s - batch ppn %lx, hv returns %ld\n", __func__, pfn, status);
-        STATS_INC(b->stats.lock_fail[is_2m_pages]);
-        return 1;
+        return req_n_pages == ctl->n_pages ? 0 : -ENOMEM;
 }
 
-/*
- * Notify the host that guest intends to release given page back into
- * the pool of available (to the guest) pages.
+/**
+ * vmballoon_handle_one_result - Handle lock/unlock result for a single page.
+ *
+ * @b: pointer for %struct vmballoon.
+ * @page: pointer for the page whose result should be handled.
+ * @page_size: size of the page.
+ * @status: status of the operation as provided by the hypervisor.
  */
-static bool vmballoon_send_unlock_page(struct vmballoon *b, unsigned long pfn,
-                                                        unsigned int *target)
+static int vmballoon_handle_one_result(struct vmballoon *b, struct page *page,
+                                       enum vmballoon_page_size_type page_size,
+                                       unsigned long status)
 {
-        unsigned long status, dummy = 0;
-        u32 pfn32;
-
-        pfn32 = (u32)pfn;
-        if (pfn32 != pfn)
-                return false;
+        /* On success do nothing. The page is already on the balloon list. */
+        if (likely(status == VMW_BALLOON_SUCCESS))
+                return 0;
 
-        STATS_INC(b->stats.unlock[false]);
+        pr_debug("%s: failed comm pfn %lx status %lu page_size %s\n", __func__,
+                 page_to_pfn(page), status,
+                 vmballoon_page_size_names[page_size]);
 
-        status = VMWARE_BALLOON_CMD(UNLOCK, pfn, dummy, *target);
-        if (vmballoon_check_status(b, status))
-                return true;
+        /* Error occurred */
+        vmballoon_stats_page_inc(b, VMW_BALLOON_PAGE_STAT_REFUSED_ALLOC,
+                                 page_size);
 
-        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
-        STATS_INC(b->stats.unlock_fail[false]);
-        return false;
+        return -EIO;
 }
 
-static bool vmballoon_send_batched_unlock(struct vmballoon *b,
-                unsigned int num_pages, bool is_2m_pages, unsigned int *target)
+/**
+ * vmballoon_status_page - returns the status of (un)lock operation
+ *
+ * @b: pointer to the balloon.
+ * @idx: index for the page for which the operation is performed.
+ * @p: pointer to where the page struct is returned.
+ *
+ * Following a lock or unlock operation, returns the status of the operation for
+ * an individual page. Provides the page that the operation was performed on on
+ * the @page argument.
+ *
+ * Returns: The status of a lock or unlock operation for an individual page.
+ */
+static unsigned long vmballoon_status_page(struct vmballoon *b, int idx,
+                                           struct page **p)
 {
-        unsigned long status;
-        unsigned long pfn = PHYS_PFN(virt_to_phys(b->batch_page));
-
-        STATS_INC(b->stats.unlock[is_2m_pages]);
-
-        if (is_2m_pages)
-                status = VMWARE_BALLOON_CMD(BATCHED_2M_UNLOCK, pfn, num_pages,
-                                *target);
-        else
-                status = VMWARE_BALLOON_CMD(BATCHED_UNLOCK, pfn, num_pages,
-                                *target);
+        if (static_branch_likely(&vmw_balloon_batching)) {
+                /* batching mode */
+                *p = pfn_to_page(b->batch_page[idx].pfn);
+                return b->batch_page[idx].status;
+        }
 
-        if (vmballoon_check_status(b, status))
-                return true;
+        /* non-batching mode */
+        *p = b->page;
 
-        pr_debug("%s - batch ppn %lx, hv returns %ld\n", __func__, pfn, status);
-        STATS_INC(b->stats.unlock_fail[is_2m_pages]);
-        return false;
+        /*
+         * If a failure occurs, the indication will be provided in the status
+         * of the entire operation, which is considered before the individual
+         * page status. So for non-batching mode, the indication is always of
+         * success.
+         */
+        return VMW_BALLOON_SUCCESS;
 }
 
-static struct page *vmballoon_alloc_page(gfp_t flags, bool is_2m_page)
+/**
+ * vmballoon_lock_op - notifies the host about inflated/deflated pages.
+ * @b: pointer to the balloon.
+ * @num_pages: number of inflated/deflated pages.
+ * @page_size: size of the page.
+ * @op: the type of operation (lock or unlock).
+ *
+ * Notify the host about page(s) that were ballooned (or removed from the
+ * balloon) so that host can use it without fear that guest will need it (or
+ * stop using them since the VM does). Host may reject some pages, we need to
+ * check the return value and maybe submit a different page. The pages that are
+ * inflated/deflated are pointed by @b->page.
+ *
+ * Return: result as provided by the hypervisor.
+ */
+static unsigned long vmballoon_lock_op(struct vmballoon *b,
+                                       unsigned int num_pages,
+                                       enum vmballoon_page_size_type page_size,
+                                       enum vmballoon_op op)
 {
-        if (is_2m_page)
-                return alloc_pages(flags, VMW_BALLOON_2M_SHIFT);
+        unsigned long cmd, pfn;
 
-        return alloc_page(flags);
-}
+        lockdep_assert_held(&b->comm_lock);
 
-static void vmballoon_free_page(struct page *page, bool is_2m_page)
-{
-        if (is_2m_page)
-                __free_pages(page, VMW_BALLOON_2M_SHIFT);
-        else
-                __free_page(page);
+        if (static_branch_likely(&vmw_balloon_batching)) {
+                if (op == VMW_BALLOON_INFLATE)
+                        cmd = page_size == VMW_BALLOON_2M_PAGE ?
+                                VMW_BALLOON_CMD_BATCHED_2M_LOCK :
+                                VMW_BALLOON_CMD_BATCHED_LOCK;
+                else
+                        cmd = page_size == VMW_BALLOON_2M_PAGE ?
+                                VMW_BALLOON_CMD_BATCHED_2M_UNLOCK :
+                                VMW_BALLOON_CMD_BATCHED_UNLOCK;
+
+                pfn = PHYS_PFN(virt_to_phys(b->batch_page));
+        } else {
+                cmd = op == VMW_BALLOON_INFLATE ? VMW_BALLOON_CMD_LOCK :
+                                                  VMW_BALLOON_CMD_UNLOCK;
+                pfn = page_to_pfn(b->page);
+
+                /* In non-batching mode, PFNs must fit in 32-bit */
+                if (unlikely(pfn != (u32)pfn))
+                        return VMW_BALLOON_ERROR_PPN_INVALID;
+        }
+
+        return vmballoon_cmd(b, cmd, pfn, num_pages);
 }
 
-/*
- * Quickly release all pages allocated for the balloon. This function is
- * called when host decides to "reset" balloon for one reason or another.
- * Unlike normal "deflate" we do not (shall not) notify host of the pages
- * being released.
+/**
+ * vmballoon_add_page - adds a page towards lock/unlock operation.
+ *
+ * @b: pointer to the balloon.
+ * @idx: index of the page to be ballooned in this batch.
+ * @p: pointer to the page that is about to be ballooned.
+ *
+ * Adds the page to be ballooned. Must be called while holding @comm_lock.
  */
-static void vmballoon_pop(struct vmballoon *b)
+static void vmballoon_add_page(struct vmballoon *b, unsigned int idx,
+                               struct page *p)
 {
-        struct page *page, *next;
-        unsigned is_2m_pages;
-
-        for (is_2m_pages = 0; is_2m_pages < VMW_BALLOON_NUM_PAGE_SIZES;
-                        is_2m_pages++) {
-                struct vmballoon_page_size *page_size =
-                                &b->page_sizes[is_2m_pages];
-                u16 size_per_page = vmballoon_page_size(is_2m_pages);
-
-                list_for_each_entry_safe(page, next, &page_size->pages, lru) {
-                        list_del(&page->lru);
-                        vmballoon_free_page(page, is_2m_pages);
-                        STATS_INC(b->stats.free[is_2m_pages]);
-                        b->size -= size_per_page;
-                        cond_resched();
-                }
-        }
+        lockdep_assert_held(&b->comm_lock);
 
-        /* Clearing the batch_page unconditionally has no adverse effect */
-        free_page((unsigned long)b->batch_page);
-        b->batch_page = NULL;
+        if (static_branch_likely(&vmw_balloon_batching))
+                b->batch_page[idx] = (struct vmballoon_batch_entry)
+                                        { .pfn = page_to_pfn(p) };
+        else
+                b->page = p;
 }
 
-/*
- * Notify the host of a ballooned page. If host rejects the page put it on the
- * refuse list, those refused page are then released at the end of the
- * inflation cycle.
+/**
+ * vmballoon_lock - lock or unlock a batch of pages.
+ *
+ * @b: pointer to the balloon.
+ * @ctl: pointer for the %struct vmballoon_ctl, which defines the operation.
+ *
+ * Notifies the host of about ballooned pages (after inflation or deflation,
+ * according to @ctl). If the host rejects the page put it on the
+ * @ctl refuse list. These refused page are then released when moving to the
+ * next size of pages.
+ *
+ * Note that we neither free any @page here nor put them back on the ballooned
+ * pages list. Instead we queue it for later processing. We do that for several
+ * reasons. First, we do not want to free the page under the lock. Second, it
+ * allows us to unify the handling of lock and unlock. In the inflate case, the
+ * caller will check if there are too many refused pages and release them.
+ * Although it is not identical to the past behavior, it should not affect
+ * performance.
  */
-static int vmballoon_lock_page(struct vmballoon *b, unsigned int num_pages,
-                                bool is_2m_pages, unsigned int *target)
+static int vmballoon_lock(struct vmballoon *b, struct vmballoon_ctl *ctl)
 {
-        int locked, hv_status;
-        struct page *page = b->page;
-        struct vmballoon_page_size *page_size = &b->page_sizes[false];
-
-        /* is_2m_pages can never happen as 2m pages support implies batching */
-
-        locked = vmballoon_send_lock_page(b, page_to_pfn(page), &hv_status,
-                                                                target);
-        if (locked) {
-                STATS_INC(b->stats.refused_alloc[false]);
-
-                if (locked == -EIO &&
-                    (hv_status == VMW_BALLOON_ERROR_RESET ||
-                     hv_status == VMW_BALLOON_ERROR_PPN_NOTNEEDED)) {
-                        vmballoon_free_page(page, false);
-                        return -EIO;
-                }
-
-                /*
-                 * Place page on the list of non-balloonable pages
-                 * and retry allocation, unless we already accumulated
-                 * too many of them, in which case take a breather.
-                 */
-                if (page_size->n_refused_pages < VMW_BALLOON_MAX_REFUSED) {
-                        page_size->n_refused_pages++;
-                        list_add(&page->lru, &page_size->refused_pages);
-                } else {
-                        vmballoon_free_page(page, false);
-                }
-                return locked;
-        }
-
-        /* track allocated page */
-        list_add(&page->lru, &page_size->pages);
+        unsigned long batch_status;
+        struct page *page;
+        unsigned int i, num_pages;
 
-        /* update balloon size */
-        b->size++;
+        num_pages = ctl->n_pages;
+        if (num_pages == 0)
+                return 0;
 
-        return 0;
-}
+        /* communication with the host is done under the communication lock */
+        spin_lock(&b->comm_lock);
 
-static int vmballoon_lock_batched_page(struct vmballoon *b,
-                unsigned int num_pages, bool is_2m_pages, unsigned int *target)
-{
-        int locked, i;
-        u16 size_per_page = vmballoon_page_size(is_2m_pages);
+        i = 0;
+        list_for_each_entry(page, &ctl->pages, lru)
+                vmballoon_add_page(b, i++, page);
 
-        locked = vmballoon_send_batched_lock(b, num_pages, is_2m_pages,
-                        target);
-        if (locked > 0) {
-                for (i = 0; i < num_pages; i++) {
-                        u64 pa = vmballoon_batch_get_pa(b->batch_page, i);
-                        struct page *p = pfn_to_page(pa >> PAGE_SHIFT);
+        batch_status = vmballoon_lock_op(b, ctl->n_pages, ctl->page_size,
+                                         ctl->op);
 
-                        vmballoon_free_page(p, is_2m_pages);
-                }
+        /*
+         * Iterate over the pages in the provided list. Since we are changing
+         * @ctl->n_pages we are saving the original value in @num_pages and
+         * use this value to bound the loop.
+         */
+        for (i = 0; i < num_pages; i++) {
+                unsigned long status;
 
-                return -EIO;
-        }
+                status = vmballoon_status_page(b, i, &page);
 
-        for (i = 0; i < num_pages; i++) {
-                u64 pa = vmballoon_batch_get_pa(b->batch_page, i);
-                struct page *p = pfn_to_page(pa >> PAGE_SHIFT);
-                struct vmballoon_page_size *page_size =
-                                &b->page_sizes[is_2m_pages];
+                /*
+                 * Failure of the whole batch overrides a single operation
+                 * results.
+                 */
+                if (batch_status != VMW_BALLOON_SUCCESS)
+                        status = batch_status;
 
-                locked = vmballoon_batch_get_status(b->batch_page, i);
+                /* Continue if no error happened */
+                if (!vmballoon_handle_one_result(b, page, ctl->page_size,
+                                                 status))
+                        continue;
 
-                switch (locked) {
-                case VMW_BALLOON_SUCCESS:
-                        list_add(&p->lru, &page_size->pages);
-                        b->size += size_per_page;
-                        break;
-                case VMW_BALLOON_ERROR_PPN_PINNED:
-                case VMW_BALLOON_ERROR_PPN_INVALID:
-                        if (page_size->n_refused_pages
-                                        < VMW_BALLOON_MAX_REFUSED) {
-                                list_add(&p->lru, &page_size->refused_pages);
-                                page_size->n_refused_pages++;
-                                break;
-                        }
-                        /* Fallthrough */
-                case VMW_BALLOON_ERROR_RESET:
-                case VMW_BALLOON_ERROR_PPN_NOTNEEDED:
-                        vmballoon_free_page(p, is_2m_pages);
-                        break;
-                default:
-                        /* This should never happen */
-                        WARN_ON_ONCE(true);
-                }
+                /*
+                 * Error happened. Move the pages to the refused list and update
+                 * the pages number.
+                 */
+                list_move(&page->lru, &ctl->refused_pages);
+                ctl->n_pages--;
+                ctl->n_refused_pages++;
         }
 
-        return 0;
+        spin_unlock(&b->comm_lock);
+
+        return batch_status == VMW_BALLOON_SUCCESS ? 0 : -EIO;
 }
 
-/*
- * Release the page allocated for the balloon. Note that we first notify
- * the host so it can make sure the page will be available for the guest
- * to use, if needed.
+/**
+ * vmballoon_release_page_list() - Releases a page list
+ *
+ * @page_list: list of pages to release.
+ * @n_pages: pointer to the number of pages.
+ * @page_size: whether the pages in the list are 2MB (or else 4KB).
+ *
+ * Releases the list of pages and zeros the number of pages.
  */
-static int vmballoon_unlock_page(struct vmballoon *b, unsigned int num_pages,
-                bool is_2m_pages, unsigned int *target)
+static void vmballoon_release_page_list(struct list_head *page_list,
+                                       int *n_pages,
+                                       enum vmballoon_page_size_type page_size)
 {
-        struct page *page = b->page;
-        struct vmballoon_page_size *page_size = &b->page_sizes[false];
-
-        /* is_2m_pages can never happen as 2m pages support implies batching */
+        struct page *page, *tmp;
 
-        if (!vmballoon_send_unlock_page(b, page_to_pfn(page), target)) {
-                list_add(&page->lru, &page_size->pages);
-                return -EIO;
+        list_for_each_entry_safe(page, tmp, page_list, lru) {
+                list_del(&page->lru);
+                __free_pages(page, vmballoon_page_order(page_size));
         }
 
-        /* deallocate page */
-        vmballoon_free_page(page, false);
-        STATS_INC(b->stats.free[false]);
+        *n_pages = 0;
+}
 
-        /* update balloon size */
-        b->size--;
 
-        return 0;
+/*
+ * Release pages that were allocated while attempting to inflate the
+ * balloon but were refused by the host for one reason or another.
+ */
+static void vmballoon_release_refused_pages(struct vmballoon *b,
+                                            struct vmballoon_ctl *ctl)
+{
+        vmballoon_stats_page_inc(b, VMW_BALLOON_PAGE_STAT_REFUSED_FREE,
+                                 ctl->page_size);
+
+        vmballoon_release_page_list(&ctl->refused_pages, &ctl->n_refused_pages,
+                                    ctl->page_size);
 }
 
-static int vmballoon_unlock_batched_page(struct vmballoon *b,
-                                unsigned int num_pages, bool is_2m_pages,
-                                unsigned int *target)
+/**
+ * vmballoon_change - retrieve the required balloon change
+ *
+ * @b: pointer for the balloon.
+ *
+ * Return: the required change for the balloon size. A positive number
+ * indicates inflation, a negative number indicates a deflation.
+ */
+static int64_t vmballoon_change(struct vmballoon *b)
 {
-        int locked, i, ret = 0;
-        bool hv_success;
-        u16 size_per_page = vmballoon_page_size(is_2m_pages);
+        int64_t size, target;
 
-        hv_success = vmballoon_send_batched_unlock(b, num_pages, is_2m_pages,
-                        target);
-        if (!hv_success)
-                ret = -EIO;
+        size = atomic64_read(&b->size);
+        target = READ_ONCE(b->target);
 
-        for (i = 0; i < num_pages; i++) {
-                u64 pa = vmballoon_batch_get_pa(b->batch_page, i);
-                struct page *p = pfn_to_page(pa >> PAGE_SHIFT);
-                struct vmballoon_page_size *page_size =
-                                &b->page_sizes[is_2m_pages];
+        /*
+         * We must cast first because of int sizes
+         * Otherwise we might get huge positives instead of negatives
+         */
 
-                locked = vmballoon_batch_get_status(b->batch_page, i);
-                if (!hv_success || locked != VMW_BALLOON_SUCCESS) {
-                        /*
-                         * That page wasn't successfully unlocked by the
-                         * hypervisor, re-add it to the list of pages owned by
-                         * the balloon driver.
-                         */
-                        list_add(&p->lru, &page_size->pages);
-                } else {
-                        /* deallocate page */
-                        vmballoon_free_page(p, is_2m_pages);
-                        STATS_INC(b->stats.free[is_2m_pages]);
-
-                        /* update balloon size */
-                        b->size -= size_per_page;
-                }
-        }
+        if (b->reset_required)
+                return 0;
+
+        /* consider a 2MB slack on deflate, unless the balloon is emptied */
+        if (target < size && target != 0 &&
+            size - target < vmballoon_page_in_frames(VMW_BALLOON_2M_PAGE))
+                return 0;
 
-        return ret;
+        return target - size;
 }
 
-/*
- * Release pages that were allocated while attempting to inflate the
- * balloon but were refused by the host for one reason or another.
+/**
+ * vmballoon_enqueue_page_list() - Enqueues list of pages after inflation.
+ *
+ * @b: pointer to balloon.
+ * @pages: list of pages to enqueue.
+ * @n_pages: pointer to number of pages in list. The value is zeroed.
+ * @page_size: whether the pages are 2MB or 4KB pages.
+ *
+ * Enqueues the provides list of pages in the ballooned page list, clears the
+ * list and zeroes the number of pages that was provided.
  */
-static void vmballoon_release_refused_pages(struct vmballoon *b,
-                bool is_2m_pages)
+static void vmballoon_enqueue_page_list(struct vmballoon *b,
+                                        struct list_head *pages,
+                                        unsigned int *n_pages,
+                                        enum vmballoon_page_size_type page_size)
 {
-        struct page *page, *next;
-        struct vmballoon_page_size *page_size =
-                        &b->page_sizes[is_2m_pages];
+        struct vmballoon_page_size *page_size_info = &b->page_sizes[page_size];
 
-        list_for_each_entry_safe(page, next, &page_size->refused_pages, lru) {
-                list_del(&page->lru);
-                vmballoon_free_page(page, is_2m_pages);
-                STATS_INC(b->stats.refused_free[is_2m_pages]);
-        }
-
-        page_size->n_refused_pages = 0;
+        list_splice_init(pages, &page_size_info->pages);
+        *n_pages = 0;
 }
 
-static void vmballoon_add_page(struct vmballoon *b, int idx, struct page *p)
+/**
+ * vmballoon_dequeue_page_list() - Dequeues page lists for deflation.
+ *
+ * @b: pointer to balloon.
+ * @pages: list of pages to enqueue.
+ * @n_pages: pointer to number of pages in list. The value is zeroed.
+ * @page_size: whether the pages are 2MB or 4KB pages.
+ * @n_req_pages: the number of requested pages.
+ *
+ * Dequeues the number of requested pages from the balloon for deflation. The
+ * number of dequeued pages may be lower, if not enough pages in the requested
+ * size are available.
+ */
+static void vmballoon_dequeue_page_list(struct vmballoon *b,
+                                        struct list_head *pages,
+                                        unsigned int *n_pages,
+                                        enum vmballoon_page_size_type page_size,
+                                        unsigned int n_req_pages)
 {
-        b->page = p;
-}
+        struct vmballoon_page_size *page_size_info = &b->page_sizes[page_size];
+        struct page *page, *tmp;
+        unsigned int i = 0;
 
-static void vmballoon_add_batched_page(struct vmballoon *b, int idx,
-                                struct page *p)
-{
-        vmballoon_batch_set_pa(b->batch_page, idx,
-                        (u64)page_to_pfn(p) << PAGE_SHIFT);
+        list_for_each_entry_safe(page, tmp, &page_size_info->pages, lru) {
+                list_move(&page->lru, pages);
+                if (++i == n_req_pages)
+                        break;
+        }
+        *n_pages = i;
 }
 
-/*
- * Inflate the balloon towards its target size. Note that we try to limit
- * the rate of allocation to make sure we are not choking the rest of the
- * system.
+/**
+ * vmballoon_inflate() - Inflate the balloon towards its target size.
+ *
+ * @b: pointer to the balloon.
  */
 static void vmballoon_inflate(struct vmballoon *b)
 {
-        unsigned int num_pages = 0;
-        int error = 0;
-        gfp_t flags = VMW_PAGE_ALLOC_NOSLEEP;
-        bool is_2m_pages;
+        int64_t to_inflate_frames;
+        struct vmballoon_ctl ctl = {
+                .pages = LIST_HEAD_INIT(ctl.pages),
+                .refused_pages = LIST_HEAD_INIT(ctl.refused_pages),
+                .page_size = b->max_page_size,
+                .op = VMW_BALLOON_INFLATE
+        };
 
-        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+        while ((to_inflate_frames = vmballoon_change(b)) > 0) {
+                unsigned int to_inflate_pages, page_in_frames;
+                int alloc_error, lock_error = 0;
 
-        /*
-         * First try NOSLEEP page allocations to inflate balloon.
-         *
-         * If we do not throttle nosleep allocations, we can drain all
-         * free pages in the guest quickly (if the balloon target is high).
-         * As a side-effect, draining free pages helps to inform (force)
-         * the guest to start swapping if balloon target is not met yet,
-         * which is a desired behavior. However, balloon driver can consume
-         * all available CPU cycles if too many pages are allocated in a
-         * second. Therefore, we throttle nosleep allocations even when
-         * the guest is not under memory pressure. OTOH, if we have already
-         * predicted that the guest is under memory pressure, then we
-         * slowdown page allocations considerably.
-         */
+                VM_BUG_ON(!list_empty(&ctl.pages));
+                VM_BUG_ON(ctl.n_pages != 0);
 
-        /*
-         * Start with no sleep allocation rate which may be higher
-         * than sleeping allocation rate.
-         */
-        is_2m_pages = b->supported_page_sizes == VMW_BALLOON_NUM_PAGE_SIZES;
+                page_in_frames = vmballoon_page_in_frames(ctl.page_size);
 
-        pr_debug("%s - goal: %d",  __func__, b->target - b->size);
+                to_inflate_pages = min_t(unsigned long, b->batch_max_pages,
+                                         DIV_ROUND_UP_ULL(to_inflate_frames,
+                                                          page_in_frames));
 
-        while (!b->reset_required &&
-                b->size + num_pages * vmballoon_page_size(is_2m_pages)
-                < b->target) {
-                struct page *page;
+                /* Start by allocating */
+                alloc_error = vmballoon_alloc_page_list(b, &ctl,
+                                                        to_inflate_pages);
 
-                if (flags == VMW_PAGE_ALLOC_NOSLEEP)
-                        STATS_INC(b->stats.alloc[is_2m_pages]);
-                else
-                        STATS_INC(b->stats.sleep_alloc);
-
-                page = vmballoon_alloc_page(flags, is_2m_pages);
-                if (!page) {
-                        STATS_INC(b->stats.alloc_fail[is_2m_pages]);
-
-                        if (is_2m_pages) {
-                                b->ops->lock(b, num_pages, true, &b->target);
-
-                                /*
-                                 * ignore errors from locking as we now switch
-                                 * to 4k pages and we might get different
-                                 * errors.
-                                 */
-
-                                num_pages = 0;
-                                is_2m_pages = false;
-                                continue;
-                        }
-
-                        if (flags == VMW_PAGE_ALLOC_CANSLEEP) {
-                                /*
-                                 * CANSLEEP page allocation failed, so guest
-                                 * is under severe memory pressure. We just log
-                                 * the event, but do not stop the inflation
-                                 * due to its negative impact on performance.
-                                 */
-                                STATS_INC(b->stats.sleep_alloc_fail);
+                /* Actually lock the pages by telling the hypervisor */
+                lock_error = vmballoon_lock(b, &ctl);
+
+                /*
+                 * If an error indicates that something serious went wrong,
+                 * stop the inflation.
+                 */
+                if (lock_error)
+                        break;
+
+                /* Update the balloon size */
+                atomic64_add(ctl.n_pages * page_in_frames, &b->size);
+
+                vmballoon_enqueue_page_list(b, &ctl.pages, &ctl.n_pages,
+                                            ctl.page_size);
+
+                /*
+                 * If allocation failed or the number of refused pages exceeds
+                 * the maximum allowed, move to the next page size.
+                 */
+                if (alloc_error ||
+                    ctl.n_refused_pages >= VMW_BALLOON_MAX_REFUSED) {
+                        if (ctl.page_size == VMW_BALLOON_4K_PAGE)
                                 break;
-                        }
 
                         /*
-                         * NOSLEEP page allocation failed, so the guest is
-                         * under memory pressure. Slowing down page alloctions
-                         * seems to be reasonable, but doing so might actually
-                         * cause the hypervisor to throttle us down, resulting
-                         * in degraded performance. We will count on the
-                         * scheduler and standard memory management mechanisms
-                         * for now.
+                         * Ignore errors from locking as we now switch to 4k
+                         * pages and we might get different errors.
                          */
-                        flags = VMW_PAGE_ALLOC_CANSLEEP;
-                        continue;
-                }
-
-                b->ops->add_page(b, num_pages++, page);
-                if (num_pages == b->batch_max_pages) {
-                        error = b->ops->lock(b, num_pages, is_2m_pages,
-                                        &b->target);
-                        num_pages = 0;
-                        if (error)
-                                break;
+                        vmballoon_release_refused_pages(b, &ctl);
+                        ctl.page_size--;
                 }
 
                 cond_resched();
         }
 
-        if (num_pages > 0)
-                b->ops->lock(b, num_pages, is_2m_pages, &b->target);
-
-        vmballoon_release_refused_pages(b, true);
-        vmballoon_release_refused_pages(b, false);
+        /*
+         * Release pages that were allocated while attempting to inflate the
+         * balloon but were refused by the host for one reason or another,
+         * and update the statistics.
+         */
+        if (ctl.n_refused_pages != 0)
+                vmballoon_release_refused_pages(b, &ctl);
 }
 
-/*
+/**
+ * vmballoon_deflate() - Decrease the size of the balloon.
+ *
+ * @b: pointer to the balloon
+ * @n_frames: the number of frames to deflate. If zero, automatically
+ * calculated according to the target size.
+ * @coordinated: whether to coordinate with the host
+ *
  * Decrease the size of the balloon allowing guest to use more memory.
+ *
+ * Return: The number of deflated frames (i.e., basic page size units)
  */
-static void vmballoon_deflate(struct vmballoon *b)
+static unsigned long vmballoon_deflate(struct vmballoon *b, uint64_t n_frames,
+                                       bool coordinated)
 {
-        unsigned is_2m_pages;
-
-        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+        unsigned long deflated_frames = 0;
+        unsigned long tried_frames = 0;
+        struct vmballoon_ctl ctl = {
+                .pages = LIST_HEAD_INIT(ctl.pages),
+                .refused_pages = LIST_HEAD_INIT(ctl.refused_pages),
+                .page_size = VMW_BALLOON_4K_PAGE,
+                .op = VMW_BALLOON_DEFLATE
+        };
 
         /* free pages to reach target */
-        for (is_2m_pages = 0; is_2m_pages < b->supported_page_sizes;
-                        is_2m_pages++) {
-                struct page *page, *next;
-                unsigned int num_pages = 0;
-                struct vmballoon_page_size *page_size =
-                                &b->page_sizes[is_2m_pages];
-
-                list_for_each_entry_safe(page, next, &page_size->pages, lru) {
-                        if (b->reset_required ||
-                                (b->target > 0 &&
-                                        b->size - num_pages
-                                        * vmballoon_page_size(is_2m_pages)
-                                < b->target + vmballoon_page_size(true)))
-                                break;
+        while (true) {
+                unsigned int to_deflate_pages, n_unlocked_frames;
+                unsigned int page_in_frames;
+                int64_t to_deflate_frames;
+                bool deflated_all;
+
+                page_in_frames = vmballoon_page_in_frames(ctl.page_size);
+
+                VM_BUG_ON(!list_empty(&ctl.pages));
+                VM_BUG_ON(ctl.n_pages);
+                VM_BUG_ON(!list_empty(&ctl.refused_pages));
+                VM_BUG_ON(ctl.n_refused_pages);
+
+                /*
+                 * If we were requested a specific number of frames, we try to
+                 * deflate this number of frames. Otherwise, deflation is
+                 * performed according to the target and balloon size.
+                 */
+                to_deflate_frames = n_frames ? n_frames - tried_frames :
+                                               -vmballoon_change(b);
+
+                /* break if no work to do */
+                if (to_deflate_frames <= 0)
+                        break;
+
+                /*
+                 * Calculate the number of frames based on current page size,
+                 * but limit the deflated frames to a single chunk
+                 */
+                to_deflate_pages = min_t(unsigned long, b->batch_max_pages,
+                                         DIV_ROUND_UP_ULL(to_deflate_frames,
+                                                          page_in_frames));
+
+                /* First take the pages from the balloon pages. */
+                vmballoon_dequeue_page_list(b, &ctl.pages, &ctl.n_pages,
+                                            ctl.page_size, to_deflate_pages);
+
+                /*
+                 * Before pages are moving to the refused list, count their
+                 * frames as frames that we tried to deflate.
+                 */
+                tried_frames += ctl.n_pages * page_in_frames;
+
+                /*
+                 * Unlock the pages by communicating with the hypervisor if the
+                 * communication is coordinated (i.e., not pop). We ignore the
+                 * return code. Instead we check if all the pages we manage to
+                 * unlock all the pages. If we failed, we will move to the next
+                 * page size, and would eventually try again later.
+                 */
+                if (coordinated)
+                        vmballoon_lock(b, &ctl);
+
+                /*
+                 * Check if we deflated enough. We will move to the next page
+                 * size if we did not manage to do so. This calculation takes
+                 * place now, as once the pages are released, the number of
+                 * pages is zeroed.
+                 */
+                deflated_all = (ctl.n_pages == to_deflate_pages);
+
+                /* Update local and global counters */
+                n_unlocked_frames = ctl.n_pages * page_in_frames;
+                atomic64_sub(n_unlocked_frames, &b->size);
+                deflated_frames += n_unlocked_frames;
 
-                        list_del(&page->lru);
-                        b->ops->add_page(b, num_pages++, page);
+                vmballoon_stats_page_add(b, VMW_BALLOON_PAGE_STAT_FREE,
+                                         ctl.page_size, ctl.n_pages);
 
-                        if (num_pages == b->batch_max_pages) {
-                                int error;
+                /* free the ballooned pages */
+                vmballoon_release_page_list(&ctl.pages, &ctl.n_pages,
+                                            ctl.page_size);
 
-                                error = b->ops->unlock(b, num_pages,
-                                                is_2m_pages, &b->target);
-                                num_pages = 0;
-                                if (error)
-                                        return;
-                        }
+                /* Return the refused pages to the ballooned list. */
+                vmballoon_enqueue_page_list(b, &ctl.refused_pages,
+                                            &ctl.n_refused_pages,
+                                            ctl.page_size);
 
-                        cond_resched();
+                /* If we failed to unlock all the pages, move to next size. */
+                if (!deflated_all) {
+                        if (ctl.page_size == b->max_page_size)
+                                break;
+                        ctl.page_size++;
                 }
 
-                if (num_pages > 0)
-                        b->ops->unlock(b, num_pages, is_2m_pages, &b->target);
+                cond_resched();
         }
-}
 
-static const struct vmballoon_ops vmballoon_basic_ops = {
-        .add_page = vmballoon_add_page,
-        .lock = vmballoon_lock_page,
-        .unlock = vmballoon_unlock_page
-};
+        return deflated_frames;
+}
 
-static const struct vmballoon_ops vmballoon_batched_ops = {
-        .add_page = vmballoon_add_batched_page,
-        .lock = vmballoon_lock_batched_page,
-        .unlock = vmballoon_unlock_batched_page
-};
+/**
+ * vmballoon_deinit_batching - disables batching mode.
+ *
+ * @b: pointer to &struct vmballoon.
+ *
+ * Disables batching, by deallocating the page for communication with the
+ * hypervisor and disabling the static key to indicate that batching is off.
+ */
+static void vmballoon_deinit_batching(struct vmballoon *b)
+{
+        free_page((unsigned long)b->batch_page);
+        b->batch_page = NULL;
+        static_branch_disable(&vmw_balloon_batching);
+        b->batch_max_pages = 1;
+}
 
-static bool vmballoon_init_batching(struct vmballoon *b)
+/**
+ * vmballoon_init_batching - enable batching mode.
+ *
+ * @b: pointer to &struct vmballoon.
+ *
+ * Enables batching, by allocating a page for communication with the hypervisor
+ * and enabling the static_key to use batching.
+ *
+ * Return: zero on success or an appropriate error-code.
+ */
+static int vmballoon_init_batching(struct vmballoon *b)
 {
         struct page *page;
 
         page = alloc_page(GFP_KERNEL | __GFP_ZERO);
         if (!page)
-                return false;
+                return -ENOMEM;
 
         b->batch_page = page_address(page);
-        return true;
+        b->batch_max_pages = PAGE_SIZE / sizeof(struct vmballoon_batch_entry);
+
+        static_branch_enable(&vmw_balloon_batching);
+
+        return 0;
 }
 
 /*
@@ -932,7 +1197,7 @@ static void vmballoon_doorbell(void *client_data)
 {
         struct vmballoon *b = client_data;
 
-        STATS_INC(b->stats.doorbell);
+        vmballoon_stats_gen_inc(b, VMW_BALLOON_STAT_DOORBELL);
 
         mod_delayed_work(system_freezable_wq, &b->dwork, 0);
 }
@@ -942,11 +1207,8 @@ static void vmballoon_doorbell(void *client_data)
  */
 static void vmballoon_vmci_cleanup(struct vmballoon *b)
 {
-        int error;
-
-        VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, VMCI_INVALID_ID,
-                        VMCI_INVALID_ID, error);
-        STATS_INC(b->stats.doorbell_unset);
+        vmballoon_cmd(b, VMW_BALLOON_CMD_VMCI_DOORBELL_SET,
+                      VMCI_INVALID_ID, VMCI_INVALID_ID);
 
         if (!vmci_handle_is_invalid(b->vmci_doorbell)) {
                 vmci_doorbell_destroy(b->vmci_doorbell);
@@ -954,12 +1216,19 @@ static void vmballoon_vmci_cleanup(struct vmballoon *b)
         }
 }
 
-/*
- * Initialize vmci doorbell, to get notified as soon as balloon changes
+/**
+ * vmballoon_vmci_init - Initialize vmci doorbell.
+ *
+ * @b: pointer to the balloon.
+ *
+ * Return: zero on success or when wakeup command not supported. Error-code
+ * otherwise.
+ *
+ * Initialize vmci doorbell, to get notified as soon as balloon changes.
  */
 static int vmballoon_vmci_init(struct vmballoon *b)
 {
-        unsigned long error, dummy;
+        unsigned long error;
 
         if ((b->capabilities & VMW_BALLOON_SIGNALLED_WAKEUP_CMD) == 0)
                 return 0;
@@ -971,10 +1240,9 @@ static int vmballoon_vmci_init(struct vmballoon *b)
         if (error != VMCI_SUCCESS)
                 goto fail;
 
-        error = VMWARE_BALLOON_CMD(VMCI_DOORBELL_SET, b->vmci_doorbell.context,
-                                   b->vmci_doorbell.resource, dummy);
-
-        STATS_INC(b->stats.doorbell_set);
+        error = __vmballoon_cmd(b, VMW_BALLOON_CMD_VMCI_DOORBELL_SET,
+                                b->vmci_doorbell.context,
+                                b->vmci_doorbell.resource, NULL);
 
         if (error != VMW_BALLOON_SUCCESS)
                 goto fail;
@@ -985,6 +1253,23 @@ fail:
         return -EIO;
 }
 
+/**
+ * vmballoon_pop - Quickly release all pages allocate for the balloon.
+ *
+ * @b: pointer to the balloon.
+ *
+ * This function is called when host decides to "reset" balloon for one reason
+ * or another. Unlike normal "deflate" we do not (shall not) notify host of the
+ * pages being released.
+ */
+static void vmballoon_pop(struct vmballoon *b)
+{
+        unsigned long size;
+
+        while ((size = atomic64_read(&b->size)))
+                vmballoon_deflate(b, size, false);
+}
+
 /*
  * Perform standard reset sequence by popping the balloon (in case it
  * is not  empty) and then restarting protocol. This operation normally
@@ -994,18 +1279,18 @@ static void vmballoon_reset(struct vmballoon *b)
 {
         int error;
 
+        down_write(&b->conf_sem);
+
         vmballoon_vmci_cleanup(b);
 
         /* free all pages, skipping monitor unlock */
         vmballoon_pop(b);
 
-        if (!vmballoon_send_start(b, VMW_BALLOON_CAPABILITIES))
+        if (vmballoon_send_start(b, VMW_BALLOON_CAPABILITIES))
                 return;
 
         if ((b->capabilities & VMW_BALLOON_BATCHED_CMDS) != 0) {
-                b->ops = &vmballoon_batched_ops;
-                b->batch_max_pages = VMW_BALLOON_BATCH_MAX_PAGES;
-                if (!vmballoon_init_batching(b)) {
+                if (vmballoon_init_batching(b)) {
                         /*
                          * We failed to initialize batching, inform the monitor
                          * about it by sending a null capability.
@@ -1016,52 +1301,70 @@ static void vmballoon_reset(struct vmballoon *b)
                         return;
                 }
         } else if ((b->capabilities & VMW_BALLOON_BASIC_CMDS) != 0) {
-                b->ops = &vmballoon_basic_ops;
-                b->batch_max_pages = 1;
+                vmballoon_deinit_batching(b);
         }
 
+        vmballoon_stats_gen_inc(b, VMW_BALLOON_STAT_RESET);
         b->reset_required = false;
 
         error = vmballoon_vmci_init(b);
         if (error)
                 pr_err("failed to initialize vmci doorbell\n");
 
-        if (!vmballoon_send_guest_id(b))
+        if (vmballoon_send_guest_id(b))
                 pr_err("failed to send guest ID to the host\n");
+
+        up_write(&b->conf_sem);
 }
 
-/*
- * Balloon work function: reset protocol, if needed, get the new size and
- * adjust balloon as needed. Repeat in 1 sec.
+/**
+ * vmballoon_work - periodic balloon worker for reset, inflation and deflation.
+ *
+ * @work: pointer to the &work_struct which is provided by the workqueue.
+ *
+ * Resets the protocol if needed, gets the new size and adjusts balloon as
+ * needed. Repeat in 1 sec.
  */
 static void vmballoon_work(struct work_struct *work)
 {
         struct delayed_work *dwork = to_delayed_work(work);
         struct vmballoon *b = container_of(dwork, struct vmballoon, dwork);
-        unsigned int target;
-
-        STATS_INC(b->stats.timer);
+        int64_t change = 0;
 
         if (b->reset_required)
                 vmballoon_reset(b);
 
-        if (!b->reset_required && vmballoon_send_get_target(b, &target)) {
-                /* update target, adjust size */
-                b->target = target;
+        down_read(&b->conf_sem);
+
+        /*
+         * Update the stats while holding the semaphore to ensure that
+         * @stats_enabled is consistent with whether the stats are actually
+         * enabled
+         */
+        vmballoon_stats_gen_inc(b, VMW_BALLOON_STAT_TIMER);
+
+        if (!vmballoon_send_get_target(b))
+                change = vmballoon_change(b);
+
+        if (change != 0) {
+                pr_debug("%s - size: %llu, target %lu\n", __func__,
+                         atomic64_read(&b->size), READ_ONCE(b->target));
 
-                if (b->size < target)
+                if (change > 0)
                         vmballoon_inflate(b);
-                else if (target == 0 ||
-                                b->size > target + vmballoon_page_size(true))
-                        vmballoon_deflate(b);
+                else  /* (change < 0) */
+                        vmballoon_deflate(b, 0, true);
         }
 
+        up_read(&b->conf_sem);
+
         /*
          * We are using a freezable workqueue so that balloon operations are
          * stopped while the system transitions to/from sleep/hibernation.
          */
         queue_delayed_work(system_freezable_wq,
                            dwork, round_jiffies_relative(HZ));
+
 }
 
 /*
@@ -1069,64 +1372,100 @@ static void vmballoon_work(struct work_struct *work)
  */
 #ifdef CONFIG_DEBUG_FS
 
+static const char * const vmballoon_stat_page_names[] = {
+        [VMW_BALLOON_PAGE_STAT_ALLOC]           = "alloc",
+        [VMW_BALLOON_PAGE_STAT_ALLOC_FAIL]      = "allocFail",
+        [VMW_BALLOON_PAGE_STAT_REFUSED_ALLOC]   = "errAlloc",
+        [VMW_BALLOON_PAGE_STAT_REFUSED_FREE]    = "errFree",
+        [VMW_BALLOON_PAGE_STAT_FREE]            = "free"
+};
+
+static const char * const vmballoon_stat_names[] = {
+        [VMW_BALLOON_STAT_TIMER]                = "timer",
+        [VMW_BALLOON_STAT_DOORBELL]             = "doorbell",
+        [VMW_BALLOON_STAT_RESET]                = "reset",
+};
+
+static int vmballoon_enable_stats(struct vmballoon *b)
+{
+        int r = 0;
+
+        down_write(&b->conf_sem);
+
+        /* did we somehow race with another reader which enabled stats? */
+        if (b->stats)
+                goto out;
+
+        b->stats = kzalloc(sizeof(*b->stats), GFP_KERNEL);
+
+        if (!b->stats) {
+                /* allocation failed */
+                r = -ENOMEM;
+                goto out;
+        }
+        static_key_enable(&balloon_stat_enabled.key);
+out:
+        up_write(&b->conf_sem);
+        return r;
+}
+
+/**
+ * vmballoon_debug_show - shows statistics of balloon operations.
+ * @f: pointer to the &struct seq_file.
+ * @offset: ignored.
+ *
+ * Provides the statistics that can be accessed in vmmemctl in the debugfs.
+ * To avoid the overhead - mainly that of memory - of collecting the statistics,
+ * we only collect statistics after the first time the counters are read.
+ *
+ * Return: zero on success or an error code.
+ */
 static int vmballoon_debug_show(struct seq_file *f, void *offset)
 {
         struct vmballoon *b = f->private;
-        struct vmballoon_stats *stats = &b->stats;
+        int i, j;
+
+        /* enables stats if they are disabled */
+        if (!b->stats) {
+                int r = vmballoon_enable_stats(b);
+
+                if (r)
+                        return r;
+        }
 
         /* format capabilities info */
-        seq_printf(f,
-                   "balloon capabilities:   %#4x\n"
-                   "used capabilities:      %#4lx\n"
-                   "is resetting:           %c\n",
-                   VMW_BALLOON_CAPABILITIES, b->capabilities,
-                   b->reset_required ? 'y' : 'n');
+        seq_printf(f, "%-22s: %#16x\n", "balloon capabilities",
+                   VMW_BALLOON_CAPABILITIES);
+        seq_printf(f, "%-22s: %#16lx\n", "used capabilities", b->capabilities);
+        seq_printf(f, "%-22s: %16s\n", "is resetting",
+                   b->reset_required ? "y" : "n");
 
         /* format size info */
-        seq_printf(f,
-                   "target:             %8d pages\n"
-                   "current:            %8d pages\n",
-                   b->target, b->size);
-
-        seq_printf(f,
-                   "\n"
-                   "timer:              %8u\n"
-                   "doorbell:           %8u\n"
-                   "start:              %8u (%4u failed)\n"
-                   "guestType:          %8u (%4u failed)\n"
-                   "2m-lock:            %8u (%4u failed)\n"
-                   "lock:               %8u (%4u failed)\n"
-                   "2m-unlock:          %8u (%4u failed)\n"
-                   "unlock:             %8u (%4u failed)\n"
-                   "target:             %8u (%4u failed)\n"
-                   "prim2mAlloc:        %8u (%4u failed)\n"
-                   "primNoSleepAlloc:   %8u (%4u failed)\n"
-                   "primCanSleepAlloc:  %8u (%4u failed)\n"
-                   "prim2mFree:         %8u\n"
-                   "primFree:           %8u\n"
-                   "err2mAlloc:         %8u\n"
-                   "errAlloc:           %8u\n"
-                   "err2mFree:          %8u\n"
-                   "errFree:            %8u\n"
-                   "doorbellSet:        %8u\n"
-                   "doorbellUnset:      %8u\n",
-                   stats->timer,
-                   stats->doorbell,
-                   stats->start, stats->start_fail,
-                   stats->guest_type, stats->guest_type_fail,
-                   stats->lock[true],  stats->lock_fail[true],
-                   stats->lock[false],  stats->lock_fail[false],
-                   stats->unlock[true], stats->unlock_fail[true],
-                   stats->unlock[false], stats->unlock_fail[false],
-                   stats->target, stats->target_fail,
-                   stats->alloc[true], stats->alloc_fail[true],
-                   stats->alloc[false], stats->alloc_fail[false],
-                   stats->sleep_alloc, stats->sleep_alloc_fail,
-                   stats->free[true],
-                   stats->free[false],
-                   stats->refused_alloc[true], stats->refused_alloc[false],
-                   stats->refused_free[true], stats->refused_free[false],
-                   stats->doorbell_set, stats->doorbell_unset);
+        seq_printf(f, "%-22s: %16lu\n", "target", READ_ONCE(b->target));
+        seq_printf(f, "%-22s: %16llu\n", "current", atomic64_read(&b->size));
+
+        for (i = 0; i < VMW_BALLOON_CMD_NUM; i++) {
+                if (vmballoon_cmd_names[i] == NULL)
+                        continue;
+
+                seq_printf(f, "%-22s: %16llu (%llu failed)\n",
+                           vmballoon_cmd_names[i],
+                           atomic64_read(&b->stats->ops[i][VMW_BALLOON_OP_STAT]),
+                           atomic64_read(&b->stats->ops[i][VMW_BALLOON_OP_FAIL_STAT]));
+        }
+
+        for (i = 0; i < VMW_BALLOON_STAT_NUM; i++)
+                seq_printf(f, "%-22s: %16llu\n",
+                           vmballoon_stat_names[i],
+                           atomic64_read(&b->stats->general_stat[i]));
+
+        for (i = 0; i < VMW_BALLOON_PAGE_STAT_NUM; i++) {
+                for (j = 0; j < VMW_BALLOON_NUM_PAGE_SIZES; j++)
+                        seq_printf(f, "%-18s(%s): %16llu\n",
+                                   vmballoon_stat_page_names[i],
+                                   vmballoon_page_size_names[j],
+                                   atomic64_read(&b->stats->page_stat[i][j]));
+        }
 
         return 0;
 }
@@ -1161,7 +1500,10 @@ static int __init vmballoon_debugfs_init(struct vmballoon *b)
 
 static void __exit vmballoon_debugfs_exit(struct vmballoon *b)
 {
+        static_key_disable(&balloon_stat_enabled.key);
         debugfs_remove(b->dbg_entry);
+        kfree(b->stats);
+        b->stats = NULL;
 }
 
 #else
@@ -1179,8 +1521,9 @@ static inline void vmballoon_debugfs_exit(struct vmballoon *b)
 
 static int __init vmballoon_init(void)
 {
+        enum vmballoon_page_size_type page_size;
         int error;
-        unsigned is_2m_pages;
+
         /*
          * Check if we are running on VMware's hypervisor and bail out
          * if we are not.
@@ -1188,11 +1531,10 @@ static int __init vmballoon_init(void)
         if (x86_hyper_type != X86_HYPER_VMWARE)
                 return -ENODEV;
 
-        for (is_2m_pages = 0; is_2m_pages < VMW_BALLOON_NUM_PAGE_SIZES;
-                        is_2m_pages++) {
-                INIT_LIST_HEAD(&balloon.page_sizes[is_2m_pages].pages);
-                INIT_LIST_HEAD(&balloon.page_sizes[is_2m_pages].refused_pages);
-        }
+        for (page_size = VMW_BALLOON_4K_PAGE;
+             page_size <= VMW_BALLOON_LAST_SIZE; page_size++)
+                INIT_LIST_HEAD(&balloon.page_sizes[page_size].pages);
+
 
         INIT_DELAYED_WORK(&balloon.dwork, vmballoon_work);
 
@@ -1200,6 +1542,8 @@ static int __init vmballoon_init(void)
         if (error)
                 return error;
 
+        spin_lock_init(&balloon.comm_lock);
+        init_rwsem(&balloon.conf_sem);
         balloon.vmci_doorbell = VMCI_INVALID_HANDLE;
         balloon.batch_page = NULL;
         balloon.page = NULL;
diff --git a/drivers/misc/vmw_vmci/vmci_driver.c b/drivers/misc/vmw_vmci/vmci_driver.c
index d7eaf1eb11e7..003bfba40758 100644
--- a/drivers/misc/vmw_vmci/vmci_driver.c
+++ b/drivers/misc/vmw_vmci/vmci_driver.c
@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
 
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
-MODULE_VERSION("1.1.5.0-k");
+MODULE_VERSION("1.1.6.0-k");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
index 83e0c95d20a4..edfffc9699ba 100644
--- a/drivers/misc/vmw_vmci/vmci_host.c
+++ b/drivers/misc/vmw_vmci/vmci_host.c
@@ -15,7 +15,6 @@
 
 #include <linux/vmw_vmci_defs.h>
 #include <linux/vmw_vmci_api.h>
-#include <linux/moduleparam.h>
 #include <linux/miscdevice.h>
 #include <linux/interrupt.h>
 #include <linux/highmem.h>
@@ -448,15 +447,12 @@ static int vmci_host_do_alloc_queuepair(struct vmci_host_dev *vmci_host_dev,
         struct vmci_handle handle;
         int vmci_status;
         int __user *retptr;
-        u32 cid;
 
         if (vmci_host_dev->ct_type != VMCIOBJ_CONTEXT) {
                 vmci_ioctl_err("only valid for contexts\n");
                 return -EINVAL;
         }
 
-        cid = vmci_ctx_get_id(vmci_host_dev->context);
-
         if (vmci_host_dev->user_version < VMCI_VERSION_NOVMVM) {
                 struct vmci_qp_alloc_info_vmvm alloc_info;
                 struct vmci_qp_alloc_info_vmvm __user *info = uptr;
diff --git a/drivers/misc/vmw_vmci/vmci_resource.c b/drivers/misc/vmw_vmci/vmci_resource.c
index 1ab6e8737a5f..da1ee2e1ba99 100644
--- a/drivers/misc/vmw_vmci/vmci_resource.c
+++ b/drivers/misc/vmw_vmci/vmci_resource.c
@@ -57,7 +57,8 @@ static struct vmci_resource *vmci_resource_lookup(struct vmci_handle handle,
 
                 if (r->type == type &&
                     rid == handle.resource &&
-                    (cid == handle.context || cid == VMCI_INVALID_ID)) {
+                    (cid == handle.context || cid == VMCI_INVALID_ID ||
+                     handle.context == VMCI_INVALID_ID)) {
                         resource = r;
                         break;
                 }
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c
index aa1657831b70..9b18ce90f907 100644
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -1,17 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * nvmem framework core.
  *
  * Copyright (C) 2015 Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
  * Copyright (C) 2013 Maxime Ripard <maxime.ripard@free-electrons.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 and
- * only version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
  */
 
 #include <linux/device.h>
@@ -19,6 +11,7 @@
 #include <linux/fs.h>
 #include <linux/idr.h>
 #include <linux/init.h>
+#include <linux/kref.h>
 #include <linux/module.h>
 #include <linux/nvmem-consumer.h>
 #include <linux/nvmem-provider.h>
@@ -26,18 +19,18 @@
 #include <linux/slab.h>
 
 struct nvmem_device {
-        const char              *name;
         struct module           *owner;
         struct device           dev;
         int                     stride;
         int                     word_size;
         int                     id;
-        int                     users;
+        struct kref             refcnt;
         size_t                  size;
         bool                    read_only;
         int                     flags;
         struct bin_attribute    eeprom;
         struct device           *base_dev;
+        struct list_head        cells;
         nvmem_reg_read_t        reg_read;
         nvmem_reg_write_t       reg_write;
         void *priv;
@@ -58,8 +51,13 @@ struct nvmem_cell {
 static DEFINE_MUTEX(nvmem_mutex);
 static DEFINE_IDA(nvmem_ida);
 
-static LIST_HEAD(nvmem_cells);
-static DEFINE_MUTEX(nvmem_cells_mutex);
+static DEFINE_MUTEX(nvmem_cell_mutex);
+static LIST_HEAD(nvmem_cell_tables);
+
+static DEFINE_MUTEX(nvmem_lookup_mutex);
+static LIST_HEAD(nvmem_lookup_list);
+
+static BLOCKING_NOTIFIER_HEAD(nvmem_notifier);
 
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 static struct lock_class_key eeprom_lock_key;
@@ -156,7 +154,7 @@ static ssize_t bin_attr_nvmem_write(struct file *filp, struct kobject *kobj,
 static struct bin_attribute bin_attr_rw_nvmem = {
         .attr   = {
                 .name   = "nvmem",
-                .mode   = S_IWUSR | S_IRUGO,
+                .mode   = 0644,
         },
         .read   = bin_attr_nvmem_read,
         .write  = bin_attr_nvmem_write,
@@ -180,7 +178,7 @@ static const struct attribute_group *nvmem_rw_dev_groups[] = {
 static struct bin_attribute bin_attr_ro_nvmem = {
         .attr   = {
                 .name   = "nvmem",
-                .mode   = S_IRUGO,
+                .mode   = 0444,
         },
         .read   = bin_attr_nvmem_read,
 };
@@ -203,7 +201,7 @@ static const struct attribute_group *nvmem_ro_dev_groups[] = {
 static struct bin_attribute bin_attr_rw_root_nvmem = {
         .attr   = {
                 .name   = "nvmem",
-                .mode   = S_IWUSR | S_IRUSR,
+                .mode   = 0600,
         },
         .read   = bin_attr_nvmem_read,
         .write  = bin_attr_nvmem_write,
@@ -227,7 +225,7 @@ static const struct attribute_group *nvmem_rw_root_dev_groups[] = {
 static struct bin_attribute bin_attr_ro_root_nvmem = {
         .attr   = {
                 .name   = "nvmem",
-                .mode   = S_IRUSR,
+                .mode   = 0400,
         },
         .read   = bin_attr_nvmem_read,
 };
@@ -282,48 +280,42 @@ static struct nvmem_device *of_nvmem_find(struct device_node *nvmem_np)
         return to_nvmem_device(d);
 }
 
-static struct nvmem_cell *nvmem_find_cell(const char *cell_id)
+static struct nvmem_device *nvmem_find(const char *name)
 {
-        struct nvmem_cell *p;
-
-        mutex_lock(&nvmem_cells_mutex);
+        struct device *d;
 
-        list_for_each_entry(p, &nvmem_cells, node)
-                if (!strcmp(p->name, cell_id)) {
-                        mutex_unlock(&nvmem_cells_mutex);
-                        return p;
-                }
+        d = bus_find_device_by_name(&nvmem_bus_type, NULL, name);
 
-        mutex_unlock(&nvmem_cells_mutex);
+        if (!d)
+                return NULL;
 
-        return NULL;
+        return to_nvmem_device(d);
 }
 
 static void nvmem_cell_drop(struct nvmem_cell *cell)
 {
-        mutex_lock(&nvmem_cells_mutex);
+        blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_REMOVE, cell);
+        mutex_lock(&nvmem_mutex);
         list_del(&cell->node);
-        mutex_unlock(&nvmem_cells_mutex);
+        mutex_unlock(&nvmem_mutex);
+        kfree(cell->name);
         kfree(cell);
 }
 
 static void nvmem_device_remove_all_cells(const struct nvmem_device *nvmem)
 {
-        struct nvmem_cell *cell;
-        struct list_head *p, *n;
+        struct nvmem_cell *cell, *p;
 
-        list_for_each_safe(p, n, &nvmem_cells) {
-                cell = list_entry(p, struct nvmem_cell, node);
-                if (cell->nvmem == nvmem)
-                        nvmem_cell_drop(cell);
-        }
+        list_for_each_entry_safe(cell, p, &nvmem->cells, node)
+                nvmem_cell_drop(cell);
 }
 
 static void nvmem_cell_add(struct nvmem_cell *cell)
 {
-        mutex_lock(&nvmem_cells_mutex);
-        list_add_tail(&cell->node, &nvmem_cells);
-        mutex_unlock(&nvmem_cells_mutex);
+        mutex_lock(&nvmem_mutex);
+        list_add_tail(&cell->node, &cell->nvmem->cells);
+        mutex_unlock(&nvmem_mutex);
+        blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell);
 }
 
 static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
@@ -361,7 +353,7 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem,
  *
  * Return: 0 or negative error code on failure.
  */
-int nvmem_add_cells(struct nvmem_device *nvmem,
+static int nvmem_add_cells(struct nvmem_device *nvmem,
                     const struct nvmem_cell_info *info,
                     int ncells)
 {
@@ -400,7 +392,6 @@ err:
 
         return rval;
 }
-EXPORT_SYMBOL_GPL(nvmem_add_cells);
 
 /*
  * nvmem_setup_compat() - Create an additional binary entry in
@@ -440,6 +431,136 @@ static int nvmem_setup_compat(struct nvmem_device *nvmem,
 }
 
 /**
+ * nvmem_register_notifier() - Register a notifier block for nvmem events.
+ *
+ * @nb: notifier block to be called on nvmem events.
+ *
+ * Return: 0 on success, negative error number on failure.
+ */
+int nvmem_register_notifier(struct notifier_block *nb)
+{
+        return blocking_notifier_chain_register(&nvmem_notifier, nb);
+}
+EXPORT_SYMBOL_GPL(nvmem_register_notifier);
+
+/**
+ * nvmem_unregister_notifier() - Unregister a notifier block for nvmem events.
+ *
+ * @nb: notifier block to be unregistered.
+ *
+ * Return: 0 on success, negative error number on failure.
+ */
+int nvmem_unregister_notifier(struct notifier_block *nb)
+{
+        return blocking_notifier_chain_unregister(&nvmem_notifier, nb);
+}
+EXPORT_SYMBOL_GPL(nvmem_unregister_notifier);
+
+static int nvmem_add_cells_from_table(struct nvmem_device *nvmem)
+{
+        const struct nvmem_cell_info *info;
+        struct nvmem_cell_table *table;
+        struct nvmem_cell *cell;
+        int rval = 0, i;
+
+        mutex_lock(&nvmem_cell_mutex);
+        list_for_each_entry(table, &nvmem_cell_tables, node) {
+                if (strcmp(nvmem_dev_name(nvmem), table->nvmem_name) == 0) {
+                        for (i = 0; i < table->ncells; i++) {
+                                info = &table->cells[i];
+
+                                cell = kzalloc(sizeof(*cell), GFP_KERNEL);
+                                if (!cell) {
+                                        rval = -ENOMEM;
+                                        goto out;
+                                }
+
+                                rval = nvmem_cell_info_to_nvmem_cell(nvmem,
+                                                                     info,
+                                                                     cell);
+                                if (rval) {
+                                        kfree(cell);
+                                        goto out;
+                                }
+
+                                nvmem_cell_add(cell);
+                        }
+                }
+        }
+
+out:
+        mutex_unlock(&nvmem_cell_mutex);
+        return rval;
+}
+
+static struct nvmem_cell *
+nvmem_find_cell_by_name(struct nvmem_device *nvmem, const char *cell_id)
+{
+        struct nvmem_cell *cell = NULL;
+
+        mutex_lock(&nvmem_mutex);
+        list_for_each_entry(cell, &nvmem->cells, node) {
+                if (strcmp(cell_id, cell->name) == 0)
+                        break;
+        }
+        mutex_unlock(&nvmem_mutex);
+
+        return cell;
+}
+
+static int nvmem_add_cells_from_of(struct nvmem_device *nvmem)
+{
+        struct device_node *parent, *child;
+        struct device *dev = &nvmem->dev;
+        struct nvmem_cell *cell;
+        const __be32 *addr;
+        int len;
+
+        parent = dev->of_node;
+
+        for_each_child_of_node(parent, child) {
+                addr = of_get_property(child, "reg", &len);
+                if (!addr || (len < 2 * sizeof(u32))) {
+                        dev_err(dev, "nvmem: invalid reg on %pOF\n", child);
+                        return -EINVAL;
+                }
+
+                cell = kzalloc(sizeof(*cell), GFP_KERNEL);
+                if (!cell)
+                        return -ENOMEM;
+
+                cell->nvmem = nvmem;
+                cell->offset = be32_to_cpup(addr++);
+                cell->bytes = be32_to_cpup(addr);
+                cell->name = kasprintf(GFP_KERNEL, "%pOFn", child);
+
+                addr = of_get_property(child, "bits", &len);
+                if (addr && len == (2 * sizeof(u32))) {
+                        cell->bit_offset = be32_to_cpup(addr++);
+                        cell->nbits = be32_to_cpup(addr);
+                }
+
+                if (cell->nbits)
+                        cell->bytes = DIV_ROUND_UP(
+                                        cell->nbits + cell->bit_offset,
+                                        BITS_PER_BYTE);
+
+                if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
+                        dev_err(dev, "cell %s unaligned to nvmem stride %d\n",
+                                cell->name, nvmem->stride);
+                        /* Cells already added will be freed later. */
+                        kfree(cell->name);
+                        kfree(cell);
+                        return -EINVAL;
+                }
+
+                nvmem_cell_add(cell);
+        }
+
+        return 0;
+}
+
+/**
  * nvmem_register() - Register a nvmem device for given nvmem_config.
  * Also creates an binary entry in /sys/bus/nvmem/devices/dev-name/nvmem
  *
@@ -467,6 +588,9 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
                 return ERR_PTR(rval);
         }
 
+        kref_init(&nvmem->refcnt);
+        INIT_LIST_HEAD(&nvmem->cells);
+
         nvmem->id = rval;
         nvmem->owner = config->owner;
         if (!nvmem->owner && config->dev->driver)
@@ -516,11 +640,31 @@ struct nvmem_device *nvmem_register(const struct nvmem_config *config)
                         goto err_device_del;
         }
 
-        if (config->cells)
-                nvmem_add_cells(nvmem, config->cells, config->ncells);
+        if (config->cells) {
+                rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
+                if (rval)
+                        goto err_teardown_compat;
+        }
+
+        rval = nvmem_add_cells_from_table(nvmem);
+        if (rval)
+                goto err_remove_cells;
+
+        rval = nvmem_add_cells_from_of(nvmem);
+        if (rval)
+                goto err_remove_cells;
+
+        rval = blocking_notifier_call_chain(&nvmem_notifier, NVMEM_ADD, nvmem);
+        if (rval)
+                goto err_remove_cells;
 
         return nvmem;
 
+err_remove_cells:
+        nvmem_device_remove_all_cells(nvmem);
+err_teardown_compat:
+        if (config->compat)
+                device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom);
 err_device_del:
         device_del(&nvmem->dev);
 err_put_device:
@@ -530,21 +674,13 @@ err_put_device:
 }
 EXPORT_SYMBOL_GPL(nvmem_register);
 
-/**
- * nvmem_unregister() - Unregister previously registered nvmem device
- *
- * @nvmem: Pointer to previously registered nvmem device.
- *
- * Return: Will be an negative on error or a zero on success.
- */
-int nvmem_unregister(struct nvmem_device *nvmem)
+static void nvmem_device_release(struct kref *kref)
 {
-        mutex_lock(&nvmem_mutex);
-        if (nvmem->users) {
-                mutex_unlock(&nvmem_mutex);
-                return -EBUSY;
-        }
-        mutex_unlock(&nvmem_mutex);
+        struct nvmem_device *nvmem;
+
+        nvmem = container_of(kref, struct nvmem_device, refcnt);
+
+        blocking_notifier_call_chain(&nvmem_notifier, NVMEM_REMOVE, nvmem);
 
         if (nvmem->flags & FLAG_COMPAT)
                 device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom);
@@ -552,14 +688,22 @@ int nvmem_unregister(struct nvmem_device *nvmem)
         nvmem_device_remove_all_cells(nvmem);
         device_del(&nvmem->dev);
         put_device(&nvmem->dev);
+}
 
-        return 0;
+/**
+ * nvmem_unregister() - Unregister previously registered nvmem device
+ *
+ * @nvmem: Pointer to previously registered nvmem device.
+ */
+void nvmem_unregister(struct nvmem_device *nvmem)
+{
+        kref_put(&nvmem->refcnt, nvmem_device_release);
 }
 EXPORT_SYMBOL_GPL(nvmem_unregister);
 
 static void devm_nvmem_release(struct device *dev, void *res)
 {
-        WARN_ON(nvmem_unregister(*(struct nvmem_device **)res));
+        nvmem_unregister(*(struct nvmem_device **)res);
 }
 
 /**
@@ -617,71 +761,34 @@ int devm_nvmem_unregister(struct device *dev, struct nvmem_device *nvmem)
 }
 EXPORT_SYMBOL(devm_nvmem_unregister);
 
-
 static struct nvmem_device *__nvmem_device_get(struct device_node *np,
-                                               struct nvmem_cell **cellp,
-                                               const char *cell_id)
+                                               const char *nvmem_name)
 {
         struct nvmem_device *nvmem = NULL;
 
         mutex_lock(&nvmem_mutex);
-
-        if (np) {
-                nvmem = of_nvmem_find(np);
-                if (!nvmem) {
-                        mutex_unlock(&nvmem_mutex);
-                        return ERR_PTR(-EPROBE_DEFER);
-                }
-        } else {
-                struct nvmem_cell *cell = nvmem_find_cell(cell_id);
-
-                if (cell) {
-                        nvmem = cell->nvmem;
-                        *cellp = cell;
-                }
-
-                if (!nvmem) {
-                        mutex_unlock(&nvmem_mutex);
-                        return ERR_PTR(-ENOENT);
-                }
-        }
-
-        nvmem->users++;
+        nvmem = np ? of_nvmem_find(np) : nvmem_find(nvmem_name);
         mutex_unlock(&nvmem_mutex);
+        if (!nvmem)
+                return ERR_PTR(-EPROBE_DEFER);
 
         if (!try_module_get(nvmem->owner)) {
                 dev_err(&nvmem->dev,
                         "could not increase module refcount for cell %s\n",
-                        nvmem->name);
-
-                mutex_lock(&nvmem_mutex);
-                nvmem->users--;
-                mutex_unlock(&nvmem_mutex);
+                        nvmem_dev_name(nvmem));
 
                 return ERR_PTR(-EINVAL);
         }
 
+        kref_get(&nvmem->refcnt);
+
         return nvmem;
 }
 
 static void __nvmem_device_put(struct nvmem_device *nvmem)
 {
         module_put(nvmem->owner);
-        mutex_lock(&nvmem_mutex);
-        nvmem->users--;
-        mutex_unlock(&nvmem_mutex);
-}
-
-static struct nvmem_device *nvmem_find(const char *name)
-{
-        struct device *d;
-
-        d = bus_find_device_by_name(&nvmem_bus_type, NULL, name);
-
-        if (!d)
-                return NULL;
-
-        return to_nvmem_device(d);
+        kref_put(&nvmem->refcnt, nvmem_device_release);
 }
 
 #if IS_ENABLED(CONFIG_OF)
@@ -706,7 +813,7 @@ struct nvmem_device *of_nvmem_device_get(struct device_node *np, const char *id)
         if (!nvmem_np)
                 return ERR_PTR(-EINVAL);
 
-        return __nvmem_device_get(nvmem_np, NULL, NULL);
+        return __nvmem_device_get(nvmem_np, NULL);
 }
 EXPORT_SYMBOL_GPL(of_nvmem_device_get);
 #endif
@@ -810,44 +917,86 @@ struct nvmem_device *devm_nvmem_device_get(struct device *dev, const char *id)
 }
 EXPORT_SYMBOL_GPL(devm_nvmem_device_get);
 
-static struct nvmem_cell *nvmem_cell_get_from_list(const char *cell_id)
+static struct nvmem_cell *
+nvmem_cell_get_from_lookup(struct device *dev, const char *con_id)
 {
-        struct nvmem_cell *cell = NULL;
+        struct nvmem_cell *cell = ERR_PTR(-ENOENT);
+        struct nvmem_cell_lookup *lookup;
         struct nvmem_device *nvmem;
+        const char *dev_id;
 
-        nvmem = __nvmem_device_get(NULL, &cell, cell_id);
-        if (IS_ERR(nvmem))
-                return ERR_CAST(nvmem);
+        if (!dev)
+                return ERR_PTR(-EINVAL);
 
+        dev_id = dev_name(dev);
+
+        mutex_lock(&nvmem_lookup_mutex);
+
+        list_for_each_entry(lookup, &nvmem_lookup_list, node) {
+                if ((strcmp(lookup->dev_id, dev_id) == 0) &&
+                    (strcmp(lookup->con_id, con_id) == 0)) {
+                        /* This is the right entry. */
+                        nvmem = __nvmem_device_get(NULL, lookup->nvmem_name);
+                        if (IS_ERR(nvmem)) {
+                                /* Provider may not be registered yet. */
+                                cell = ERR_CAST(nvmem);
+                                goto out;
+                        }
+
+                        cell = nvmem_find_cell_by_name(nvmem,
+                                                       lookup->cell_name);
+                        if (!cell) {
+                                __nvmem_device_put(nvmem);
+                                cell = ERR_PTR(-ENOENT);
+                                goto out;
+                        }
+                }
+        }
+
+out:
+        mutex_unlock(&nvmem_lookup_mutex);
         return cell;
 }
 
 #if IS_ENABLED(CONFIG_OF)
+static struct nvmem_cell *
+nvmem_find_cell_by_index(struct nvmem_device *nvmem, int index)
+{
+        struct nvmem_cell *cell = NULL;
+        int i = 0;
+
+        mutex_lock(&nvmem_mutex);
+        list_for_each_entry(cell, &nvmem->cells, node) {
+                if (index == i++)
+                        break;
+        }
+        mutex_unlock(&nvmem_mutex);
+
+        return cell;
+}
+
 /**
  * of_nvmem_cell_get() - Get a nvmem cell from given device node and cell id
  *
  * @np: Device tree node that uses the nvmem cell.
- * @name: nvmem cell name from nvmem-cell-names property, or NULL
- *        for the cell at index 0 (the lone cell with no accompanying
- *        nvmem-cell-names property).
+ * @id: nvmem cell name from nvmem-cell-names property, or NULL
+ *      for the cell at index 0 (the lone cell with no accompanying
+ *      nvmem-cell-names property).
  *
  * Return: Will be an ERR_PTR() on error or a valid pointer
  * to a struct nvmem_cell.  The nvmem_cell will be freed by the
  * nvmem_cell_put().
  */
-struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
-                                            const char *name)
+struct nvmem_cell *of_nvmem_cell_get(struct device_node *np, const char *id)
 {
         struct device_node *cell_np, *nvmem_np;
-        struct nvmem_cell *cell;
         struct nvmem_device *nvmem;
-        const __be32 *addr;
-        int rval, len;
+        struct nvmem_cell *cell;
         int index = 0;
 
         /* if cell name exists, find index to the name */
-        if (name)
-                index = of_property_match_string(np, "nvmem-cell-names", name);
+        if (id)
+                index = of_property_match_string(np, "nvmem-cell-names", id);
 
         cell_np = of_parse_phandle(np, "nvmem-cells", index);
         if (!cell_np)
@@ -857,59 +1006,18 @@ struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
         if (!nvmem_np)
                 return ERR_PTR(-EINVAL);
 
-        nvmem = __nvmem_device_get(nvmem_np, NULL, NULL);
+        nvmem = __nvmem_device_get(nvmem_np, NULL);
         of_node_put(nvmem_np);
         if (IS_ERR(nvmem))
                 return ERR_CAST(nvmem);
 
-        addr = of_get_property(cell_np, "reg", &len);
-        if (!addr || (len < 2 * sizeof(u32))) {
-                dev_err(&nvmem->dev, "nvmem: invalid reg on %pOF\n",
-                        cell_np);
-                rval  = -EINVAL;
-                goto err_mem;
-        }
-
-        cell = kzalloc(sizeof(*cell), GFP_KERNEL);
+        cell = nvmem_find_cell_by_index(nvmem, index);
         if (!cell) {
-                rval = -ENOMEM;
-                goto err_mem;
-        }
-
-        cell->nvmem = nvmem;
-        cell->offset = be32_to_cpup(addr++);
-        cell->bytes = be32_to_cpup(addr);
-        cell->name = cell_np->name;
-
-        addr = of_get_property(cell_np, "bits", &len);
-        if (addr && len == (2 * sizeof(u32))) {
-                cell->bit_offset = be32_to_cpup(addr++);
-                cell->nbits = be32_to_cpup(addr);
+                __nvmem_device_put(nvmem);
+                return ERR_PTR(-ENOENT);
         }
 
-        if (cell->nbits)
-                cell->bytes = DIV_ROUND_UP(cell->nbits + cell->bit_offset,
-                                           BITS_PER_BYTE);
-
-        if (!IS_ALIGNED(cell->offset, nvmem->stride)) {
-                        dev_err(&nvmem->dev,
-                                "cell %s unaligned to nvmem stride %d\n",
-                                cell->name, nvmem->stride);
-                rval  = -EINVAL;
-                goto err_sanity;
-        }
-
-        nvmem_cell_add(cell);
-
         return cell;
-
-err_sanity:
-        kfree(cell);
-
-err_mem:
-        __nvmem_device_put(nvmem);
-
-        return ERR_PTR(rval);
 }
 EXPORT_SYMBOL_GPL(of_nvmem_cell_get);
 #endif
@@ -918,27 +1026,29 @@ EXPORT_SYMBOL_GPL(of_nvmem_cell_get);
  * nvmem_cell_get() - Get nvmem cell of device form a given cell name
  *
  * @dev: Device that requests the nvmem cell.
- * @cell_id: nvmem cell name to get.
+ * @id: nvmem cell name to get (this corresponds with the name from the
+ *      nvmem-cell-names property for DT systems and with the con_id from
+ *      the lookup entry for non-DT systems).
  *
  * Return: Will be an ERR_PTR() on error or a valid pointer
  * to a struct nvmem_cell.  The nvmem_cell will be freed by the
  * nvmem_cell_put().
  */
-struct nvmem_cell *nvmem_cell_get(struct device *dev, const char *cell_id)
+struct nvmem_cell *nvmem_cell_get(struct device *dev, const char *id)
 {
         struct nvmem_cell *cell;
 
         if (dev->of_node) { /* try dt first */
-                cell = of_nvmem_cell_get(dev->of_node, cell_id);
+                cell = of_nvmem_cell_get(dev->of_node, id);
                 if (!IS_ERR(cell) || PTR_ERR(cell) == -EPROBE_DEFER)
                         return cell;
         }
 
-        /* NULL cell_id only allowed for device tree; invalid otherwise */
-        if (!cell_id)
+        /* NULL cell id only allowed for device tree; invalid otherwise */
+        if (!id)
                 return ERR_PTR(-EINVAL);
 
-        return nvmem_cell_get_from_list(cell_id);
+        return nvmem_cell_get_from_lookup(dev, id);
 }
 EXPORT_SYMBOL_GPL(nvmem_cell_get);
 
@@ -1015,7 +1125,6 @@ void nvmem_cell_put(struct nvmem_cell *cell)
         struct nvmem_device *nvmem = cell->nvmem;
 
         __nvmem_device_put(nvmem);
-        nvmem_cell_drop(cell);
 }
 EXPORT_SYMBOL_GPL(nvmem_cell_put);
 
@@ -1267,7 +1376,7 @@ EXPORT_SYMBOL_GPL(nvmem_device_cell_read);
  * @buf: buffer to be written to cell.
  *
  * Return: length of bytes written or negative error code on failure.
- * */
+ */
 int nvmem_device_cell_write(struct nvmem_device *nvmem,
                             struct nvmem_cell_info *info, void *buf)
 {
@@ -1323,7 +1432,7 @@ EXPORT_SYMBOL_GPL(nvmem_device_read);
  * @buf: buffer to be written.
  *
  * Return: length of bytes written or negative error code on failure.
- * */
+ */
 int nvmem_device_write(struct nvmem_device *nvmem,
                        unsigned int offset,
                        size_t bytes, void *buf)
@@ -1343,6 +1452,80 @@ int nvmem_device_write(struct nvmem_device *nvmem,
 }
 EXPORT_SYMBOL_GPL(nvmem_device_write);
 
+/**
+ * nvmem_add_cell_table() - register a table of cell info entries
+ *
+ * @table: table of cell info entries
+ */
+void nvmem_add_cell_table(struct nvmem_cell_table *table)
+{
+        mutex_lock(&nvmem_cell_mutex);
+        list_add_tail(&table->node, &nvmem_cell_tables);
+        mutex_unlock(&nvmem_cell_mutex);
+}
+EXPORT_SYMBOL_GPL(nvmem_add_cell_table);
+
+/**
+ * nvmem_del_cell_table() - remove a previously registered cell info table
+ *
+ * @table: table of cell info entries
+ */
+void nvmem_del_cell_table(struct nvmem_cell_table *table)
+{
+        mutex_lock(&nvmem_cell_mutex);
+        list_del(&table->node);
+        mutex_unlock(&nvmem_cell_mutex);
+}
+EXPORT_SYMBOL_GPL(nvmem_del_cell_table);
+
+/**
+ * nvmem_add_cell_lookups() - register a list of cell lookup entries
+ *
+ * @entries: array of cell lookup entries
+ * @nentries: number of cell lookup entries in the array
+ */
+void nvmem_add_cell_lookups(struct nvmem_cell_lookup *entries, size_t nentries)
+{
+        int i;
+
+        mutex_lock(&nvmem_lookup_mutex);
+        for (i = 0; i < nentries; i++)
+                list_add_tail(&entries[i].node, &nvmem_lookup_list);
+        mutex_unlock(&nvmem_lookup_mutex);
+}
+EXPORT_SYMBOL_GPL(nvmem_add_cell_lookups);
+
+/**
+ * nvmem_del_cell_lookups() - remove a list of previously added cell lookup
+ *                            entries
+ *
+ * @entries: array of cell lookup entries
+ * @nentries: number of cell lookup entries in the array
+ */
+void nvmem_del_cell_lookups(struct nvmem_cell_lookup *entries, size_t nentries)
+{
+        int i;
+
+        mutex_lock(&nvmem_lookup_mutex);
+        for (i = 0; i < nentries; i++)
+                list_del(&entries[i].node);
+        mutex_unlock(&nvmem_lookup_mutex);
+}
+EXPORT_SYMBOL_GPL(nvmem_del_cell_lookups);
+
+/**
+ * nvmem_dev_name() - Get the name of a given nvmem device.
+ *
+ * @nvmem: nvmem device.
+ *
+ * Return: name of the nvmem device.
+ */
+const char *nvmem_dev_name(struct nvmem_device *nvmem)
+{
+        return dev_name(&nvmem->dev);
+}
+EXPORT_SYMBOL_GPL(nvmem_dev_name);
+
 static int __init nvmem_init(void)
 {
         return bus_register(&nvmem_bus_type);
diff --git a/drivers/nvmem/lpc18xx_eeprom.c b/drivers/nvmem/lpc18xx_eeprom.c
index a9534a6e8636..66cff1e2147a 100644
--- a/drivers/nvmem/lpc18xx_eeprom.c
+++ b/drivers/nvmem/lpc18xx_eeprom.c
@@ -236,7 +236,7 @@ static int lpc18xx_eeprom_probe(struct platform_device *pdev)
         lpc18xx_nvmem_config.dev = dev;
         lpc18xx_nvmem_config.priv = eeprom;
 
-        eeprom->nvmem = nvmem_register(&lpc18xx_nvmem_config);
+        eeprom->nvmem = devm_nvmem_register(dev, &lpc18xx_nvmem_config);
         if (IS_ERR(eeprom->nvmem)) {
                 ret = PTR_ERR(eeprom->nvmem);
                 goto err_clk;
@@ -255,11 +255,6 @@ err_clk:
 static int lpc18xx_eeprom_remove(struct platform_device *pdev)
 {
         struct lpc18xx_eeprom_dev *eeprom = platform_get_drvdata(pdev);
-        int ret;
-
-        ret = nvmem_unregister(eeprom->nvmem);
-        if (ret < 0)
-                return ret;
 
         clk_disable_unprepare(eeprom->clk);
 
diff --git a/drivers/nvmem/mxs-ocotp.c b/drivers/nvmem/mxs-ocotp.c
index 7018e2ef5714..53122f59c4b2 100644
--- a/drivers/nvmem/mxs-ocotp.c
+++ b/drivers/nvmem/mxs-ocotp.c
@@ -177,7 +177,7 @@ static int mxs_ocotp_probe(struct platform_device *pdev)
         ocotp_config.size = data->size;
         ocotp_config.priv = otp;
         ocotp_config.dev = dev;
-        otp->nvmem = nvmem_register(&ocotp_config);
+        otp->nvmem = devm_nvmem_register(dev, &ocotp_config);
         if (IS_ERR(otp->nvmem)) {
                 ret = PTR_ERR(otp->nvmem);
                 goto err_clk;
@@ -199,7 +199,7 @@ static int mxs_ocotp_remove(struct platform_device *pdev)
 
         clk_unprepare(otp->clk);
 
-        return nvmem_unregister(otp->nvmem);
+        return 0;
 }
 
 static struct platform_driver mxs_ocotp_driver = {
diff --git a/drivers/nvmem/sunxi_sid.c b/drivers/nvmem/sunxi_sid.c
index d020f89248fd..570a2e354f30 100644
--- a/drivers/nvmem/sunxi_sid.c
+++ b/drivers/nvmem/sunxi_sid.c
@@ -154,7 +154,7 @@ static int sunxi_sid_probe(struct platform_device *pdev)
         struct resource *res;
         struct nvmem_device *nvmem;
         struct sunxi_sid *sid;
-        int ret, i, size;
+        int i, size;
         char *randomness;
         const struct sunxi_sid_cfg *cfg;
 
@@ -181,15 +181,13 @@ static int sunxi_sid_probe(struct platform_device *pdev)
         else
                 econfig.reg_read = sunxi_sid_read;
         econfig.priv = sid;
-        nvmem = nvmem_register(&econfig);
+        nvmem = devm_nvmem_register(dev, &econfig);
         if (IS_ERR(nvmem))
                 return PTR_ERR(nvmem);
 
         randomness = kzalloc(size, GFP_KERNEL);
-        if (!randomness) {
-                ret = -EINVAL;
-                goto err_unreg_nvmem;
-        }
+        if (!randomness)
+                return -ENOMEM;
 
         for (i = 0; i < size; i++)
                 econfig.reg_read(sid, i, &randomness[i], 1);
@@ -200,17 +198,6 @@ static int sunxi_sid_probe(struct platform_device *pdev)
         platform_set_drvdata(pdev, nvmem);
 
         return 0;
-
-err_unreg_nvmem:
-        nvmem_unregister(nvmem);
-        return ret;
-}
-
-static int sunxi_sid_remove(struct platform_device *pdev)
-{
-        struct nvmem_device *nvmem = platform_get_drvdata(pdev);
-
-        return nvmem_unregister(nvmem);
 }
 
 static const struct sunxi_sid_cfg sun4i_a10_cfg = {
@@ -243,7 +230,6 @@ MODULE_DEVICE_TABLE(of, sunxi_sid_of_match);
 
 static struct platform_driver sunxi_sid_driver = {
         .probe = sunxi_sid_probe,
-        .remove = sunxi_sid_remove,
         .driver = {
                 .name = "eeprom-sunxi-sid",
                 .of_match_table = sunxi_sid_of_match,
diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
index 2da567540c2d..7c639006252e 100644
--- a/drivers/platform/goldfish/goldfish_pipe.c
+++ b/drivers/platform/goldfish/goldfish_pipe.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Copyright (C) 2012 Intel, Inc.
  * Copyright (C) 2013 Intel, Inc.
@@ -46,7 +47,6 @@
  * exchange is properly mapped during a transfer.
  */
 
-
 #include <linux/module.h>
 #include <linux/mod_devicetable.h>
 #include <linux/interrupt.h>
@@ -59,10 +59,11 @@
 #include <linux/bitops.h>
 #include <linux/slab.h>
 #include <linux/io.h>
-#include <linux/goldfish.h>
 #include <linux/dma-mapping.h>
 #include <linux/mm.h>
 #include <linux/acpi.h>
+#include <linux/bug.h>
+#include "goldfish_pipe_qemu.h"
 
 /*
  * Update this when something changes in the driver's behavior so the host
@@ -73,71 +74,6 @@ enum {
         PIPE_CURRENT_DEVICE_VERSION = 2
 };
 
-/*
- * IMPORTANT: The following constants must match the ones used and defined
- * in external/qemu/hw/goldfish_pipe.c in the Android source tree.
- */
-
-/* List of bitflags returned in status of CMD_POLL command */
-enum PipePollFlags {
-        PIPE_POLL_IN    = 1 << 0,
-        PIPE_POLL_OUT   = 1 << 1,
-        PIPE_POLL_HUP   = 1 << 2
-};
-
-/* Possible status values used to signal errors - see goldfish_pipe_error_convert */
-enum PipeErrors {
-        PIPE_ERROR_INVAL  = -1,
-        PIPE_ERROR_AGAIN  = -2,
-        PIPE_ERROR_NOMEM  = -3,
-        PIPE_ERROR_IO     = -4
-};
-
-/* Bit-flags used to signal events from the emulator */
-enum PipeWakeFlags {
-        PIPE_WAKE_CLOSED = 1 << 0,  /* emulator closed pipe */
-        PIPE_WAKE_READ   = 1 << 1,  /* pipe can now be read from */
-        PIPE_WAKE_WRITE  = 1 << 2  /* pipe can now be written to */
-};
-
-/* Bit flags for the 'flags' field */
-enum PipeFlagsBits {
-        BIT_CLOSED_ON_HOST = 0,  /* pipe closed by host */
-        BIT_WAKE_ON_WRITE  = 1,  /* want to be woken on writes */
-        BIT_WAKE_ON_READ   = 2,  /* want to be woken on reads */
-};
-
-enum PipeRegs {
-        PIPE_REG_CMD = 0,
-
-        PIPE_REG_SIGNAL_BUFFER_HIGH = 4,
-        PIPE_REG_SIGNAL_BUFFER = 8,
-        PIPE_REG_SIGNAL_BUFFER_COUNT = 12,
-
-        PIPE_REG_OPEN_BUFFER_HIGH = 20,
-        PIPE_REG_OPEN_BUFFER = 24,
-
-        PIPE_REG_VERSION = 36,
-
-        PIPE_REG_GET_SIGNALLED = 48,
-};
-
-enum PipeCmdCode {
-        PIPE_CMD_OPEN = 1,      /* to be used by the pipe device itself */
-        PIPE_CMD_CLOSE,
-        PIPE_CMD_POLL,
-        PIPE_CMD_WRITE,
-        PIPE_CMD_WAKE_ON_WRITE,
-        PIPE_CMD_READ,
-        PIPE_CMD_WAKE_ON_READ,
-
-        /*
-         * TODO(zyy): implement a deferred read/write execution to allow
-         * parallel processing of pipe operations on the host.
-         */
-        PIPE_CMD_WAKE_ON_DONE_IO,
-};
-
 enum {
         MAX_BUFFERS_PER_COMMAND = 336,
         MAX_SIGNALLED_PIPES = 64,
@@ -145,14 +81,12 @@ enum {
 };
 
 struct goldfish_pipe_dev;
-struct goldfish_pipe;
-struct goldfish_pipe_command;
 
 /* A per-pipe command structure, shared with the host */
 struct goldfish_pipe_command {
-        s32 cmd;                /* PipeCmdCode, guest -> host */
-        s32 id;                 /* pipe id, guest -> host */
-        s32 status;             /* command execution status, host -> guest */
+        s32 cmd;        /* PipeCmdCode, guest -> host */
+        s32 id;         /* pipe id, guest -> host */
+        s32 status;     /* command execution status, host -> guest */
         s32 reserved;   /* to pad to 64-bit boundary */
         union {
                 /* Parameters for PIPE_CMD_{READ,WRITE} */
@@ -184,19 +118,21 @@ struct open_command_param {
 /* Device-level set of buffers shared with the host */
 struct goldfish_pipe_dev_buffers {
         struct open_command_param open_command_params;
-        struct signalled_pipe_buffer signalled_pipe_buffers[
-                MAX_SIGNALLED_PIPES];
+        struct signalled_pipe_buffer
+                signalled_pipe_buffers[MAX_SIGNALLED_PIPES];
 };
 
 /* This data type models a given pipe instance */
 struct goldfish_pipe {
         /* pipe ID - index into goldfish_pipe_dev::pipes array */
         u32 id;
+
         /* The wake flags pipe is waiting for
          * Note: not protected with any lock, uses atomic operations
          *  and barriers to make it thread-safe.
          */
         unsigned long flags;
+
         /* wake flags host have signalled,
          *  - protected by goldfish_pipe_dev::lock
          */
@@ -220,8 +156,12 @@ struct goldfish_pipe {
 
         /* A wake queue for sleeping until host signals an event */
         wait_queue_head_t wake_queue;
+
         /* Pointer to the parent goldfish_pipe_dev instance */
         struct goldfish_pipe_dev *dev;
+
+        /* A buffer of pages, too large to fit into a stack frame */
+        struct page *pages[MAX_BUFFERS_PER_COMMAND];
 };
 
 /* The global driver data. Holds a reference to the i/o page used to
@@ -229,6 +169,9 @@ struct goldfish_pipe {
  * waiting to be awoken.
  */
 struct goldfish_pipe_dev {
+        /* A magic number to check if this is an instance of this struct */
+        void *magic;
+
         /*
          * Global device spinlock. Protects the following members:
          *  - pipes, pipes_capacity
@@ -261,15 +204,22 @@ struct goldfish_pipe_dev {
         /* Head of a doubly linked list of signalled pipes */
         struct goldfish_pipe *first_signalled_pipe;
 
+        /* ptr to platform device's device struct */
+        struct device *pdev_dev;
+
         /* Some device-specific data */
         int irq;
         int version;
         unsigned char __iomem *base;
-};
 
-static struct goldfish_pipe_dev pipe_dev[1] = {};
+        /* an irq tasklet to run goldfish_interrupt_task */
+        struct tasklet_struct irq_tasklet;
 
-static int goldfish_cmd_locked(struct goldfish_pipe *pipe, enum PipeCmdCode cmd)
+        struct miscdevice miscdev;
+};
+
+static int goldfish_pipe_cmd_locked(struct goldfish_pipe *pipe,
+                                    enum PipeCmdCode cmd)
 {
         pipe->command_buffer->cmd = cmd;
         /* failure by default */
@@ -278,13 +228,13 @@ static int goldfish_cmd_locked(struct goldfish_pipe *pipe, enum PipeCmdCode cmd)
         return pipe->command_buffer->status;
 }
 
-static int goldfish_cmd(struct goldfish_pipe *pipe, enum PipeCmdCode cmd)
+static int goldfish_pipe_cmd(struct goldfish_pipe *pipe, enum PipeCmdCode cmd)
 {
         int status;
 
         if (mutex_lock_interruptible(&pipe->lock))
                 return PIPE_ERROR_IO;
-        status = goldfish_cmd_locked(pipe, cmd);
+        status = goldfish_pipe_cmd_locked(pipe, cmd);
         mutex_unlock(&pipe->lock);
         return status;
 }
@@ -307,10 +257,12 @@ static int goldfish_pipe_error_convert(int status)
         }
 }
 
-static int pin_user_pages(unsigned long first_page, unsigned long last_page,
-        unsigned int last_page_size, int is_write,
-        struct page *pages[MAX_BUFFERS_PER_COMMAND],
-        unsigned int *iter_last_page_size)
+static int pin_user_pages(unsigned long first_page,
+                          unsigned long last_page,
+                          unsigned int last_page_size,
+                          int is_write,
+                          struct page *pages[MAX_BUFFERS_PER_COMMAND],
+                          unsigned int *iter_last_page_size)
 {
         int ret;
         int requested_pages = ((last_page - first_page) >> PAGE_SHIFT) + 1;
@@ -322,18 +274,18 @@ static int pin_user_pages(unsigned long first_page, unsigned long last_page,
                 *iter_last_page_size = last_page_size;
         }
 
-        ret = get_user_pages_fast(
-                        first_page, requested_pages, !is_write, pages);
+        ret = get_user_pages_fast(first_page, requested_pages, !is_write,
+                                  pages);
         if (ret <= 0)
                 return -EFAULT;
         if (ret < requested_pages)
                 *iter_last_page_size = PAGE_SIZE;
-        return ret;
 
+        return ret;
 }
 
 static void release_user_pages(struct page **pages, int pages_count,
-        int is_write, s32 consumed_size)
+                               int is_write, s32 consumed_size)
 {
         int i;
 
@@ -345,12 +297,15 @@ static void release_user_pages(struct page **pages, int pages_count,
 }
 
 /* Populate the call parameters, merging adjacent pages together */
-static void populate_rw_params(
-        struct page **pages, int pages_count,
-        unsigned long address, unsigned long address_end,
-        unsigned long first_page, unsigned long last_page,
-        unsigned int iter_last_page_size, int is_write,
-        struct goldfish_pipe_command *command)
+static void populate_rw_params(struct page **pages,
+                               int pages_count,
+                               unsigned long address,
+                               unsigned long address_end,
+                               unsigned long first_page,
+                               unsigned long last_page,
+                               unsigned int iter_last_page_size,
+                               int is_write,
+                               struct goldfish_pipe_command *command)
 {
         /*
          * Process the first page separately - it's the only page that
@@ -382,55 +337,59 @@ static void populate_rw_params(
 }
 
 static int transfer_max_buffers(struct goldfish_pipe *pipe,
-        unsigned long address, unsigned long address_end, int is_write,
-        unsigned long last_page, unsigned int last_page_size,
-        s32 *consumed_size, int *status)
+                                unsigned long address,
+                                unsigned long address_end,
+                                int is_write,
+                                unsigned long last_page,
+                                unsigned int last_page_size,
+                                s32 *consumed_size,
+                                int *status)
 {
-        static struct page *pages[MAX_BUFFERS_PER_COMMAND];
         unsigned long first_page = address & PAGE_MASK;
         unsigned int iter_last_page_size;
-        int pages_count = pin_user_pages(first_page, last_page,
-                        last_page_size, is_write,
-                        pages, &iter_last_page_size);
-
-        if (pages_count < 0)
-                return pages_count;
+        int pages_count;
 
         /* Serialize access to the pipe command buffers */
         if (mutex_lock_interruptible(&pipe->lock))
                 return -ERESTARTSYS;
 
-        populate_rw_params(pages, pages_count, address, address_end,
-                first_page, last_page, iter_last_page_size, is_write,
-                pipe->command_buffer);
+        pages_count = pin_user_pages(first_page, last_page,
+                                     last_page_size, is_write,
+                                     pipe->pages, &iter_last_page_size);
+        if (pages_count < 0) {
+                mutex_unlock(&pipe->lock);
+                return pages_count;
+        }
+
+        populate_rw_params(pipe->pages, pages_count, address, address_end,
+                           first_page, last_page, iter_last_page_size, is_write,
+                           pipe->command_buffer);
 
         /* Transfer the data */
-        *status = goldfish_cmd_locked(pipe,
+        *status = goldfish_pipe_cmd_locked(pipe,
                                 is_write ? PIPE_CMD_WRITE : PIPE_CMD_READ);
 
         *consumed_size = pipe->command_buffer->rw_params.consumed_size;
 
-        release_user_pages(pages, pages_count, is_write, *consumed_size);
+        release_user_pages(pipe->pages, pages_count, is_write, *consumed_size);
 
         mutex_unlock(&pipe->lock);
-
         return 0;
 }
 
 static int wait_for_host_signal(struct goldfish_pipe *pipe, int is_write)
 {
-        u32 wakeBit = is_write ? BIT_WAKE_ON_WRITE : BIT_WAKE_ON_READ;
+        u32 wake_bit = is_write ? BIT_WAKE_ON_WRITE : BIT_WAKE_ON_READ;
 
-        set_bit(wakeBit, &pipe->flags);
+        set_bit(wake_bit, &pipe->flags);
 
         /* Tell the emulator we're going to wait for a wake event */
-        (void)goldfish_cmd(pipe,
+        goldfish_pipe_cmd(pipe,
                 is_write ? PIPE_CMD_WAKE_ON_WRITE : PIPE_CMD_WAKE_ON_READ);
 
-        while (test_bit(wakeBit, &pipe->flags)) {
-                if (wait_event_interruptible(
-                                pipe->wake_queue,
-                                !test_bit(wakeBit, &pipe->flags)))
+        while (test_bit(wake_bit, &pipe->flags)) {
+                if (wait_event_interruptible(pipe->wake_queue,
+                                             !test_bit(wake_bit, &pipe->flags)))
                         return -ERESTARTSYS;
 
                 if (test_bit(BIT_CLOSED_ON_HOST, &pipe->flags))
@@ -441,7 +400,9 @@ static int wait_for_host_signal(struct goldfish_pipe *pipe, int is_write)
 }
 
 static ssize_t goldfish_pipe_read_write(struct file *filp,
-        char __user *buffer, size_t bufflen, int is_write)
+                                        char __user *buffer,
+                                        size_t bufflen,
+                                        int is_write)
 {
         struct goldfish_pipe *pipe = filp->private_data;
         int count = 0, ret = -EINVAL;
@@ -456,7 +417,7 @@ static ssize_t goldfish_pipe_read_write(struct file *filp,
                 return 0;
         /* Check the buffer range for access */
         if (unlikely(!access_ok(is_write ? VERIFY_WRITE : VERIFY_READ,
-                        buffer, bufflen)))
+                                buffer, bufflen)))
                 return -EFAULT;
 
         address = (unsigned long)buffer;
@@ -469,8 +430,8 @@ static ssize_t goldfish_pipe_read_write(struct file *filp,
                 int status;
 
                 ret = transfer_max_buffers(pipe, address, address_end, is_write,
-                                last_page, last_page_size, &consumed_size,
-                                &status);
+                                           last_page, last_page_size,
+                                           &consumed_size, &status);
                 if (ret < 0)
                         break;
 
@@ -496,7 +457,8 @@ static ssize_t goldfish_pipe_read_write(struct file *filp,
                          * err.
                          */
                         if (status != PIPE_ERROR_AGAIN)
-                                pr_info_ratelimited("goldfish_pipe: backend error %d on %s\n",
+                                dev_err_ratelimited(pipe->dev->pdev_dev,
+                                        "backend error %d on %s\n",
                                         status, is_write ? "write" : "read");
                         break;
                 }
@@ -522,19 +484,21 @@ static ssize_t goldfish_pipe_read_write(struct file *filp,
 }
 
 static ssize_t goldfish_pipe_read(struct file *filp, char __user *buffer,
-                                size_t bufflen, loff_t *ppos)
+                                  size_t bufflen, loff_t *ppos)
 {
         return goldfish_pipe_read_write(filp, buffer, bufflen,
-                        /* is_write */ 0);
+                                        /* is_write */ 0);
 }
 
 static ssize_t goldfish_pipe_write(struct file *filp,
-                                const char __user *buffer, size_t bufflen,
-                                loff_t *ppos)
+                                   const char __user *buffer, size_t bufflen,
+                                   loff_t *ppos)
 {
-        return goldfish_pipe_read_write(filp,
-                        /* cast away the const */(char __user *)buffer, bufflen,
-                        /* is_write */ 1);
+        /* cast away the const */
+        char __user *no_const_buffer = (char __user *)buffer;
+
+        return goldfish_pipe_read_write(filp, no_const_buffer, bufflen,
+                                        /* is_write */ 1);
 }
 
 static __poll_t goldfish_pipe_poll(struct file *filp, poll_table *wait)
@@ -545,7 +509,7 @@ static __poll_t goldfish_pipe_poll(struct file *filp, poll_table *wait)
 
         poll_wait(filp, &pipe->wake_queue, wait);
 
-        status = goldfish_cmd(pipe, PIPE_CMD_POLL);
+        status = goldfish_pipe_cmd(pipe, PIPE_CMD_POLL);
         if (status < 0)
                 return -ERESTARTSYS;
 
@@ -562,7 +526,7 @@ static __poll_t goldfish_pipe_poll(struct file *filp, poll_table *wait)
 }
 
 static void signalled_pipes_add_locked(struct goldfish_pipe_dev *dev,
-        u32 id, u32 flags)
+                                       u32 id, u32 flags)
 {
         struct goldfish_pipe *pipe;
 
@@ -574,8 +538,8 @@ static void signalled_pipes_add_locked(struct goldfish_pipe_dev *dev,
                 return;
         pipe->signalled_flags |= flags;
 
-        if (pipe->prev_signalled || pipe->next_signalled
-                || dev->first_signalled_pipe == pipe)
+        if (pipe->prev_signalled || pipe->next_signalled ||
+                dev->first_signalled_pipe == pipe)
                 return; /* already in the list */
         pipe->next_signalled = dev->first_signalled_pipe;
         if (dev->first_signalled_pipe)
@@ -584,7 +548,8 @@ static void signalled_pipes_add_locked(struct goldfish_pipe_dev *dev,
 }
 
 static void signalled_pipes_remove_locked(struct goldfish_pipe_dev *dev,
-        struct goldfish_pipe *pipe) {
+                                          struct goldfish_pipe *pipe)
+{
         if (pipe->prev_signalled)
                 pipe->prev_signalled->next_signalled = pipe->next_signalled;
         if (pipe->next_signalled)
@@ -623,10 +588,10 @@ static struct goldfish_pipe *signalled_pipes_pop_front(
         return pipe;
 }
 
-static void goldfish_interrupt_task(unsigned long unused)
+static void goldfish_interrupt_task(unsigned long dev_addr)
 {
-        struct goldfish_pipe_dev *dev = pipe_dev;
         /* Iterate over the signalled pipes and wake them one by one */
+        struct goldfish_pipe_dev *dev = (struct goldfish_pipe_dev *)dev_addr;
         struct goldfish_pipe *pipe;
         int wakes;
 
@@ -646,7 +611,9 @@ static void goldfish_interrupt_task(unsigned long unused)
                 wake_up_interruptible(&pipe->wake_queue);
         }
 }
-static DECLARE_TASKLET(goldfish_interrupt_tasklet, goldfish_interrupt_task, 0);
+
+static void goldfish_pipe_device_deinit(struct platform_device *pdev,
+                                        struct goldfish_pipe_dev *dev);
 
 /*
  * The general idea of the interrupt handling:
@@ -668,7 +635,7 @@ static irqreturn_t goldfish_pipe_interrupt(int irq, void *dev_id)
         unsigned long flags;
         struct goldfish_pipe_dev *dev = dev_id;
 
-        if (dev != pipe_dev)
+        if (dev->magic != &goldfish_pipe_device_deinit)
                 return IRQ_NONE;
 
         /* Request the signalled pipes from the device */
@@ -689,7 +656,7 @@ static irqreturn_t goldfish_pipe_interrupt(int irq, void *dev_id)
 
         spin_unlock_irqrestore(&dev->lock, flags);
 
-        tasklet_schedule(&goldfish_interrupt_tasklet);
+        tasklet_schedule(&dev->irq_tasklet);
         return IRQ_HANDLED;
 }
 
@@ -702,7 +669,10 @@ static int get_free_pipe_id_locked(struct goldfish_pipe_dev *dev)
                         return id;
 
         {
-                /* Reallocate the array */
+                /* Reallocate the array.
+                 * Since get_free_pipe_id_locked runs with interrupts disabled,
+                 * we don't want to make calls that could lead to sleep.
+                 */
                 u32 new_capacity = 2 * dev->pipes_capacity;
                 struct goldfish_pipe **pipes =
                         kcalloc(new_capacity, sizeof(*pipes), GFP_ATOMIC);
@@ -717,6 +687,14 @@ static int get_free_pipe_id_locked(struct goldfish_pipe_dev *dev)
         return id;
 }
 
+/* A helper function to get the instance of goldfish_pipe_dev from file */
+static struct goldfish_pipe_dev *to_goldfish_pipe_dev(struct file *file)
+{
+        struct miscdevice *miscdev = file->private_data;
+
+        return container_of(miscdev, struct goldfish_pipe_dev, miscdev);
+}
+
 /**
  *      goldfish_pipe_open - open a channel to the AVD
  *      @inode: inode of device
@@ -730,14 +708,15 @@ static int get_free_pipe_id_locked(struct goldfish_pipe_dev *dev)
  */
 static int goldfish_pipe_open(struct inode *inode, struct file *file)
 {
-        struct goldfish_pipe_dev *dev = pipe_dev;
+        struct goldfish_pipe_dev *dev = to_goldfish_pipe_dev(file);
         unsigned long flags;
         int id;
         int status;
 
         /* Allocate new pipe kernel object */
         struct goldfish_pipe *pipe = kzalloc(sizeof(*pipe), GFP_KERNEL);
-        if (pipe == NULL)
+
+        if (!pipe)
                 return -ENOMEM;
 
         pipe->dev = dev;
@@ -748,6 +727,7 @@ static int goldfish_pipe_open(struct inode *inode, struct file *file)
          * Command buffer needs to be allocated on its own page to make sure
          * it is physically contiguous in host's address space.
          */
+        BUILD_BUG_ON(sizeof(struct goldfish_pipe_command) > PAGE_SIZE);
         pipe->command_buffer =
                 (struct goldfish_pipe_command *)__get_free_page(GFP_KERNEL);
         if (!pipe->command_buffer) {
@@ -772,7 +752,7 @@ static int goldfish_pipe_open(struct inode *inode, struct file *file)
                         MAX_BUFFERS_PER_COMMAND;
         dev->buffers->open_command_params.command_buffer_ptr =
                         (u64)(unsigned long)__pa(pipe->command_buffer);
-        status = goldfish_cmd_locked(pipe, PIPE_CMD_OPEN);
+        status = goldfish_pipe_cmd_locked(pipe, PIPE_CMD_OPEN);
         spin_unlock_irqrestore(&dev->lock, flags);
         if (status < 0)
                 goto err_cmd;
@@ -798,7 +778,7 @@ static int goldfish_pipe_release(struct inode *inode, struct file *filp)
         struct goldfish_pipe_dev *dev = pipe->dev;
 
         /* The guest is closing the channel, so tell the emulator right now */
-        (void)goldfish_cmd(pipe, PIPE_CMD_CLOSE);
+        goldfish_pipe_cmd(pipe, PIPE_CMD_CLOSE);
 
         spin_lock_irqsave(&dev->lock, flags);
         dev->pipes[pipe->id] = NULL;
@@ -820,36 +800,55 @@ static const struct file_operations goldfish_pipe_fops = {
         .release = goldfish_pipe_release,
 };
 
-static struct miscdevice goldfish_pipe_dev = {
-        .minor = MISC_DYNAMIC_MINOR,
-        .name = "goldfish_pipe",
-        .fops = &goldfish_pipe_fops,
-};
+static void init_miscdevice(struct miscdevice *miscdev)
+{
+        memset(miscdev, 0, sizeof(*miscdev));
+
+        miscdev->minor = MISC_DYNAMIC_MINOR;
+        miscdev->name = "goldfish_pipe";
+        miscdev->fops = &goldfish_pipe_fops;
+}
+
+static void write_pa_addr(void *addr, void __iomem *portl, void __iomem *porth)
+{
+        const unsigned long paddr = __pa(addr);
+
+        writel(upper_32_bits(paddr), porth);
+        writel(lower_32_bits(paddr), portl);
+}
 
-static int goldfish_pipe_device_init(struct platform_device *pdev)
+static int goldfish_pipe_device_init(struct platform_device *pdev,
+                                     struct goldfish_pipe_dev *dev)
 {
-        char *page;
-        struct goldfish_pipe_dev *dev = pipe_dev;
-        int err = devm_request_irq(&pdev->dev, dev->irq,
-                                goldfish_pipe_interrupt,
-                                IRQF_SHARED, "goldfish_pipe", dev);
+        int err;
+
+        tasklet_init(&dev->irq_tasklet, &goldfish_interrupt_task,
+                     (unsigned long)dev);
+
+        err = devm_request_irq(&pdev->dev, dev->irq,
+                               goldfish_pipe_interrupt,
+                               IRQF_SHARED, "goldfish_pipe", dev);
         if (err) {
                 dev_err(&pdev->dev, "unable to allocate IRQ for v2\n");
                 return err;
         }
 
-        err = misc_register(&goldfish_pipe_dev);
+        init_miscdevice(&dev->miscdev);
+        err = misc_register(&dev->miscdev);
         if (err) {
                 dev_err(&pdev->dev, "unable to register v2 device\n");
                 return err;
         }
 
+        dev->pdev_dev = &pdev->dev;
         dev->first_signalled_pipe = NULL;
         dev->pipes_capacity = INITIAL_PIPES_CAPACITY;
         dev->pipes = kcalloc(dev->pipes_capacity, sizeof(*dev->pipes),
-                                        GFP_KERNEL);
-        if (!dev->pipes)
+                             GFP_KERNEL);
+        if (!dev->pipes) {
+                misc_deregister(&dev->miscdev);
                 return -ENOMEM;
+        }
 
         /*
          * We're going to pass two buffers, open_command_params and
@@ -857,75 +856,67 @@ static int goldfish_pipe_device_init(struct platform_device *pdev)
          * needs to be contained in a single physical page. The easiest choice
          * is to just allocate a page and place the buffers in it.
          */
-        if (WARN_ON(sizeof(*dev->buffers) > PAGE_SIZE))
-                return -ENOMEM;
-
-        page = (char *)__get_free_page(GFP_KERNEL);
-        if (!page) {
+        BUILD_BUG_ON(sizeof(struct goldfish_pipe_dev_buffers) > PAGE_SIZE);
+        dev->buffers = (struct goldfish_pipe_dev_buffers *)
+                __get_free_page(GFP_KERNEL);
+        if (!dev->buffers) {
                 kfree(dev->pipes);
+                misc_deregister(&dev->miscdev);
                 return -ENOMEM;
         }
-        dev->buffers = (struct goldfish_pipe_dev_buffers *)page;
 
         /* Send the buffer addresses to the host */
-        {
-                u64 paddr = __pa(&dev->buffers->signalled_pipe_buffers);
-
-                writel((u32)(unsigned long)(paddr >> 32),
-                        dev->base + PIPE_REG_SIGNAL_BUFFER_HIGH);
-                writel((u32)(unsigned long)paddr,
-                        dev->base + PIPE_REG_SIGNAL_BUFFER);
-                writel((u32)MAX_SIGNALLED_PIPES,
-                        dev->base + PIPE_REG_SIGNAL_BUFFER_COUNT);
-
-                paddr = __pa(&dev->buffers->open_command_params);
-                writel((u32)(unsigned long)(paddr >> 32),
-                        dev->base + PIPE_REG_OPEN_BUFFER_HIGH);
-                writel((u32)(unsigned long)paddr,
-                        dev->base + PIPE_REG_OPEN_BUFFER);
-        }
+        write_pa_addr(&dev->buffers->signalled_pipe_buffers,
+                      dev->base + PIPE_REG_SIGNAL_BUFFER,
+                      dev->base + PIPE_REG_SIGNAL_BUFFER_HIGH);
+
+        writel(MAX_SIGNALLED_PIPES,
+               dev->base + PIPE_REG_SIGNAL_BUFFER_COUNT);
+
+        write_pa_addr(&dev->buffers->open_command_params,
+                      dev->base + PIPE_REG_OPEN_BUFFER,
+                      dev->base + PIPE_REG_OPEN_BUFFER_HIGH);
+
+        platform_set_drvdata(pdev, dev);
         return 0;
 }
 
-static void goldfish_pipe_device_deinit(struct platform_device *pdev)
+static void goldfish_pipe_device_deinit(struct platform_device *pdev,
+                                        struct goldfish_pipe_dev *dev)
 {
-        struct goldfish_pipe_dev *dev = pipe_dev;
-
-        misc_deregister(&goldfish_pipe_dev);
+        misc_deregister(&dev->miscdev);
+        tasklet_kill(&dev->irq_tasklet);
         kfree(dev->pipes);
         free_page((unsigned long)dev->buffers);
 }
 
 static int goldfish_pipe_probe(struct platform_device *pdev)
 {
-        int err;
         struct resource *r;
-        struct goldfish_pipe_dev *dev = pipe_dev;
+        struct goldfish_pipe_dev *dev;
 
-        if (WARN_ON(sizeof(struct goldfish_pipe_command) > PAGE_SIZE))
+        dev = devm_kzalloc(&pdev->dev, sizeof(*dev), GFP_KERNEL);
+        if (!dev)
                 return -ENOMEM;
 
-        /* not thread safe, but this should not happen */
-        WARN_ON(dev->base != NULL);
-
+        dev->magic = &goldfish_pipe_device_deinit;
         spin_lock_init(&dev->lock);
 
         r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        if (r == NULL || resource_size(r) < PAGE_SIZE) {
+        if (!r || resource_size(r) < PAGE_SIZE) {
                 dev_err(&pdev->dev, "can't allocate i/o page\n");
                 return -EINVAL;
         }
         dev->base = devm_ioremap(&pdev->dev, r->start, PAGE_SIZE);
-        if (dev->base == NULL) {
+        if (!dev->base) {
                 dev_err(&pdev->dev, "ioremap failed\n");
                 return -EINVAL;
         }
 
         r = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (r == NULL) {
-                err = -EINVAL;
-                goto error;
-        }
+        if (!r)
+                return -EINVAL;
+
         dev->irq = r->start;
 
         /*
@@ -935,25 +926,19 @@ static int goldfish_pipe_probe(struct platform_device *pdev)
          *  reading device version back: this allows the host implementation to
          *  detect the old driver (if there was no version write before read).
          */
-        writel((u32)PIPE_DRIVER_VERSION, dev->base + PIPE_REG_VERSION);
+        writel(PIPE_DRIVER_VERSION, dev->base + PIPE_REG_VERSION);
         dev->version = readl(dev->base + PIPE_REG_VERSION);
         if (WARN_ON(dev->version < PIPE_CURRENT_DEVICE_VERSION))
                 return -EINVAL;
 
-        err = goldfish_pipe_device_init(pdev);
-        if (!err)
-                return 0;
-
-error:
-        dev->base = NULL;
-        return err;
+        return goldfish_pipe_device_init(pdev, dev);
 }
 
 static int goldfish_pipe_remove(struct platform_device *pdev)
 {
-        struct goldfish_pipe_dev *dev = pipe_dev;
-        goldfish_pipe_device_deinit(pdev);
-        dev->base = NULL;
+        struct goldfish_pipe_dev *dev = platform_get_drvdata(pdev);
+
+        goldfish_pipe_device_deinit(pdev, dev);
         return 0;
 }
 
@@ -981,4 +966,4 @@ static struct platform_driver goldfish_pipe_driver = {
 
 module_platform_driver(goldfish_pipe_driver);
 MODULE_AUTHOR("David Turner <digit@google.com>");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/platform/goldfish/goldfish_pipe_qemu.h b/drivers/platform/goldfish/goldfish_pipe_qemu.h
new file mode 100644
index 000000000000..b4d78c108afd
--- /dev/null
+++ b/drivers/platform/goldfish/goldfish_pipe_qemu.h
@@ -0,0 +1,98 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * IMPORTANT: The following constants must match the ones used and defined in
+ * external/qemu/include/hw/misc/goldfish_pipe.h
+ */
+
+#ifndef GOLDFISH_PIPE_QEMU_H
+#define GOLDFISH_PIPE_QEMU_H
+
+/* List of bitflags returned in status of CMD_POLL command */
+enum PipePollFlags {
+        PIPE_POLL_IN    = 1 << 0,
+        PIPE_POLL_OUT   = 1 << 1,
+        PIPE_POLL_HUP   = 1 << 2
+};
+
+/* Possible status values used to signal errors */
+enum PipeErrors {
+        PIPE_ERROR_INVAL        = -1,
+        PIPE_ERROR_AGAIN        = -2,
+        PIPE_ERROR_NOMEM        = -3,
+        PIPE_ERROR_IO           = -4
+};
+
+/* Bit-flags used to signal events from the emulator */
+enum PipeWakeFlags {
+        /* emulator closed pipe */
+        PIPE_WAKE_CLOSED                = 1 << 0,
+
+        /* pipe can now be read from */
+        PIPE_WAKE_READ                  = 1 << 1,
+
+        /* pipe can now be written to */
+        PIPE_WAKE_WRITE                 = 1 << 2,
+
+        /* unlock this pipe's DMA buffer */
+        PIPE_WAKE_UNLOCK_DMA            = 1 << 3,
+
+        /* unlock DMA buffer of the pipe shared to this pipe */
+        PIPE_WAKE_UNLOCK_DMA_SHARED     = 1 << 4,
+};
+
+/* Possible pipe closing reasons */
+enum PipeCloseReason {
+        /* guest sent a close command */
+        PIPE_CLOSE_GRACEFUL             = 0,
+
+        /* guest rebooted, we're closing the pipes */
+        PIPE_CLOSE_REBOOT               = 1,
+
+        /* close old pipes on snapshot load */
+        PIPE_CLOSE_LOAD_SNAPSHOT        = 2,
+
+        /* some unrecoverable error on the pipe */
+        PIPE_CLOSE_ERROR                = 3,
+};
+
+/* Bit flags for the 'flags' field */
+enum PipeFlagsBits {
+        BIT_CLOSED_ON_HOST = 0,  /* pipe closed by host */
+        BIT_WAKE_ON_WRITE  = 1,  /* want to be woken on writes */
+        BIT_WAKE_ON_READ   = 2,  /* want to be woken on reads */
+};
+
+enum PipeRegs {
+        PIPE_REG_CMD = 0,
+
+        PIPE_REG_SIGNAL_BUFFER_HIGH = 4,
+        PIPE_REG_SIGNAL_BUFFER = 8,
+        PIPE_REG_SIGNAL_BUFFER_COUNT = 12,
+
+        PIPE_REG_OPEN_BUFFER_HIGH = 20,
+        PIPE_REG_OPEN_BUFFER = 24,
+
+        PIPE_REG_VERSION = 36,
+
+        PIPE_REG_GET_SIGNALLED = 48,
+};
+
+enum PipeCmdCode {
+        /* to be used by the pipe device itself */
+        PIPE_CMD_OPEN           = 1,
+
+        PIPE_CMD_CLOSE,
+        PIPE_CMD_POLL,
+        PIPE_CMD_WRITE,
+        PIPE_CMD_WAKE_ON_WRITE,
+        PIPE_CMD_READ,
+        PIPE_CMD_WAKE_ON_READ,
+
+        /*
+         * TODO(zyy): implement a deferred read/write execution to allow
+         * parallel processing of pipe operations on the host.
+         */
+        PIPE_CMD_WAKE_ON_DONE_IO,
+};
+
+#endif /* GOLDFISH_PIPE_QEMU_H */
diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c
index 95b00d28ad6e..55eda5863a6b 100644
--- a/drivers/slimbus/core.c
+++ b/drivers/slimbus/core.c
@@ -9,6 +9,7 @@
 #include <linux/init.h>
 #include <linux/idr.h>
 #include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/pm_runtime.h>
 #include <linux/slimbus.h>
 #include "slimbus.h"
@@ -32,6 +33,10 @@ static int slim_device_match(struct device *dev, struct device_driver *drv)
         struct slim_device *sbdev = to_slim_device(dev);
         struct slim_driver *sbdrv = to_slim_driver(drv);
 
+        /* Attempt an OF style match first */
+        if (of_driver_match_device(dev, drv))
+                return 1;
+
         return !!slim_match(sbdrv->id_table, sbdev);
 }
 
@@ -39,8 +44,23 @@ static int slim_device_probe(struct device *dev)
 {
         struct slim_device      *sbdev = to_slim_device(dev);
         struct slim_driver      *sbdrv = to_slim_driver(dev->driver);
+        int ret;
 
-        return sbdrv->probe(sbdev);
+        ret = sbdrv->probe(sbdev);
+        if (ret)
+                return ret;
+
+        /* try getting the logical address after probe */
+        ret = slim_get_logical_addr(sbdev);
+        if (!ret) {
+                if (sbdrv->device_status)
+                        sbdrv->device_status(sbdev, sbdev->status);
+        } else {
+                dev_err(&sbdev->dev, "Failed to get logical address\n");
+                ret = -EPROBE_DEFER;
+        }
+
+        return ret;
 }
 
 static int slim_device_remove(struct device *dev)
@@ -57,11 +77,24 @@ static int slim_device_remove(struct device *dev)
         return 0;
 }
 
+static int slim_device_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        struct slim_device *sbdev = to_slim_device(dev);
+        int ret;
+
+        ret = of_device_uevent_modalias(dev, env);
+        if (ret != -ENODEV)
+                return ret;
+
+        return add_uevent_var(env, "MODALIAS=slim:%s", dev_name(&sbdev->dev));
+}
+
 struct bus_type slimbus_bus = {
         .name           = "slimbus",
         .match          = slim_device_match,
         .probe          = slim_device_probe,
         .remove         = slim_device_remove,
+        .uevent         = slim_device_uevent,
 };
 EXPORT_SYMBOL_GPL(slimbus_bus);
 
@@ -77,7 +110,7 @@ EXPORT_SYMBOL_GPL(slimbus_bus);
 int __slim_driver_register(struct slim_driver *drv, struct module *owner)
 {
         /* ID table and probe are mandatory */
-        if (!drv->id_table || !drv->probe)
+        if (!(drv->driver.of_match_table || drv->id_table) || !drv->probe)
                 return -EINVAL;
 
         drv->driver.bus = &slimbus_bus;
diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c
index 8be4d6786c61..7218fb963d0a 100644
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1004,6 +1004,7 @@ static int qcom_slim_ngd_get_laddr(struct slim_controller *ctrl,
                                    struct slim_eaddr *ea, u8 *laddr)
 {
         struct slim_val_inf msg =  {0};
+        u8 failed_ea[6] = {0, 0, 0, 0, 0, 0};
         struct slim_msg_txn txn;
         u8 wbuf[10] = {0};
         u8 rbuf[10] = {0};
@@ -1034,6 +1035,9 @@ static int qcom_slim_ngd_get_laddr(struct slim_controller *ctrl,
                 return ret;
         }
 
+        if (!memcmp(rbuf, failed_ea, 6))
+                return -ENXIO;
+
         *laddr = rbuf[6];
 
         return ret;
@@ -1234,8 +1238,17 @@ static int qcom_slim_ngd_enable(struct qcom_slim_ngd_ctrl *ctrl, bool enable)
                         pm_runtime_resume(ctrl->dev);
                 pm_runtime_mark_last_busy(ctrl->dev);
                 pm_runtime_put(ctrl->dev);
+
+                ret = slim_register_controller(&ctrl->ctrl);
+                if (ret) {
+                        dev_err(ctrl->dev, "error adding slim controller\n");
+                        return ret;
+                }
+
+                dev_info(ctrl->dev, "SLIM controller Registered\n");
         } else {
                 qcom_slim_qmi_exit(ctrl);
+                slim_unregister_controller(&ctrl->ctrl);
         }
 
         return 0;
@@ -1342,7 +1355,6 @@ static int of_qcom_slim_ngd_register(struct device *parent,
                 ngd->base = ctrl->base + ngd->id * data->offset +
                                         (ngd->id - 1) * data->size;
                 ctrl->ngd = ngd;
-                platform_driver_register(&qcom_slim_ngd_driver);
 
                 return 0;
         }
@@ -1357,11 +1369,6 @@ static int qcom_slim_ngd_probe(struct platform_device *pdev)
         int ret;
 
         ctrl->ctrl.dev = dev;
-        ret = slim_register_controller(&ctrl->ctrl);
-        if (ret) {
-                dev_err(dev, "error adding slim controller\n");
-                return ret;
-        }
 
         pm_runtime_use_autosuspend(dev);
         pm_runtime_set_autosuspend_delay(dev, QCOM_SLIM_NGD_AUTOSUSPEND);
@@ -1371,7 +1378,7 @@ static int qcom_slim_ngd_probe(struct platform_device *pdev)
         ret = qcom_slim_ngd_qmi_svc_event_init(ctrl);
         if (ret) {
                 dev_err(&pdev->dev, "QMI service registration failed:%d", ret);
-                goto err;
+                return ret;
         }
 
         INIT_WORK(&ctrl->m_work, qcom_slim_ngd_master_worker);
@@ -1383,14 +1390,12 @@ static int qcom_slim_ngd_probe(struct platform_device *pdev)
         }
 
         return 0;
-err:
-        slim_unregister_controller(&ctrl->ctrl);
 wq_err:
         qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
         if (ctrl->mwq)
                 destroy_workqueue(ctrl->mwq);
 
-        return 0;
+        return ret;
 }
 
 static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
@@ -1441,6 +1446,7 @@ static int qcom_slim_ngd_ctrl_probe(struct platform_device *pdev)
         init_completion(&ctrl->reconf);
         init_completion(&ctrl->qmi.qmi_comp);
 
+        platform_driver_register(&qcom_slim_ngd_driver);
         return of_qcom_slim_ngd_register(dev, ctrl);
 }
 
@@ -1456,7 +1462,7 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
         struct qcom_slim_ngd_ctrl *ctrl = platform_get_drvdata(pdev);
 
         pm_runtime_disable(&pdev->dev);
-        slim_unregister_controller(&ctrl->ctrl);
+        qcom_slim_ngd_enable(ctrl, false);
         qcom_slim_ngd_exit_dma(ctrl);
         qcom_slim_ngd_qmi_svc_event_deinit(&ctrl->qmi);
         if (ctrl->mwq)
@@ -1467,7 +1473,7 @@ static int qcom_slim_ngd_remove(struct platform_device *pdev)
         return 0;
 }
 
-static int qcom_slim_ngd_runtime_idle(struct device *dev)
+static int __maybe_unused qcom_slim_ngd_runtime_idle(struct device *dev)
 {
         struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
 
@@ -1477,8 +1483,7 @@ static int qcom_slim_ngd_runtime_idle(struct device *dev)
         return -EAGAIN;
 }
 
-#ifdef CONFIG_PM
-static int qcom_slim_ngd_runtime_suspend(struct device *dev)
+static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev)
 {
         struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev);
         int ret = 0;
@@ -1491,7 +1496,6 @@ static int qcom_slim_ngd_runtime_suspend(struct device *dev)
 
         return ret;
 }
-#endif
 
 static const struct dev_pm_ops qcom_slim_ngd_dev_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend,
diff --git a/drivers/soundwire/bus.c b/drivers/soundwire/bus.c
index dcc0ff9f0c22..1cbfedfc20ef 100644
--- a/drivers/soundwire/bus.c
+++ b/drivers/soundwire/bus.c
@@ -35,6 +35,11 @@ int sdw_add_bus_master(struct sdw_bus *bus)
         INIT_LIST_HEAD(&bus->slaves);
         INIT_LIST_HEAD(&bus->m_rt_list);
 
+        /*
+         * Initialize multi_link flag
+         * TODO: populate this flag by reading property from FW node
+         */
+        bus->multi_link = false;
         if (bus->ops->read_prop) {
                 ret = bus->ops->read_prop(bus);
                 if (ret < 0) {
@@ -175,6 +180,7 @@ static inline int do_transfer_defer(struct sdw_bus *bus,
 
         defer->msg = msg;
         defer->length = msg->len;
+        init_completion(&defer->complete);
 
         for (i = 0; i <= retry; i++) {
                 resp = bus->ops->xfer_msg_defer(bus, msg, defer);
diff --git a/drivers/soundwire/bus.h b/drivers/soundwire/bus.h
index 3b15c4e25a3a..c77de05b8100 100644
--- a/drivers/soundwire/bus.h
+++ b/drivers/soundwire/bus.h
@@ -4,6 +4,8 @@
 #ifndef __SDW_BUS_H
 #define __SDW_BUS_H
 
+#define DEFAULT_BANK_SWITCH_TIMEOUT 3000
+
 #if IS_ENABLED(CONFIG_ACPI)
 int sdw_acpi_find_slaves(struct sdw_bus *bus);
 #else
@@ -99,6 +101,7 @@ struct sdw_slave_runtime {
  * this stream, can be zero.
  * @slave_rt_list: Slave runtime list
  * @port_list: List of Master Ports configured for this stream, can be zero.
+ * @stream_node: sdw_stream_runtime master_list node
  * @bus_node: sdw_bus m_rt_list node
  */
 struct sdw_master_runtime {
@@ -108,6 +111,7 @@ struct sdw_master_runtime {
         unsigned int ch_count;
         struct list_head slave_rt_list;
         struct list_head port_list;
+        struct list_head stream_node;
         struct list_head bus_node;
 };
 
diff --git a/drivers/soundwire/intel.c b/drivers/soundwire/intel.c
index 0a8990e758f9..c5ee97ee7886 100644
--- a/drivers/soundwire/intel.c
+++ b/drivers/soundwire/intel.c
@@ -398,6 +398,69 @@ static int intel_config_stream(struct sdw_intel *sdw,
 }
 
 /*
+ * bank switch routines
+ */
+
+static int intel_pre_bank_switch(struct sdw_bus *bus)
+{
+        struct sdw_cdns *cdns = bus_to_cdns(bus);
+        struct sdw_intel *sdw = cdns_to_intel(cdns);
+        void __iomem *shim = sdw->res->shim;
+        int sync_reg;
+
+        /* Write to register only for multi-link */
+        if (!bus->multi_link)
+                return 0;
+
+        /* Read SYNC register */
+        sync_reg = intel_readl(shim, SDW_SHIM_SYNC);
+        sync_reg |= SDW_SHIM_SYNC_CMDSYNC << sdw->instance;
+        intel_writel(shim, SDW_SHIM_SYNC, sync_reg);
+
+        return 0;
+}
+
+static int intel_post_bank_switch(struct sdw_bus *bus)
+{
+        struct sdw_cdns *cdns = bus_to_cdns(bus);
+        struct sdw_intel *sdw = cdns_to_intel(cdns);
+        void __iomem *shim = sdw->res->shim;
+        int sync_reg, ret;
+
+        /* Write to register only for multi-link */
+        if (!bus->multi_link)
+                return 0;
+
+        /* Read SYNC register */
+        sync_reg = intel_readl(shim, SDW_SHIM_SYNC);
+
+        /*
+         * post_bank_switch() ops is called from the bus in loop for
+         * all the Masters in the steam with the expectation that
+         * we trigger the bankswitch for the only first Master in the list
+         * and do nothing for the other Masters
+         *
+         * So, set the SYNCGO bit only if CMDSYNC bit is set for any Master.
+         */
+        if (!(sync_reg & SDW_SHIM_SYNC_CMDSYNC_MASK))
+                return 0;
+
+        /*
+         * Set SyncGO bit to synchronously trigger a bank switch for
+         * all the masters. A write to SYNCGO bit clears CMDSYNC bit for all
+         * the Masters.
+         */
+        sync_reg |= SDW_SHIM_SYNC_SYNCGO;
+
+        ret = intel_clear_bit(shim, SDW_SHIM_SYNC, sync_reg,
+                                        SDW_SHIM_SYNC_SYNCGO);
+        if (ret < 0)
+                dev_err(sdw->cdns.dev, "Post bank switch failed: %d", ret);
+
+        return ret;
+}
+
+/*
  * DAI routines
  */
 
@@ -750,6 +813,8 @@ static struct sdw_master_ops sdw_intel_ops = {
         .xfer_msg_defer = cdns_xfer_msg_defer,
         .reset_page_addr = cdns_reset_page_addr,
         .set_bus_conf = cdns_bus_conf,
+        .pre_bank_switch = intel_pre_bank_switch,
+        .post_bank_switch = intel_post_bank_switch,
 };
 
 /*
@@ -780,9 +845,6 @@ static int intel_probe(struct platform_device *pdev)
         sdw_intel_ops.read_prop = intel_prop_read;
         sdw->cdns.bus.ops = &sdw_intel_ops;
 
-        sdw_intel_ops.read_prop = intel_prop_read;
-        sdw->cdns.bus.ops = &sdw_intel_ops;
-
         platform_set_drvdata(pdev, sdw);
 
         ret = sdw_add_bus_master(&sdw->cdns.bus);
diff --git a/drivers/soundwire/intel_init.c b/drivers/soundwire/intel_init.c
index d1ea6b4d0ad3..5c8a20d99878 100644
--- a/drivers/soundwire/intel_init.c
+++ b/drivers/soundwire/intel_init.c
@@ -151,7 +151,7 @@ static acpi_status sdw_intel_acpi_cb(acpi_handle handle, u32 level,
         struct acpi_device *adev;
 
         if (acpi_bus_get_device(handle, &adev)) {
-                dev_err(&adev->dev, "Couldn't find ACPI handle\n");
+                pr_err("%s: Couldn't find ACPI handle\n", __func__);
                 return AE_NOT_FOUND;
         }
 
diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c
index e5c7e1ef6318..bd879b1a76c8 100644
--- a/drivers/soundwire/stream.c
+++ b/drivers/soundwire/stream.c
@@ -626,9 +626,10 @@ static int sdw_program_params(struct sdw_bus *bus)
         return ret;
 }
 
-static int sdw_bank_switch(struct sdw_bus *bus)
+static int sdw_bank_switch(struct sdw_bus *bus, int m_rt_count)
 {
         int col_index, row_index;
+        bool multi_link;
         struct sdw_msg *wr_msg;
         u8 *wbuf = NULL;
         int ret = 0;
@@ -638,6 +639,8 @@ static int sdw_bank_switch(struct sdw_bus *bus)
         if (!wr_msg)
                 return -ENOMEM;
 
+        bus->defer_msg.msg = wr_msg;
+
         wbuf = kzalloc(sizeof(*wbuf), GFP_KERNEL);
         if (!wbuf) {
                 ret = -ENOMEM;
@@ -658,17 +661,29 @@ static int sdw_bank_switch(struct sdw_bus *bus)
                                         SDW_MSG_FLAG_WRITE, wbuf);
         wr_msg->ssp_sync = true;
 
-        ret = sdw_transfer(bus, wr_msg);
+        /*
+         * Set the multi_link flag only when both the hardware supports
+         * and there is a stream handled by multiple masters
+         */
+        multi_link = bus->multi_link && (m_rt_count > 1);
+
+        if (multi_link)
+                ret = sdw_transfer_defer(bus, wr_msg, &bus->defer_msg);
+        else
+                ret = sdw_transfer(bus, wr_msg);
+
         if (ret < 0) {
                 dev_err(bus->dev, "Slave frame_ctrl reg write failed");
                 goto error;
         }
 
-        kfree(wr_msg);
-        kfree(wbuf);
-        bus->defer_msg.msg = NULL;
-        bus->params.curr_bank = !bus->params.curr_bank;
-        bus->params.next_bank = !bus->params.next_bank;
+        if (!multi_link) {
+                kfree(wr_msg);
+                kfree(wbuf);
+                bus->defer_msg.msg = NULL;
+                bus->params.curr_bank = !bus->params.curr_bank;
+                bus->params.next_bank = !bus->params.next_bank;
+        }
 
         return 0;
 
@@ -679,37 +694,138 @@ error_1:
         return ret;
 }
 
+/**
+ * sdw_ml_sync_bank_switch: Multilink register bank switch
+ *
+ * @bus: SDW bus instance
+ *
+ * Caller function should free the buffers on error
+ */
+static int sdw_ml_sync_bank_switch(struct sdw_bus *bus)
+{
+        unsigned long time_left;
+
+        if (!bus->multi_link)
+                return 0;
+
+        /* Wait for completion of transfer */
+        time_left = wait_for_completion_timeout(&bus->defer_msg.complete,
+                                                bus->bank_switch_timeout);
+
+        if (!time_left) {
+                dev_err(bus->dev, "Controller Timed out on bank switch");
+                return -ETIMEDOUT;
+        }
+
+        bus->params.curr_bank = !bus->params.curr_bank;
+        bus->params.next_bank = !bus->params.next_bank;
+
+        if (bus->defer_msg.msg) {
+                kfree(bus->defer_msg.msg->buf);
+                kfree(bus->defer_msg.msg);
+        }
+
+        return 0;
+}
+
 static int do_bank_switch(struct sdw_stream_runtime *stream)
 {
-        struct sdw_master_runtime *m_rt = stream->m_rt;
+        struct sdw_master_runtime *m_rt = NULL;
         const struct sdw_master_ops *ops;
-        struct sdw_bus *bus = m_rt->bus;
+        struct sdw_bus *bus = NULL;
+        bool multi_link = false;
         int ret = 0;
 
-        ops = bus->ops;
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
+                ops = bus->ops;
+
+                if (bus->multi_link) {
+                        multi_link = true;
+                        mutex_lock(&bus->msg_lock);
+                }
+
+                /* Pre-bank switch */
+                if (ops->pre_bank_switch) {
+                        ret = ops->pre_bank_switch(bus);
+                        if (ret < 0) {
+                                dev_err(bus->dev,
+                                        "Pre bank switch op failed: %d", ret);
+                                goto msg_unlock;
+                        }
+                }
 
-        /* Pre-bank switch */
-        if (ops->pre_bank_switch) {
-                ret = ops->pre_bank_switch(bus);
+                /*
+                 * Perform Bank switch operation.
+                 * For multi link cases, the actual bank switch is
+                 * synchronized across all Masters and happens later as a
+                 * part of post_bank_switch ops.
+                 */
+                ret = sdw_bank_switch(bus, stream->m_rt_count);
                 if (ret < 0) {
-                        dev_err(bus->dev, "Pre bank switch op failed: %d", ret);
-                        return ret;
+                        dev_err(bus->dev, "Bank switch failed: %d", ret);
+                        goto error;
+
                 }
         }
 
-        /* Bank switch */
-        ret = sdw_bank_switch(bus);
-        if (ret < 0) {
-                dev_err(bus->dev, "Bank switch failed: %d", ret);
-                return ret;
-        }
+        /*
+         * For multi link cases, it is expected that the bank switch is
+         * triggered by the post_bank_switch for the first Master in the list
+         * and for the other Masters the post_bank_switch() should return doing
+         * nothing.
+         */
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
+                ops = bus->ops;
+
+                /* Post-bank switch */
+                if (ops->post_bank_switch) {
+                        ret = ops->post_bank_switch(bus);
+                        if (ret < 0) {
+                                dev_err(bus->dev,
+                                        "Post bank switch op failed: %d", ret);
+                                goto error;
+                        }
+                } else if (bus->multi_link && stream->m_rt_count > 1) {
+                        dev_err(bus->dev,
+                                "Post bank switch ops not implemented");
+                        goto error;
+                }
+
+                /* Set the bank switch timeout to default, if not set */
+                if (!bus->bank_switch_timeout)
+                        bus->bank_switch_timeout = DEFAULT_BANK_SWITCH_TIMEOUT;
 
-        /* Post-bank switch */
-        if (ops->post_bank_switch) {
-                ret = ops->post_bank_switch(bus);
+                /* Check if bank switch was successful */
+                ret = sdw_ml_sync_bank_switch(bus);
                 if (ret < 0) {
                         dev_err(bus->dev,
-                                        "Post bank switch op failed: %d", ret);
+                                "multi link bank switch failed: %d", ret);
+                        goto error;
+                }
+
+                mutex_unlock(&bus->msg_lock);
+        }
+
+        return ret;
+
+error:
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+
+                bus = m_rt->bus;
+
+                kfree(bus->defer_msg.msg->buf);
+                kfree(bus->defer_msg.msg);
+        }
+
+msg_unlock:
+
+        if (multi_link) {
+                list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                        bus = m_rt->bus;
+                        if (mutex_is_locked(&bus->msg_lock))
+                                mutex_unlock(&bus->msg_lock);
                 }
         }
 
@@ -747,12 +863,29 @@ struct sdw_stream_runtime *sdw_alloc_stream(char *stream_name)
                 return NULL;
 
         stream->name = stream_name;
+        INIT_LIST_HEAD(&stream->master_list);
         stream->state = SDW_STREAM_ALLOCATED;
+        stream->m_rt_count = 0;
 
         return stream;
 }
 EXPORT_SYMBOL(sdw_alloc_stream);
 
+static struct sdw_master_runtime
+*sdw_find_master_rt(struct sdw_bus *bus,
+                        struct sdw_stream_runtime *stream)
+{
+        struct sdw_master_runtime *m_rt = NULL;
+
+        /* Retrieve Bus handle if already available */
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                if (m_rt->bus == bus)
+                        return m_rt;
+        }
+
+        return NULL;
+}
+
 /**
  * sdw_alloc_master_rt() - Allocates and initialize Master runtime handle
  *
@@ -769,12 +902,11 @@ static struct sdw_master_runtime
 {
         struct sdw_master_runtime *m_rt;
 
-        m_rt = stream->m_rt;
-
         /*
          * check if Master is already allocated (as a result of Slave adding
          * it first), if so skip allocation and go to configure
          */
+        m_rt = sdw_find_master_rt(bus, stream);
         if (m_rt)
                 goto stream_config;
 
@@ -785,7 +917,7 @@ static struct sdw_master_runtime
         /* Initialization of Master runtime handle */
         INIT_LIST_HEAD(&m_rt->port_list);
         INIT_LIST_HEAD(&m_rt->slave_rt_list);
-        stream->m_rt = m_rt;
+        list_add_tail(&m_rt->stream_node, &stream->master_list);
 
         list_add_tail(&m_rt->bus_node, &bus->m_rt_list);
 
@@ -843,17 +975,21 @@ static void sdw_slave_port_release(struct sdw_bus *bus,
                         struct sdw_stream_runtime *stream)
 {
         struct sdw_port_runtime *p_rt, *_p_rt;
-        struct sdw_master_runtime *m_rt = stream->m_rt;
+        struct sdw_master_runtime *m_rt;
         struct sdw_slave_runtime *s_rt;
 
-        list_for_each_entry(s_rt, &m_rt->slave_rt_list, m_rt_node) {
-                if (s_rt->slave != slave)
-                        continue;
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                list_for_each_entry(s_rt, &m_rt->slave_rt_list, m_rt_node) {
 
-                list_for_each_entry_safe(p_rt, _p_rt,
-                                &s_rt->port_list, port_node) {
-                        list_del(&p_rt->port_node);
-                        kfree(p_rt);
+                        if (s_rt->slave != slave)
+                                continue;
+
+                        list_for_each_entry_safe(p_rt, _p_rt,
+                                        &s_rt->port_list, port_node) {
+
+                                list_del(&p_rt->port_node);
+                                kfree(p_rt);
+                        }
                 }
         }
 }
@@ -870,16 +1006,18 @@ static void sdw_release_slave_stream(struct sdw_slave *slave,
                         struct sdw_stream_runtime *stream)
 {
         struct sdw_slave_runtime *s_rt, *_s_rt;
-        struct sdw_master_runtime *m_rt = stream->m_rt;
+        struct sdw_master_runtime *m_rt;
 
-        /* Retrieve Slave runtime handle */
-        list_for_each_entry_safe(s_rt, _s_rt,
-                        &m_rt->slave_rt_list, m_rt_node) {
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                /* Retrieve Slave runtime handle */
+                list_for_each_entry_safe(s_rt, _s_rt,
+                                        &m_rt->slave_rt_list, m_rt_node) {
 
-                if (s_rt->slave == slave) {
-                        list_del(&s_rt->m_rt_node);
-                        kfree(s_rt);
-                        return;
+                        if (s_rt->slave == slave) {
+                                list_del(&s_rt->m_rt_node);
+                                kfree(s_rt);
+                                return;
+                        }
                 }
         }
 }
@@ -887,6 +1025,7 @@ static void sdw_release_slave_stream(struct sdw_slave *slave,
 /**
  * sdw_release_master_stream() - Free Master runtime handle
  *
+ * @m_rt: Master runtime node
  * @stream: Stream runtime handle.
  *
  * This function is to be called with bus_lock held
@@ -894,9 +1033,9 @@ static void sdw_release_slave_stream(struct sdw_slave *slave,
  * handle. If this is called first then sdw_release_slave_stream() will have
  * no effect as Slave(s) runtime handle would already be freed up.
  */
-static void sdw_release_master_stream(struct sdw_stream_runtime *stream)
+static void sdw_release_master_stream(struct sdw_master_runtime *m_rt,
+                        struct sdw_stream_runtime *stream)
 {
-        struct sdw_master_runtime *m_rt = stream->m_rt;
         struct sdw_slave_runtime *s_rt, *_s_rt;
 
         list_for_each_entry_safe(s_rt, _s_rt, &m_rt->slave_rt_list, m_rt_node) {
@@ -904,7 +1043,9 @@ static void sdw_release_master_stream(struct sdw_stream_runtime *stream)
                 sdw_release_slave_stream(s_rt->slave, stream);
         }
 
+        list_del(&m_rt->stream_node);
         list_del(&m_rt->bus_node);
+        kfree(m_rt);
 }
 
 /**
@@ -918,13 +1059,23 @@ static void sdw_release_master_stream(struct sdw_stream_runtime *stream)
 int sdw_stream_remove_master(struct sdw_bus *bus,
                 struct sdw_stream_runtime *stream)
 {
+        struct sdw_master_runtime *m_rt, *_m_rt;
+
         mutex_lock(&bus->bus_lock);
 
-        sdw_release_master_stream(stream);
-        sdw_master_port_release(bus, stream->m_rt);
-        stream->state = SDW_STREAM_RELEASED;
-        kfree(stream->m_rt);
-        stream->m_rt = NULL;
+        list_for_each_entry_safe(m_rt, _m_rt,
+                        &stream->master_list, stream_node) {
+
+                if (m_rt->bus != bus)
+                        continue;
+
+                sdw_master_port_release(bus, m_rt);
+                sdw_release_master_stream(m_rt, stream);
+                stream->m_rt_count--;
+        }
+
+        if (list_empty(&stream->master_list))
+                stream->state = SDW_STREAM_RELEASED;
 
         mutex_unlock(&bus->bus_lock);
 
@@ -1107,6 +1258,18 @@ int sdw_stream_add_master(struct sdw_bus *bus,
 
         mutex_lock(&bus->bus_lock);
 
+        /*
+         * For multi link streams, add the second master only if
+         * the bus supports it.
+         * Check if bus->multi_link is set
+         */
+        if (!bus->multi_link && stream->m_rt_count > 0) {
+                dev_err(bus->dev,
+                        "Multilink not supported, link %d", bus->link_id);
+                ret = -EINVAL;
+                goto unlock;
+        }
+
         m_rt = sdw_alloc_master_rt(bus, stream_config, stream);
         if (!m_rt) {
                 dev_err(bus->dev,
@@ -1124,10 +1287,12 @@ int sdw_stream_add_master(struct sdw_bus *bus,
         if (ret)
                 goto stream_error;
 
+        stream->m_rt_count++;
+
         goto unlock;
 
 stream_error:
-        sdw_release_master_stream(stream);
+        sdw_release_master_stream(m_rt, stream);
 unlock:
         mutex_unlock(&bus->bus_lock);
         return ret;
@@ -1205,7 +1370,7 @@ stream_error:
          * we hit error so cleanup the stream, release all Slave(s) and
          * Master runtime
          */
-        sdw_release_master_stream(stream);
+        sdw_release_master_stream(m_rt, stream);
 error:
         mutex_unlock(&slave->bus->bus_lock);
         return ret;
@@ -1245,33 +1410,82 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_prop(struct sdw_slave *slave,
         return NULL;
 }
 
+/**
+ * sdw_acquire_bus_lock: Acquire bus lock for all Master runtime(s)
+ *
+ * @stream: SoundWire stream
+ *
+ * Acquire bus_lock for each of the master runtime(m_rt) part of this
+ * stream to reconfigure the bus.
+ * NOTE: This function is called from SoundWire stream ops and is
+ * expected that a global lock is held before acquiring bus_lock.
+ */
+static void sdw_acquire_bus_lock(struct sdw_stream_runtime *stream)
+{
+        struct sdw_master_runtime *m_rt = NULL;
+        struct sdw_bus *bus = NULL;
+
+        /* Iterate for all Master(s) in Master list */
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
+
+                mutex_lock(&bus->bus_lock);
+        }
+}
+
+/**
+ * sdw_release_bus_lock: Release bus lock for all Master runtime(s)
+ *
+ * @stream: SoundWire stream
+ *
+ * Release the previously held bus_lock after reconfiguring the bus.
+ * NOTE: This function is called from SoundWire stream ops and is
+ * expected that a global lock is held before releasing bus_lock.
+ */
+static void sdw_release_bus_lock(struct sdw_stream_runtime *stream)
+{
+        struct sdw_master_runtime *m_rt = NULL;
+        struct sdw_bus *bus = NULL;
+
+        /* Iterate for all Master(s) in Master list */
+        list_for_each_entry_reverse(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
+                mutex_unlock(&bus->bus_lock);
+        }
+}
+
 static int _sdw_prepare_stream(struct sdw_stream_runtime *stream)
 {
-        struct sdw_master_runtime *m_rt = stream->m_rt;
-        struct sdw_bus *bus = m_rt->bus;
+        struct sdw_master_runtime *m_rt = NULL;
+        struct sdw_bus *bus = NULL;
         struct sdw_master_prop *prop = NULL;
         struct sdw_bus_params params;
         int ret;
 
-        prop = &bus->prop;
-        memcpy(&params, &bus->params, sizeof(params));
+        /* Prepare  Master(s) and Slave(s) port(s) associated with stream */
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
+                prop = &bus->prop;
+                memcpy(&params, &bus->params, sizeof(params));
 
-        /* TODO: Support Asynchronous mode */
-        if ((prop->max_freq % stream->params.rate) != 0) {
-                dev_err(bus->dev, "Async mode not supported");
-                return -EINVAL;
-        }
+                /* TODO: Support Asynchronous mode */
+                if ((prop->max_freq % stream->params.rate) != 0) {
+                        dev_err(bus->dev, "Async mode not supported");
+                        return -EINVAL;
+                }
 
-        /* Increment cumulative bus bandwidth */
-        /* TODO: Update this during Device-Device support */
-        bus->params.bandwidth += m_rt->stream->params.rate *
-                m_rt->ch_count * m_rt->stream->params.bps;
+                /* Increment cumulative bus bandwidth */
+                /* TODO: Update this during Device-Device support */
+                bus->params.bandwidth += m_rt->stream->params.rate *
+                        m_rt->ch_count * m_rt->stream->params.bps;
+
+                /* Program params */
+                ret = sdw_program_params(bus);
+                if (ret < 0) {
+                        dev_err(bus->dev, "Program params failed: %d", ret);
+                        goto restore_params;
+                }
 
-        /* Program params */
-        ret = sdw_program_params(bus);
-        if (ret < 0) {
-                dev_err(bus->dev, "Program params failed: %d", ret);
-                goto restore_params;
         }
 
         ret = do_bank_switch(stream);
@@ -1280,12 +1494,16 @@ static int _sdw_prepare_stream(struct sdw_stream_runtime *stream)
                 goto restore_params;
         }
 
-        /* Prepare port(s) on the new clock configuration */
-        ret = sdw_prep_deprep_ports(m_rt, true);
-        if (ret < 0) {
-                dev_err(bus->dev, "Prepare port(s) failed ret = %d",
-                                ret);
-                return ret;
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
+
+                /* Prepare port(s) on the new clock configuration */
+                ret = sdw_prep_deprep_ports(m_rt, true);
+                if (ret < 0) {
+                        dev_err(bus->dev, "Prepare port(s) failed ret = %d",
+                                        ret);
+                        return ret;
+                }
         }
 
         stream->state = SDW_STREAM_PREPARED;
@@ -1313,35 +1531,40 @@ int sdw_prepare_stream(struct sdw_stream_runtime *stream)
                 return -EINVAL;
         }
 
-        mutex_lock(&stream->m_rt->bus->bus_lock);
+        sdw_acquire_bus_lock(stream);
 
         ret = _sdw_prepare_stream(stream);
         if (ret < 0)
                 pr_err("Prepare for stream:%s failed: %d", stream->name, ret);
 
-        mutex_unlock(&stream->m_rt->bus->bus_lock);
+        sdw_release_bus_lock(stream);
         return ret;
 }
 EXPORT_SYMBOL(sdw_prepare_stream);
 
 static int _sdw_enable_stream(struct sdw_stream_runtime *stream)
 {
-        struct sdw_master_runtime *m_rt = stream->m_rt;
-        struct sdw_bus *bus = m_rt->bus;
+        struct sdw_master_runtime *m_rt = NULL;
+        struct sdw_bus *bus = NULL;
         int ret;
 
-        /* Program params */
-        ret = sdw_program_params(bus);
-        if (ret < 0) {
-                dev_err(bus->dev, "Program params failed: %d", ret);
-                return ret;
-        }
+        /* Enable Master(s) and Slave(s) port(s) associated with stream */
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
 
-        /* Enable port(s) */
-        ret = sdw_enable_disable_ports(m_rt, true);
-        if (ret < 0) {
-                dev_err(bus->dev, "Enable port(s) failed ret: %d", ret);
-                return ret;
+                /* Program params */
+                ret = sdw_program_params(bus);
+                if (ret < 0) {
+                        dev_err(bus->dev, "Program params failed: %d", ret);
+                        return ret;
+                }
+
+                /* Enable port(s) */
+                ret = sdw_enable_disable_ports(m_rt, true);
+                if (ret < 0) {
+                        dev_err(bus->dev, "Enable port(s) failed ret: %d", ret);
+                        return ret;
+                }
         }
 
         ret = do_bank_switch(stream);
@@ -1370,37 +1593,42 @@ int sdw_enable_stream(struct sdw_stream_runtime *stream)
                 return -EINVAL;
         }
 
-        mutex_lock(&stream->m_rt->bus->bus_lock);
+        sdw_acquire_bus_lock(stream);
 
         ret = _sdw_enable_stream(stream);
         if (ret < 0)
                 pr_err("Enable for stream:%s failed: %d", stream->name, ret);
 
-        mutex_unlock(&stream->m_rt->bus->bus_lock);
+        sdw_release_bus_lock(stream);
         return ret;
 }
 EXPORT_SYMBOL(sdw_enable_stream);
 
 static int _sdw_disable_stream(struct sdw_stream_runtime *stream)
 {
-        struct sdw_master_runtime *m_rt = stream->m_rt;
-        struct sdw_bus *bus = m_rt->bus;
+        struct sdw_master_runtime *m_rt = NULL;
+        struct sdw_bus *bus = NULL;
         int ret;
 
-        /* Disable port(s) */
-        ret = sdw_enable_disable_ports(m_rt, false);
-        if (ret < 0) {
-                dev_err(bus->dev, "Disable port(s) failed: %d", ret);
-                return ret;
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
+                /* Disable port(s) */
+                ret = sdw_enable_disable_ports(m_rt, false);
+                if (ret < 0) {
+                        dev_err(bus->dev, "Disable port(s) failed: %d", ret);
+                        return ret;
+                }
         }
-
         stream->state = SDW_STREAM_DISABLED;
 
-        /* Program params */
-        ret = sdw_program_params(bus);
-        if (ret < 0) {
-                dev_err(bus->dev, "Program params failed: %d", ret);
-                return ret;
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
+                /* Program params */
+                ret = sdw_program_params(bus);
+                if (ret < 0) {
+                        dev_err(bus->dev, "Program params failed: %d", ret);
+                        return ret;
+                }
         }
 
         return do_bank_switch(stream);
@@ -1422,43 +1650,46 @@ int sdw_disable_stream(struct sdw_stream_runtime *stream)
                 return -EINVAL;
         }
 
-        mutex_lock(&stream->m_rt->bus->bus_lock);
+        sdw_acquire_bus_lock(stream);
 
         ret = _sdw_disable_stream(stream);
         if (ret < 0)
                 pr_err("Disable for stream:%s failed: %d", stream->name, ret);
 
-        mutex_unlock(&stream->m_rt->bus->bus_lock);
+        sdw_release_bus_lock(stream);
         return ret;
 }
 EXPORT_SYMBOL(sdw_disable_stream);
 
 static int _sdw_deprepare_stream(struct sdw_stream_runtime *stream)
 {
-        struct sdw_master_runtime *m_rt = stream->m_rt;
-        struct sdw_bus *bus = m_rt->bus;
+        struct sdw_master_runtime *m_rt = NULL;
+        struct sdw_bus *bus = NULL;
         int ret = 0;
 
-        /* De-prepare port(s) */
-        ret = sdw_prep_deprep_ports(m_rt, false);
-        if (ret < 0) {
-                dev_err(bus->dev, "De-prepare port(s) failed: %d", ret);
-                return ret;
-        }
+        list_for_each_entry(m_rt, &stream->master_list, stream_node) {
+                bus = m_rt->bus;
+                /* De-prepare port(s) */
+                ret = sdw_prep_deprep_ports(m_rt, false);
+                if (ret < 0) {
+                        dev_err(bus->dev, "De-prepare port(s) failed: %d", ret);
+                        return ret;
+                }
 
-        stream->state = SDW_STREAM_DEPREPARED;
+                /* TODO: Update this during Device-Device support */
+                bus->params.bandwidth -= m_rt->stream->params.rate *
+                        m_rt->ch_count * m_rt->stream->params.bps;
 
-        /* TODO: Update this during Device-Device support */
-        bus->params.bandwidth -= m_rt->stream->params.rate *
-                m_rt->ch_count * m_rt->stream->params.bps;
+                /* Program params */
+                ret = sdw_program_params(bus);
+                if (ret < 0) {
+                        dev_err(bus->dev, "Program params failed: %d", ret);
+                        return ret;
+                }
 
-        /* Program params */
-        ret = sdw_program_params(bus);
-        if (ret < 0) {
-                dev_err(bus->dev, "Program params failed: %d", ret);
-                return ret;
         }
 
+        stream->state = SDW_STREAM_DEPREPARED;
         return do_bank_switch(stream);
 }
 
@@ -1478,13 +1709,12 @@ int sdw_deprepare_stream(struct sdw_stream_runtime *stream)
                 return -EINVAL;
         }
 
-        mutex_lock(&stream->m_rt->bus->bus_lock);
-
+        sdw_acquire_bus_lock(stream);
         ret = _sdw_deprepare_stream(stream);
         if (ret < 0)
                 pr_err("De-prepare for stream:%d failed: %d", ret, ret);
 
-        mutex_unlock(&stream->m_rt->bus->bus_lock);
+        sdw_release_bus_lock(stream);
         return ret;
 }
 EXPORT_SYMBOL(sdw_deprepare_stream);
diff --git a/drivers/thunderbolt/cap.c b/drivers/thunderbolt/cap.c
index c2277b8ee88d..9553305c63ea 100644
--- a/drivers/thunderbolt/cap.c
+++ b/drivers/thunderbolt/cap.c
@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Thunderbolt Cactus Ridge driver - capabilities lookup
+ * Thunderbolt driver - capabilities lookup
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #include <linux/slab.h>
diff --git a/drivers/thunderbolt/ctl.c b/drivers/thunderbolt/ctl.c
index 37a7f4c735d0..73b386de4d15 100644
--- a/drivers/thunderbolt/ctl.c
+++ b/drivers/thunderbolt/ctl.c
@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Thunderbolt Cactus Ridge driver - control channel and configuration commands
+ * Thunderbolt driver - control channel and configuration commands
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #include <linux/crc32.h>
@@ -631,7 +632,7 @@ struct tb_ctl *tb_ctl_alloc(struct tb_nhi *nhi, event_cb cb, void *cb_data)
                 ctl->rx_packets[i]->frame.callback = tb_ctl_rx_callback;
         }
 
-        tb_ctl_info(ctl, "control channel created\n");
+        tb_ctl_dbg(ctl, "control channel created\n");
         return ctl;
 err:
         tb_ctl_free(ctl);
@@ -662,8 +663,7 @@ void tb_ctl_free(struct tb_ctl *ctl)
                 tb_ctl_pkg_free(ctl->rx_packets[i]);
 
 
-        if (ctl->frame_pool)
-                dma_pool_destroy(ctl->frame_pool);
+        dma_pool_destroy(ctl->frame_pool);
         kfree(ctl);
 }
 
@@ -673,7 +673,7 @@ void tb_ctl_free(struct tb_ctl *ctl)
 void tb_ctl_start(struct tb_ctl *ctl)
 {
         int i;
-        tb_ctl_info(ctl, "control channel starting...\n");
+        tb_ctl_dbg(ctl, "control channel starting...\n");
         tb_ring_start(ctl->tx); /* is used to ack hotplug packets, start first */
         tb_ring_start(ctl->rx);
         for (i = 0; i < TB_CTL_RX_PKG_COUNT; i++)
@@ -702,7 +702,7 @@ void tb_ctl_stop(struct tb_ctl *ctl)
         if (!list_empty(&ctl->request_queue))
                 tb_ctl_WARN(ctl, "dangling request in request_queue\n");
         INIT_LIST_HEAD(&ctl->request_queue);
-        tb_ctl_info(ctl, "control channel stopped\n");
+        tb_ctl_dbg(ctl, "control channel stopped\n");
 }
 
 /* public interface, commands */
diff --git a/drivers/thunderbolt/ctl.h b/drivers/thunderbolt/ctl.h
index 3062e0b5f71e..2f1a1e111110 100644
--- a/drivers/thunderbolt/ctl.h
+++ b/drivers/thunderbolt/ctl.h
@@ -1,8 +1,9 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
- * Thunderbolt Cactus Ridge driver - control channel and configuration commands
+ * Thunderbolt driver - control channel and configuration commands
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #ifndef _TB_CFG
diff --git a/drivers/thunderbolt/dma_port.c b/drivers/thunderbolt/dma_port.c
index f2701194f810..847dd07a7b17 100644
--- a/drivers/thunderbolt/dma_port.c
+++ b/drivers/thunderbolt/dma_port.c
@@ -1,13 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Thunderbolt DMA configuration based mailbox support
  *
  * Copyright (C) 2017, Intel Corporation
  * Authors: Michael Jamet <michael.jamet@intel.com>
  *          Mika Westerberg <mika.westerberg@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #include <linux/delay.h>
diff --git a/drivers/thunderbolt/dma_port.h b/drivers/thunderbolt/dma_port.h
index c4a69e0fbff7..7deadd97ce31 100644
--- a/drivers/thunderbolt/dma_port.h
+++ b/drivers/thunderbolt/dma_port.h
@@ -1,13 +1,10 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Thunderbolt DMA configuration based mailbox support
  *
  * Copyright (C) 2017, Intel Corporation
  * Authors: Michael Jamet <michael.jamet@intel.com>
  *          Mika Westerberg <mika.westerberg@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #ifndef DMA_PORT_H_
diff --git a/drivers/thunderbolt/domain.c b/drivers/thunderbolt/domain.c
index 092381e2accf..93e562f18d40 100644
--- a/drivers/thunderbolt/domain.c
+++ b/drivers/thunderbolt/domain.c
@@ -1,12 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Thunderbolt bus support
  *
  * Copyright (C) 2017, Intel Corporation
- * Author:  Mika Westerberg <mika.westerberg@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
+ * Author: Mika Westerberg <mika.westerberg@linux.intel.com>
  */
 
 #include <linux/device.h>
diff --git a/drivers/thunderbolt/eeprom.c b/drivers/thunderbolt/eeprom.c
index 3e8caf22c294..81e8ac4c5805 100644
--- a/drivers/thunderbolt/eeprom.c
+++ b/drivers/thunderbolt/eeprom.c
@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Thunderbolt Cactus Ridge driver - eeprom access
+ * Thunderbolt driver - eeprom access
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #include <linux/crc32.h>
@@ -540,7 +541,7 @@ int tb_drom_read(struct tb_switch *sw)
                 return res;
         size &= 0x3ff;
         size += TB_DROM_DATA_START;
-        tb_sw_info(sw, "reading drom (length: %#x)\n", size);
+        tb_sw_dbg(sw, "reading drom (length: %#x)\n", size);
         if (size < sizeof(*header)) {
                 tb_sw_warn(sw, "drom too small, aborting\n");
                 return -EIO;
diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
index 28fc4ce75edb..e3fc920af682 100644
--- a/drivers/thunderbolt/icm.c
+++ b/drivers/thunderbolt/icm.c
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Internal Thunderbolt Connection Manager. This is a firmware running on
  * the Thunderbolt host controller performing most of the low-level
@@ -6,10 +7,6 @@
  * Copyright (C) 2017, Intel Corporation
  * Authors: Michael Jamet <michael.jamet@intel.com>
  *          Mika Westerberg <mika.westerberg@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #include <linux/delay.h>
diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c
index 5cd6bdfa068f..9aa44f9762a3 100644
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -1,10 +1,11 @@
 /*
- * Thunderbolt Cactus Ridge driver - NHI driver
+ * Thunderbolt driver - NHI driver
  *
  * The NHI (native host interface) is the pci device that allows us to send and
  * receive frames from the thunderbolt bus.
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #include <linux/pm_runtime.h>
@@ -95,9 +96,9 @@ static void ring_interrupt_active(struct tb_ring *ring, bool active)
         else
                 new = old & ~mask;
 
-        dev_info(&ring->nhi->pdev->dev,
-                 "%s interrupt at register %#x bit %d (%#x -> %#x)\n",
-                 active ? "enabling" : "disabling", reg, bit, old, new);
+        dev_dbg(&ring->nhi->pdev->dev,
+                "%s interrupt at register %#x bit %d (%#x -> %#x)\n",
+                active ? "enabling" : "disabling", reg, bit, old, new);
 
         if (new == old)
                 dev_WARN(&ring->nhi->pdev->dev,
@@ -476,8 +477,9 @@ static struct tb_ring *tb_ring_alloc(struct tb_nhi *nhi, u32 hop, int size,
                                      void *poll_data)
 {
         struct tb_ring *ring = NULL;
-        dev_info(&nhi->pdev->dev, "allocating %s ring %d of size %d\n",
-                 transmit ? "TX" : "RX", hop, size);
+
+        dev_dbg(&nhi->pdev->dev, "allocating %s ring %d of size %d\n",
+                transmit ? "TX" : "RX", hop, size);
 
         /* Tx Ring 2 is reserved for E2E workaround */
         if (transmit && hop == RING_E2E_UNUSED_HOPID)
@@ -585,8 +587,8 @@ void tb_ring_start(struct tb_ring *ring)
                 dev_WARN(&ring->nhi->pdev->dev, "ring already started\n");
                 goto err;
         }
-        dev_info(&ring->nhi->pdev->dev, "starting %s %d\n",
-                 RING_TYPE(ring), ring->hop);
+        dev_dbg(&ring->nhi->pdev->dev, "starting %s %d\n",
+                RING_TYPE(ring), ring->hop);
 
         if (ring->flags & RING_FLAG_FRAME) {
                 /* Means 4096 */
@@ -647,8 +649,8 @@ void tb_ring_stop(struct tb_ring *ring)
 {
         spin_lock_irq(&ring->nhi->lock);
         spin_lock(&ring->lock);
-        dev_info(&ring->nhi->pdev->dev, "stopping %s %d\n",
-                 RING_TYPE(ring), ring->hop);
+        dev_dbg(&ring->nhi->pdev->dev, "stopping %s %d\n",
+                RING_TYPE(ring), ring->hop);
         if (ring->nhi->going_away)
                 goto err;
         if (!ring->running) {
@@ -716,10 +718,8 @@ void tb_ring_free(struct tb_ring *ring)
         ring->descriptors_dma = 0;
 
 
-        dev_info(&ring->nhi->pdev->dev,
-                 "freeing %s %d\n",
-                 RING_TYPE(ring),
-                 ring->hop);
+        dev_dbg(&ring->nhi->pdev->dev, "freeing %s %d\n", RING_TYPE(ring),
+                ring->hop);
 
         /**
          * ring->work can no longer be scheduled (it is scheduled only
@@ -931,7 +931,8 @@ static int nhi_runtime_resume(struct device *dev)
 static void nhi_shutdown(struct tb_nhi *nhi)
 {
         int i;
-        dev_info(&nhi->pdev->dev, "shutdown\n");
+
+        dev_dbg(&nhi->pdev->dev, "shutdown\n");
 
         for (i = 0; i < nhi->hop_count; i++) {
                 if (nhi->tx_rings[i])
@@ -1059,7 +1060,7 @@ static int nhi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 return -ENODEV;
         }
 
-        dev_info(&nhi->pdev->dev, "NHI initialized, starting thunderbolt\n");
+        dev_dbg(&nhi->pdev->dev, "NHI initialized, starting thunderbolt\n");
 
         res = tb_domain_add(tb);
         if (res) {
diff --git a/drivers/thunderbolt/nhi.h b/drivers/thunderbolt/nhi.h
index 1696a4560948..1b5d47ecd3ed 100644
--- a/drivers/thunderbolt/nhi.h
+++ b/drivers/thunderbolt/nhi.h
@@ -1,8 +1,9 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
- * Thunderbolt Cactus Ridge driver - NHI driver
+ * Thunderbolt driver - NHI driver
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #ifndef DSL3510_H_
diff --git a/drivers/thunderbolt/nhi_regs.h b/drivers/thunderbolt/nhi_regs.h
index b3e49d19c01e..a60bd98c1d04 100644
--- a/drivers/thunderbolt/nhi_regs.h
+++ b/drivers/thunderbolt/nhi_regs.h
@@ -3,6 +3,7 @@
  * Thunderbolt driver - NHI registers
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #ifndef NHI_REGS_H_
diff --git a/drivers/thunderbolt/path.c b/drivers/thunderbolt/path.c
index ff49ad880bfd..a11956522bac 100644
--- a/drivers/thunderbolt/path.c
+++ b/drivers/thunderbolt/path.c
@@ -13,19 +13,19 @@
 
 static void tb_dump_hop(struct tb_port *port, struct tb_regs_hop *hop)
 {
-        tb_port_info(port, " Hop through port %d to hop %d (%s)\n",
-                     hop->out_port, hop->next_hop,
-                     hop->enable ? "enabled" : "disabled");
-        tb_port_info(port, "  Weight: %d Priority: %d Credits: %d Drop: %d\n",
-                     hop->weight, hop->priority,
-                     hop->initial_credits, hop->drop_packages);
-        tb_port_info(port, "   Counter enabled: %d Counter index: %d\n",
-                     hop->counter_enable, hop->counter);
-        tb_port_info(port, "  Flow Control (In/Eg): %d/%d Shared Buffer (In/Eg): %d/%d\n",
-                     hop->ingress_fc, hop->egress_fc,
-                     hop->ingress_shared_buffer, hop->egress_shared_buffer);
-        tb_port_info(port, "  Unknown1: %#x Unknown2: %#x Unknown3: %#x\n",
-                     hop->unknown1, hop->unknown2, hop->unknown3);
+        tb_port_dbg(port, " Hop through port %d to hop %d (%s)\n",
+                    hop->out_port, hop->next_hop,
+                    hop->enable ? "enabled" : "disabled");
+        tb_port_dbg(port, "  Weight: %d Priority: %d Credits: %d Drop: %d\n",
+                    hop->weight, hop->priority,
+                    hop->initial_credits, hop->drop_packages);
+        tb_port_dbg(port, "   Counter enabled: %d Counter index: %d\n",
+                    hop->counter_enable, hop->counter);
+        tb_port_dbg(port, "  Flow Control (In/Eg): %d/%d Shared Buffer (In/Eg): %d/%d\n",
+                    hop->ingress_fc, hop->egress_fc,
+                    hop->ingress_shared_buffer, hop->egress_shared_buffer);
+        tb_port_dbg(port, "  Unknown1: %#x Unknown2: %#x Unknown3: %#x\n",
+                    hop->unknown1, hop->unknown2, hop->unknown3);
 }
 
 /**
diff --git a/drivers/thunderbolt/property.c b/drivers/thunderbolt/property.c
index 8fe913a95b4a..b2f0d6386cee 100644
--- a/drivers/thunderbolt/property.c
+++ b/drivers/thunderbolt/property.c
@@ -1,13 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Thunderbolt XDomain property support
  *
  * Copyright (C) 2017, Intel Corporation
  * Authors: Michael Jamet <michael.jamet@intel.com>
  *          Mika Westerberg <mika.westerberg@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #include <linux/err.h>
diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c
index 7442bc4c6433..52ff854f0d6c 100644
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -1,8 +1,9 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Thunderbolt Cactus Ridge driver - switch/port utility functions
+ * Thunderbolt driver - switch/port utility functions
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #include <linux/delay.h>
@@ -436,15 +437,15 @@ static const char *tb_port_type(struct tb_regs_port_header *port)
 
 static void tb_dump_port(struct tb *tb, struct tb_regs_port_header *port)
 {
-        tb_info(tb,
-                " Port %d: %x:%x (Revision: %d, TB Version: %d, Type: %s (%#x))\n",
-                port->port_number, port->vendor_id, port->device_id,
-                port->revision, port->thunderbolt_version, tb_port_type(port),
-                port->type);
-        tb_info(tb, "  Max hop id (in/out): %d/%d\n",
-                port->max_in_hop_id, port->max_out_hop_id);
-        tb_info(tb, "  Max counters: %d\n", port->max_counters);
-        tb_info(tb, "  NFC Credits: %#x\n", port->nfc_credits);
+        tb_dbg(tb,
+               " Port %d: %x:%x (Revision: %d, TB Version: %d, Type: %s (%#x))\n",
+               port->port_number, port->vendor_id, port->device_id,
+               port->revision, port->thunderbolt_version, tb_port_type(port),
+               port->type);
+        tb_dbg(tb, "  Max hop id (in/out): %d/%d\n",
+               port->max_in_hop_id, port->max_out_hop_id);
+        tb_dbg(tb, "  Max counters: %d\n", port->max_counters);
+        tb_dbg(tb, "  NFC Credits: %#x\n", port->nfc_credits);
 }
 
 /**
@@ -605,20 +606,18 @@ static int tb_init_port(struct tb_port *port)
 
 static void tb_dump_switch(struct tb *tb, struct tb_regs_switch_header *sw)
 {
-        tb_info(tb,
-                " Switch: %x:%x (Revision: %d, TB Version: %d)\n",
-                sw->vendor_id, sw->device_id, sw->revision,
-                sw->thunderbolt_version);
-        tb_info(tb, "  Max Port Number: %d\n", sw->max_port_number);
-        tb_info(tb, "  Config:\n");
-        tb_info(tb,
+        tb_dbg(tb, " Switch: %x:%x (Revision: %d, TB Version: %d)\n",
+               sw->vendor_id, sw->device_id, sw->revision,
+               sw->thunderbolt_version);
+        tb_dbg(tb, "  Max Port Number: %d\n", sw->max_port_number);
+        tb_dbg(tb, "  Config:\n");
+        tb_dbg(tb,
                 "   Upstream Port Number: %d Depth: %d Route String: %#llx Enabled: %d, PlugEventsDelay: %dms\n",
-                sw->upstream_port_number, sw->depth,
-                (((u64) sw->route_hi) << 32) | sw->route_lo,
-                sw->enabled, sw->plug_events_delay);
-        tb_info(tb,
-                "   unknown1: %#x unknown4: %#x\n",
-                sw->__unknown1, sw->__unknown4);
+               sw->upstream_port_number, sw->depth,
+               (((u64) sw->route_hi) << 32) | sw->route_lo,
+               sw->enabled, sw->plug_events_delay);
+        tb_dbg(tb, "   unknown1: %#x unknown4: %#x\n",
+               sw->__unknown1, sw->__unknown4);
 }
 
 /**
@@ -634,7 +633,7 @@ int tb_switch_reset(struct tb *tb, u64 route)
                 header.route_lo = route,
                 header.enabled = true,
         };
-        tb_info(tb, "resetting switch at %llx\n", route);
+        tb_dbg(tb, "resetting switch at %llx\n", route);
         res.err = tb_cfg_write(tb->ctl, ((u32 *) &header) + 2, route,
                         0, 2, 2, 2);
         if (res.err)
@@ -1139,7 +1138,7 @@ struct tb_switch *tb_switch_alloc(struct tb *tb, struct device *parent,
         if (tb_cfg_read(tb->ctl, &sw->config, route, 0, TB_CFG_SWITCH, 0, 5))
                 goto err_free_sw_ports;
 
-        tb_info(tb, "current switch config:\n");
+        tb_dbg(tb, "current switch config:\n");
         tb_dump_switch(tb, &sw->config);
 
         /* configure switch */
@@ -1246,9 +1245,8 @@ int tb_switch_configure(struct tb_switch *sw)
         int ret;
 
         route = tb_route(sw);
-        tb_info(tb,
-                "initializing Switch at %#llx (depth: %d, up port: %d)\n",
-                route, tb_route_length(route), sw->config.upstream_port_number);
+        tb_dbg(tb, "initializing Switch at %#llx (depth: %d, up port: %d)\n",
+               route, tb_route_length(route), sw->config.upstream_port_number);
 
         if (sw->config.vendor_id != PCI_VENDOR_ID_INTEL)
                 tb_sw_warn(sw, "unknown switch vendor id %#x\n",
@@ -1386,13 +1384,13 @@ int tb_switch_add(struct tb_switch *sw)
                         tb_sw_warn(sw, "tb_eeprom_read_rom failed\n");
                         return ret;
                 }
-                tb_sw_info(sw, "uid: %#llx\n", sw->uid);
+                tb_sw_dbg(sw, "uid: %#llx\n", sw->uid);
 
                 tb_switch_set_uuid(sw);
 
                 for (i = 0; i <= sw->config.max_port_number; i++) {
                         if (sw->ports[i].disabled) {
-                                tb_port_info(&sw->ports[i], "disabled by eeprom\n");
+                                tb_port_dbg(&sw->ports[i], "disabled by eeprom\n");
                                 continue;
                         }
                         ret = tb_init_port(&sw->ports[i]);
@@ -1405,6 +1403,14 @@ int tb_switch_add(struct tb_switch *sw)
         if (ret)
                 return ret;
 
+        if (tb_route(sw)) {
+                dev_info(&sw->dev, "new device found, vendor=%#x device=%#x\n",
+                         sw->vendor, sw->device);
+                if (sw->vendor_name && sw->device_name)
+                        dev_info(&sw->dev, "%s %s\n", sw->vendor_name,
+                                 sw->device_name);
+        }
+
         ret = tb_switch_nvm_add(sw);
         if (ret) {
                 device_del(&sw->dev);
@@ -1456,6 +1462,9 @@ void tb_switch_remove(struct tb_switch *sw)
                 tb_plug_events_active(sw, false);
 
         tb_switch_nvm_remove(sw);
+
+        if (tb_route(sw))
+                dev_info(&sw->dev, "device disconnected\n");
         device_unregister(&sw->dev);
 }
 
@@ -1483,7 +1492,7 @@ void tb_sw_set_unplugged(struct tb_switch *sw)
 int tb_switch_resume(struct tb_switch *sw)
 {
         int i, err;
-        tb_sw_info(sw, "resuming switch\n");
+        tb_sw_dbg(sw, "resuming switch\n");
 
         /*
          * Check for UID of the connected switches except for root
diff --git a/drivers/thunderbolt/tb.c b/drivers/thunderbolt/tb.c
index 1424581fd9af..30e02c716f6c 100644
--- a/drivers/thunderbolt/tb.c
+++ b/drivers/thunderbolt/tb.c
@@ -404,10 +404,10 @@ static int tb_suspend_noirq(struct tb *tb)
 {
         struct tb_cm *tcm = tb_priv(tb);
 
-        tb_info(tb, "suspending...\n");
+        tb_dbg(tb, "suspending...\n");
         tb_switch_suspend(tb->root_switch);
         tcm->hotplug_active = false; /* signal tb_handle_hotplug to quit */
-        tb_info(tb, "suspend finished\n");
+        tb_dbg(tb, "suspend finished\n");
 
         return 0;
 }
@@ -417,7 +417,7 @@ static int tb_resume_noirq(struct tb *tb)
         struct tb_cm *tcm = tb_priv(tb);
         struct tb_pci_tunnel *tunnel, *n;
 
-        tb_info(tb, "resuming...\n");
+        tb_dbg(tb, "resuming...\n");
 
         /* remove any pci devices the firmware might have setup */
         tb_switch_reset(tb, 0);
@@ -432,12 +432,12 @@ static int tb_resume_noirq(struct tb *tb)
                  * the pcie links need some time to get going.
                  * 100ms works for me...
                  */
-                tb_info(tb, "tunnels restarted, sleeping for 100ms\n");
+                tb_dbg(tb, "tunnels restarted, sleeping for 100ms\n");
                 msleep(100);
         }
          /* Allow tb_handle_hotplug to progress events */
         tcm->hotplug_active = true;
-        tb_info(tb, "resume finished\n");
+        tb_dbg(tb, "resume finished\n");
 
         return 0;
 }
diff --git a/drivers/thunderbolt/tb.h b/drivers/thunderbolt/tb.h
index 5067d69d0501..52584c4003e3 100644
--- a/drivers/thunderbolt/tb.h
+++ b/drivers/thunderbolt/tb.h
@@ -1,8 +1,9 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
- * Thunderbolt Cactus Ridge driver - bus logic (NHI independent)
+ * Thunderbolt driver - bus logic (NHI independent)
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #ifndef TB_H_
@@ -327,7 +328,7 @@ static inline int tb_port_write(struct tb_port *port, const void *buffer,
 #define tb_WARN(tb, fmt, arg...) dev_WARN(&(tb)->nhi->pdev->dev, fmt, ## arg)
 #define tb_warn(tb, fmt, arg...) dev_warn(&(tb)->nhi->pdev->dev, fmt, ## arg)
 #define tb_info(tb, fmt, arg...) dev_info(&(tb)->nhi->pdev->dev, fmt, ## arg)
-
+#define tb_dbg(tb, fmt, arg...) dev_dbg(&(tb)->nhi->pdev->dev, fmt, ## arg)
 
 #define __TB_SW_PRINT(level, sw, fmt, arg...)           \
         do {                                            \
@@ -338,7 +339,7 @@ static inline int tb_port_write(struct tb_port *port, const void *buffer,
 #define tb_sw_WARN(sw, fmt, arg...) __TB_SW_PRINT(tb_WARN, sw, fmt, ##arg)
 #define tb_sw_warn(sw, fmt, arg...) __TB_SW_PRINT(tb_warn, sw, fmt, ##arg)
 #define tb_sw_info(sw, fmt, arg...) __TB_SW_PRINT(tb_info, sw, fmt, ##arg)
-
+#define tb_sw_dbg(sw, fmt, arg...) __TB_SW_PRINT(tb_dbg, sw, fmt, ##arg)
 
 #define __TB_PORT_PRINT(level, _port, fmt, arg...)                      \
         do {                                                            \
@@ -352,6 +353,8 @@ static inline int tb_port_write(struct tb_port *port, const void *buffer,
         __TB_PORT_PRINT(tb_warn, port, fmt, ##arg)
 #define tb_port_info(port, fmt, arg...) \
         __TB_PORT_PRINT(tb_info, port, fmt, ##arg)
+#define tb_port_dbg(port, fmt, arg...) \
+        __TB_PORT_PRINT(tb_dbg, port, fmt, ##arg)
 
 struct tb *icm_probe(struct tb_nhi *nhi);
 struct tb *tb_probe(struct tb_nhi *nhi);
diff --git a/drivers/thunderbolt/tb_msgs.h b/drivers/thunderbolt/tb_msgs.h
index 2487e162c885..02c84aa3d018 100644
--- a/drivers/thunderbolt/tb_msgs.h
+++ b/drivers/thunderbolt/tb_msgs.h
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Thunderbolt control channel messages
  *
  * Copyright (C) 2014 Andreas Noever <andreas.noever@gmail.com>
  * Copyright (C) 2017, Intel Corporation
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #ifndef _TB_MSGS
diff --git a/drivers/thunderbolt/tb_regs.h b/drivers/thunderbolt/tb_regs.h
index 693b0353c3fe..6f1ff04ee195 100644
--- a/drivers/thunderbolt/tb_regs.h
+++ b/drivers/thunderbolt/tb_regs.h
@@ -1,12 +1,13 @@
 /* SPDX-License-Identifier: GPL-2.0 */
 /*
- * Thunderbolt Cactus Ridge driver - Port/Switch config area registers
+ * Thunderbolt driver - Port/Switch config area registers
  *
  * Every thunderbolt device consists (logically) of a switch with multiple
  * ports. Every port contains up to four config regions (HOPS, PORT, SWITCH,
  * COUNTERS) which are used to configure the device.
  *
  * Copyright (c) 2014 Andreas Noever <andreas.noever@gmail.com>
+ * Copyright (C) 2018, Intel Corporation
  */
 
 #ifndef _TB_REGS
diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c
index db8bece63327..e27dd8beb94b 100644
--- a/drivers/thunderbolt/xdomain.c
+++ b/drivers/thunderbolt/xdomain.c
@@ -1,13 +1,10 @@
+// SPDX-License-Identifier: GPL-2.0
 /*
  * Thunderbolt XDomain discovery protocol support
  *
  * Copyright (C) 2017, Intel Corporation
  * Authors: Michael Jamet <michael.jamet@intel.com>
  *          Mika Westerberg <mika.westerberg@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #include <linux/device.h>
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 70a7981b94b3..85644669fbe7 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -274,6 +274,8 @@ static struct class uio_class = {
         .dev_groups = uio_groups,
 };
 
+static bool uio_class_registered;
+
 /*
  * device functions
  */
@@ -668,7 +670,7 @@ static vm_fault_t uio_vma_fault(struct vm_fault *vmf)
         struct page *page;
         unsigned long offset;
         void *addr;
-        int ret = 0;
+        vm_fault_t ret = 0;
         int mi;
 
         mutex_lock(&idev->info_lock);
@@ -736,7 +738,8 @@ static int uio_mmap_physical(struct vm_area_struct *vma)
                 return -EINVAL;
 
         vma->vm_ops = &uio_physical_vm_ops;
-        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+        if (idev->info->mem[mi].memtype == UIO_MEM_PHYS)
+                vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
 
         /*
          * We cannot use the vm_iomap_memory() helper here,
@@ -793,18 +796,19 @@ static int uio_mmap(struct file *filep, struct vm_area_struct *vma)
         }
 
         switch (idev->info->mem[mi].memtype) {
-                case UIO_MEM_PHYS:
-                        ret = uio_mmap_physical(vma);
-                        break;
-                case UIO_MEM_LOGICAL:
-                case UIO_MEM_VIRTUAL:
-                        ret = uio_mmap_logical(vma);
-                        break;
-                default:
-                        ret = -EINVAL;
+        case UIO_MEM_IOVA:
+        case UIO_MEM_PHYS:
+                ret = uio_mmap_physical(vma);
+                break;
+        case UIO_MEM_LOGICAL:
+        case UIO_MEM_VIRTUAL:
+                ret = uio_mmap_logical(vma);
+                break;
+        default:
+                ret = -EINVAL;
         }
 
-out:
+ out:
         mutex_unlock(&idev->info_lock);
         return ret;
 }
@@ -876,6 +880,9 @@ static int init_uio_class(void)
                 printk(KERN_ERR "class_register failed for uio\n");
                 goto err_class_register;
         }
+
+        uio_class_registered = true;
+
         return 0;
 
 err_class_register:
@@ -886,6 +893,7 @@ exit:
 
 static void release_uio_class(void)
 {
+        uio_class_registered = false;
         class_unregister(&uio_class);
         uio_major_cleanup();
 }
@@ -912,6 +920,9 @@ int __uio_register_device(struct module *owner,
         struct uio_device *idev;
         int ret = 0;
 
+        if (!uio_class_registered)
+                return -EPROBE_DEFER;
+
         if (!parent || !info || !info->name || !info->version)
                 return -EINVAL;
 
diff --git a/drivers/uio/uio_dmem_genirq.c b/drivers/uio/uio_dmem_genirq.c
index e1134a4d97f3..003badaef5f3 100644
--- a/drivers/uio/uio_dmem_genirq.c
+++ b/drivers/uio/uio_dmem_genirq.c
@@ -163,7 +163,8 @@ static int uio_dmem_genirq_probe(struct platform_device *pdev)
                         dev_err(&pdev->dev, "unable to kmalloc\n");
                         goto bad2;
                 }
-                uioinfo->name = pdev->dev.of_node->name;
+                uioinfo->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%pOFn",
+                                               pdev->dev.of_node);
                 uioinfo->version = "devicetree";
 
                 /* Multiple IRQs are not supported */
diff --git a/drivers/uio/uio_fsl_elbc_gpcm.c b/drivers/uio/uio_fsl_elbc_gpcm.c
index bbc17effae5e..9cc37fe07d35 100644
--- a/drivers/uio/uio_fsl_elbc_gpcm.c
+++ b/drivers/uio/uio_fsl_elbc_gpcm.c
@@ -382,8 +382,7 @@ static int uio_fsl_elbc_gpcm_probe(struct platform_device *pdev)
         }
 
         /* set all UIO data */
-        if (node->name)
-                info->mem[0].name = kstrdup(node->name, GFP_KERNEL);
+        info->mem[0].name = kasprintf(GFP_KERNEL, "%pOFn", node);
         info->mem[0].addr = res.start;
         info->mem[0].size = resource_size(&res);
         info->mem[0].memtype = UIO_MEM_PHYS;
diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c
index e401be8321ab..c2493d011225 100644
--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -17,7 +17,6 @@
  * # echo -n "ed963694-e847-4b2a-85af-bc9cfc11d6f3" \
  *    > /sys/bus/vmbus/drivers/uio_hv_generic/bind
  */
-#define DEBUG 1
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/device.h>
@@ -33,13 +32,13 @@
 
 #include "../hv/hyperv_vmbus.h"
 
-#define DRIVER_VERSION  "0.02.0"
+#define DRIVER_VERSION  "0.02.1"
 #define DRIVER_AUTHOR   "Stephen Hemminger <sthemmin at microsoft.com>"
 #define DRIVER_DESC     "Generic UIO driver for VMBus devices"
 
 #define HV_RING_SIZE     512    /* pages */
-#define SEND_BUFFER_SIZE (15 * 1024 * 1024)
-#define RECV_BUFFER_SIZE (15 * 1024 * 1024)
+#define SEND_BUFFER_SIZE (16 * 1024 * 1024)
+#define RECV_BUFFER_SIZE (31 * 1024 * 1024)
 
 /*
  * List of resources to be mapped to user space
@@ -56,6 +55,7 @@ enum hv_uio_map {
 struct hv_uio_private_data {
         struct uio_info info;
         struct hv_device *device;
+        atomic_t refcnt;
 
         void    *recv_buf;
         u32     recv_gpadl;
@@ -129,13 +129,12 @@ static int hv_uio_ring_mmap(struct file *filp, struct kobject *kobj,
 {
         struct vmbus_channel *channel
                 = container_of(kobj, struct vmbus_channel, kobj);
-        struct hv_device *dev = channel->primary_channel->device_obj;
-        u16 q_idx = channel->offermsg.offer.sub_channel_index;
+        void *ring_buffer = page_address(channel->ringbuffer_page);
 
-        dev_dbg(&dev->device, "mmap channel %u pages %#lx at %#lx\n",
-                q_idx, vma_pages(vma), vma->vm_pgoff);
+        if (channel->state != CHANNEL_OPENED_STATE)
+                return -ENODEV;
 
-        return vm_iomap_memory(vma, virt_to_phys(channel->ringbuffer_pages),
+        return vm_iomap_memory(vma, virt_to_phys(ring_buffer),
                                channel->ringbuffer_pagecount << PAGE_SHIFT);
 }
 
@@ -176,58 +175,104 @@ hv_uio_new_channel(struct vmbus_channel *new_sc)
         }
 }
 
+/* free the reserved buffers for send and receive */
 static void
 hv_uio_cleanup(struct hv_device *dev, struct hv_uio_private_data *pdata)
 {
-        if (pdata->send_gpadl)
+        if (pdata->send_gpadl) {
                 vmbus_teardown_gpadl(dev->channel, pdata->send_gpadl);
-        vfree(pdata->send_buf);
+                pdata->send_gpadl = 0;
+                vfree(pdata->send_buf);
+        }
 
-        if (pdata->recv_gpadl)
+        if (pdata->recv_gpadl) {
                 vmbus_teardown_gpadl(dev->channel, pdata->recv_gpadl);
-        vfree(pdata->recv_buf);
+                pdata->recv_gpadl = 0;
+                vfree(pdata->recv_buf);
+        }
+}
+
+/* VMBus primary channel is opened on first use */
+static int
+hv_uio_open(struct uio_info *info, struct inode *inode)
+{
+        struct hv_uio_private_data *pdata
+                = container_of(info, struct hv_uio_private_data, info);
+        struct hv_device *dev = pdata->device;
+        int ret;
+
+        if (atomic_inc_return(&pdata->refcnt) != 1)
+                return 0;
+
+        ret = vmbus_connect_ring(dev->channel,
+                                 hv_uio_channel_cb, dev->channel);
+
+        if (ret == 0)
+                dev->channel->inbound.ring_buffer->interrupt_mask = 1;
+        else
+                atomic_dec(&pdata->refcnt);
+
+        return ret;
+}
+
+/* VMBus primary channel is closed on last close */
+static int
+hv_uio_release(struct uio_info *info, struct inode *inode)
+{
+        struct hv_uio_private_data *pdata
+                = container_of(info, struct hv_uio_private_data, info);
+        struct hv_device *dev = pdata->device;
+        int ret = 0;
+
+        if (atomic_dec_and_test(&pdata->refcnt))
+                ret = vmbus_disconnect_ring(dev->channel);
+
+        return ret;
 }
 
 static int
 hv_uio_probe(struct hv_device *dev,
              const struct hv_vmbus_device_id *dev_id)
 {
+        struct vmbus_channel *channel = dev->channel;
         struct hv_uio_private_data *pdata;
+        void *ring_buffer;
         int ret;
 
+        /* Communicating with host has to be via shared memory not hypercall */
+        if (!channel->offermsg.monitor_allocated) {
+                dev_err(&dev->device, "vmbus channel requires hypercall\n");
+                return -ENOTSUPP;
+        }
+
         pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
         if (!pdata)
                 return -ENOMEM;
 
-        ret = vmbus_open(dev->channel, HV_RING_SIZE * PAGE_SIZE,
-                         HV_RING_SIZE * PAGE_SIZE, NULL, 0,
-                         hv_uio_channel_cb, dev->channel);
+        ret = vmbus_alloc_ring(channel, HV_RING_SIZE * PAGE_SIZE,
+                               HV_RING_SIZE * PAGE_SIZE);
         if (ret)
                 goto fail;
 
-        /* Communicating with host has to be via shared memory not hypercall */
-        if (!dev->channel->offermsg.monitor_allocated) {
-                dev_err(&dev->device, "vmbus channel requires hypercall\n");
-                ret = -ENOTSUPP;
-                goto fail_close;
-        }
-
-        dev->channel->inbound.ring_buffer->interrupt_mask = 1;
-        set_channel_read_mode(dev->channel, HV_CALL_ISR);
+        set_channel_read_mode(channel, HV_CALL_ISR);
 
         /* Fill general uio info */
         pdata->info.name = "uio_hv_generic";
         pdata->info.version = DRIVER_VERSION;
         pdata->info.irqcontrol = hv_uio_irqcontrol;
+        pdata->info.open = hv_uio_open;
+        pdata->info.release = hv_uio_release;
         pdata->info.irq = UIO_IRQ_CUSTOM;
+        atomic_set(&pdata->refcnt, 0);
 
         /* mem resources */
         pdata->info.mem[TXRX_RING_MAP].name = "txrx_rings";
+        ring_buffer = page_address(channel->ringbuffer_page);
         pdata->info.mem[TXRX_RING_MAP].addr
-                = (uintptr_t)dev->channel->ringbuffer_pages;
+                = (uintptr_t)virt_to_phys(ring_buffer);
         pdata->info.mem[TXRX_RING_MAP].size
-                = dev->channel->ringbuffer_pagecount << PAGE_SHIFT;
-        pdata->info.mem[TXRX_RING_MAP].memtype = UIO_MEM_LOGICAL;
+                = channel->ringbuffer_pagecount << PAGE_SHIFT;
+        pdata->info.mem[TXRX_RING_MAP].memtype = UIO_MEM_IOVA;
 
         pdata->info.mem[INT_PAGE_MAP].name = "int_page";
         pdata->info.mem[INT_PAGE_MAP].addr
@@ -247,7 +292,7 @@ hv_uio_probe(struct hv_device *dev,
                 goto fail_close;
         }
 
-        ret = vmbus_establish_gpadl(dev->channel, pdata->recv_buf,
+        ret = vmbus_establish_gpadl(channel, pdata->recv_buf,
                                     RECV_BUFFER_SIZE, &pdata->recv_gpadl);
         if (ret)
                 goto fail_close;
@@ -261,14 +306,13 @@ hv_uio_probe(struct hv_device *dev,
         pdata->info.mem[RECV_BUF_MAP].size = RECV_BUFFER_SIZE;
         pdata->info.mem[RECV_BUF_MAP].memtype = UIO_MEM_VIRTUAL;
 
-
         pdata->send_buf = vzalloc(SEND_BUFFER_SIZE);
         if (pdata->send_buf == NULL) {
                 ret = -ENOMEM;
                 goto fail_close;
         }
 
-        ret = vmbus_establish_gpadl(dev->channel, pdata->send_buf,
+        ret = vmbus_establish_gpadl(channel, pdata->send_buf,
                                     SEND_BUFFER_SIZE, &pdata->send_gpadl);
         if (ret)
                 goto fail_close;
@@ -290,10 +334,10 @@ hv_uio_probe(struct hv_device *dev,
                 goto fail_close;
         }
 
-        vmbus_set_chn_rescind_callback(dev->channel, hv_uio_rescind);
-        vmbus_set_sc_create_callback(dev->channel, hv_uio_new_channel);
+        vmbus_set_chn_rescind_callback(channel, hv_uio_rescind);
+        vmbus_set_sc_create_callback(channel, hv_uio_new_channel);
 
-        ret = sysfs_create_bin_file(&dev->channel->kobj, &ring_buffer_bin_attr);
+        ret = sysfs_create_bin_file(&channel->kobj, &ring_buffer_bin_attr);
         if (ret)
                 dev_notice(&dev->device,
                            "sysfs create ring bin file failed; %d\n", ret);
@@ -304,7 +348,6 @@ hv_uio_probe(struct hv_device *dev,
 
 fail_close:
         hv_uio_cleanup(dev, pdata);
-        vmbus_close(dev->channel);
 fail:
         kfree(pdata);
 
@@ -322,7 +365,8 @@ hv_uio_remove(struct hv_device *dev)
         uio_unregister_device(&pdata->info);
         hv_uio_cleanup(dev, pdata);
         hv_set_drvdata(dev, NULL);
-        vmbus_close(dev->channel);
+
+        vmbus_free_ring(dev->channel);
         kfree(pdata);
         return 0;
 }
diff --git a/drivers/uio/uio_pdrv_genirq.c b/drivers/uio/uio_pdrv_genirq.c
index f598ecddc8a7..6c759934bff3 100644
--- a/drivers/uio/uio_pdrv_genirq.c
+++ b/drivers/uio/uio_pdrv_genirq.c
@@ -118,7 +118,8 @@ static int uio_pdrv_genirq_probe(struct platform_device *pdev)
                         dev_err(&pdev->dev, "unable to kmalloc\n");
                         return -ENOMEM;
                 }
-                uioinfo->name = pdev->dev.of_node->name;
+                uioinfo->name = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%pOFn",
+                                               pdev->dev.of_node);
                 uioinfo->version = "devicetree";
                 /* Multiple IRQs are not supported */
         }
diff --git a/drivers/vme/vme.c b/drivers/vme/vme.c
index 92500f6bdad1..520a5f9c27de 100644
--- a/drivers/vme/vme.c
+++ b/drivers/vme/vme.c
@@ -1890,7 +1890,6 @@ static int __vme_register_driver_bus(struct vme_driver *drv,
 
 err_reg:
         put_device(&vdev->dev);
-        kfree(vdev);
 err_devalloc:
         list_for_each_entry_safe(vdev, tmp, &drv->devices, drv_list) {
                 list_del(&vdev->drv_list);
diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
index 83fc9aab34e8..3099052e1243 100644
--- a/drivers/w1/masters/omap_hdq.c
+++ b/drivers/w1/masters/omap_hdq.c
@@ -763,6 +763,8 @@ static int omap_hdq_remove(struct platform_device *pdev)
         /* remove module dependency */
         pm_runtime_disable(&pdev->dev);
 
+        w1_remove_master_device(&omap_w1_master);
+
         return 0;
 }
 
diff --git a/drivers/w1/slaves/w1_ds2438.c b/drivers/w1/slaves/w1_ds2438.c
index bf641a191d07..7c4e33dbee4d 100644
--- a/drivers/w1/slaves/w1_ds2438.c
+++ b/drivers/w1/slaves/w1_ds2438.c
@@ -186,8 +186,8 @@ static int w1_ds2438_change_config_bit(struct w1_slave *sl, u8 mask, u8 value)
         return -1;
 }
 
-static uint16_t w1_ds2438_get_voltage(struct w1_slave *sl,
-                                      int adc_input, uint16_t *voltage)
+static int w1_ds2438_get_voltage(struct w1_slave *sl,
+                                 int adc_input, uint16_t *voltage)
 {
         unsigned int retries = W1_DS2438_RETRIES;
         u8 w1_buf[DS2438_PAGE_SIZE + 1 /*for CRC*/];
@@ -235,6 +235,25 @@ post_unlock:
         return ret;
 }
 
+static int w1_ds2438_get_current(struct w1_slave *sl, int16_t *voltage)
+{
+        u8 w1_buf[DS2438_PAGE_SIZE + 1 /*for CRC*/];
+        int ret;
+
+        mutex_lock(&sl->master->bus_mutex);
+
+        if (w1_ds2438_get_page(sl, 0, w1_buf) == 0) {
+                /* The voltage measured across current sense resistor RSENS. */
+                *voltage = (((int16_t) w1_buf[DS2438_CURRENT_MSB]) << 8) | ((int16_t) w1_buf[DS2438_CURRENT_LSB]);
+                ret = 0;
+        } else
+                ret = -1;
+
+        mutex_unlock(&sl->master->bus_mutex);
+
+        return ret;
+}
+
 static ssize_t iad_write(struct file *filp, struct kobject *kobj,
                          struct bin_attribute *bin_attr, char *buf,
                          loff_t off, size_t count)
@@ -257,6 +276,27 @@ static ssize_t iad_write(struct file *filp, struct kobject *kobj,
         return ret;
 }
 
+static ssize_t iad_read(struct file *filp, struct kobject *kobj,
+                        struct bin_attribute *bin_attr, char *buf,
+                        loff_t off, size_t count)
+{
+        struct w1_slave *sl = kobj_to_w1_slave(kobj);
+        int ret;
+        int16_t voltage;
+
+        if (off != 0)
+                return 0;
+        if (!buf)
+                return -EINVAL;
+
+        if (w1_ds2438_get_current(sl, &voltage) == 0) {
+                ret = snprintf(buf, count, "%i\n", voltage);
+        } else
+                ret = -EIO;
+
+        return ret;
+}
+
 static ssize_t page0_read(struct file *filp, struct kobject *kobj,
                           struct bin_attribute *bin_attr, char *buf,
                           loff_t off, size_t count)
@@ -272,9 +312,13 @@ static ssize_t page0_read(struct file *filp, struct kobject *kobj,
 
         mutex_lock(&sl->master->bus_mutex);
 
+        /* Read no more than page0 size */
+        if (count > DS2438_PAGE_SIZE)
+                count = DS2438_PAGE_SIZE;
+
         if (w1_ds2438_get_page(sl, 0, w1_buf) == 0) {
-                memcpy(buf, &w1_buf, DS2438_PAGE_SIZE);
-                ret = DS2438_PAGE_SIZE;
+                memcpy(buf, &w1_buf, count);
+                ret = count;
         } else
                 ret = -EIO;
 
@@ -289,7 +333,6 @@ static ssize_t temperature_read(struct file *filp, struct kobject *kobj,
 {
         struct w1_slave *sl = kobj_to_w1_slave(kobj);
         int ret;
-        ssize_t c = PAGE_SIZE;
         int16_t temp;
 
         if (off != 0)
@@ -298,8 +341,7 @@ static ssize_t temperature_read(struct file *filp, struct kobject *kobj,
                 return -EINVAL;
 
         if (w1_ds2438_get_temperature(sl, &temp) == 0) {
-                c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", temp);
-                ret = PAGE_SIZE - c;
+                ret = snprintf(buf, count, "%i\n", temp);
         } else
                 ret = -EIO;
 
@@ -312,7 +354,6 @@ static ssize_t vad_read(struct file *filp, struct kobject *kobj,
 {
         struct w1_slave *sl = kobj_to_w1_slave(kobj);
         int ret;
-        ssize_t c = PAGE_SIZE;
         uint16_t voltage;
 
         if (off != 0)
@@ -321,8 +362,7 @@ static ssize_t vad_read(struct file *filp, struct kobject *kobj,
                 return -EINVAL;
 
         if (w1_ds2438_get_voltage(sl, DS2438_ADC_INPUT_VAD, &voltage) == 0) {
-                c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", voltage);
-                ret = PAGE_SIZE - c;
+                ret = snprintf(buf, count, "%u\n", voltage);
         } else
                 ret = -EIO;
 
@@ -335,7 +375,6 @@ static ssize_t vdd_read(struct file *filp, struct kobject *kobj,
 {
         struct w1_slave *sl = kobj_to_w1_slave(kobj);
         int ret;
-        ssize_t c = PAGE_SIZE;
         uint16_t voltage;
 
         if (off != 0)
@@ -344,15 +383,14 @@ static ssize_t vdd_read(struct file *filp, struct kobject *kobj,
                 return -EINVAL;
 
         if (w1_ds2438_get_voltage(sl, DS2438_ADC_INPUT_VDD, &voltage) == 0) {
-                c -= snprintf(buf + PAGE_SIZE - c, c, "%d\n", voltage);
-                ret = PAGE_SIZE - c;
+                ret = snprintf(buf, count, "%u\n", voltage);
         } else
                 ret = -EIO;
 
         return ret;
 }
 
-static BIN_ATTR(iad, S_IRUGO | S_IWUSR | S_IWGRP, NULL, iad_write, 1);
+static BIN_ATTR(iad, S_IRUGO | S_IWUSR | S_IWGRP, iad_read, iad_write, 0);
 static BIN_ATTR_RO(page0, DS2438_PAGE_SIZE);
 static BIN_ATTR_RO(temperature, 0/* real length varies */);
 static BIN_ATTR_RO(vad, 0/* real length varies */);
diff --git a/include/linux/coresight.h b/include/linux/coresight.h
index d828a6efe0b1..46c67a764877 100644
--- a/include/linux/coresight.h
+++ b/include/linux/coresight.h
@@ -94,20 +94,15 @@ union coresight_dev_subtype {
  * @cpu:        the CPU a source belongs to. Only applicable for ETM/PTMs.
  * @name:       name of the component as shown under sysfs.
  * @nr_inport:  number of input ports for this component.
- * @outports:   list of remote endpoint port number.
- * @child_names:name of all child components connected to this device.
- * @child_ports:child component port number the current component is
-                connected  to.
  * @nr_outport: number of output ports for this component.
+ * @conns:      Array of nr_outport connections from this component
  */
 struct coresight_platform_data {
         int cpu;
         const char *name;
         int nr_inport;
-        int *outports;
-        const char **child_names;
-        int *child_ports;
         int nr_outport;
+        struct coresight_connection *conns;
 };
 
 /**
@@ -190,23 +185,15 @@ struct coresight_device {
  * @disable:            disables the sink.
  * @alloc_buffer:       initialises perf's ring buffer for trace collection.
  * @free_buffer:        release memory allocated in @get_config.
- * @set_buffer:         initialises buffer mechanic before a trace session.
- * @reset_buffer:       finalises buffer mechanic after a trace session.
  * @update_buffer:      update buffer pointers after a trace session.
  */
 struct coresight_ops_sink {
-        int (*enable)(struct coresight_device *csdev, u32 mode);
+        int (*enable)(struct coresight_device *csdev, u32 mode, void *data);
         void (*disable)(struct coresight_device *csdev);
         void *(*alloc_buffer)(struct coresight_device *csdev, int cpu,
                               void **pages, int nr_pages, bool overwrite);
         void (*free_buffer)(void *config);
-        int (*set_buffer)(struct coresight_device *csdev,
-                          struct perf_output_handle *handle,
-                          void *sink_config);
-        unsigned long (*reset_buffer)(struct coresight_device *csdev,
-                                      struct perf_output_handle *handle,
-                                      void *sink_config);
-        void (*update_buffer)(struct coresight_device *csdev,
+        unsigned long (*update_buffer)(struct coresight_device *csdev,
                               struct perf_output_handle *handle,
                               void *sink_config);
 };
@@ -270,6 +257,13 @@ extern int coresight_enable(struct coresight_device *csdev);
 extern void coresight_disable(struct coresight_device *csdev);
 extern int coresight_timeout(void __iomem *addr, u32 offset,
                              int position, int value);
+
+extern int coresight_claim_device(void __iomem *base);
+extern int coresight_claim_device_unlocked(void __iomem *base);
+
+extern void coresight_disclaim_device(void __iomem *base);
+extern void coresight_disclaim_device_unlocked(void __iomem *base);
+
 #else
 static inline struct coresight_device *
 coresight_register(struct coresight_desc *desc) { return NULL; }
@@ -279,6 +273,19 @@ coresight_enable(struct coresight_device *csdev) { return -ENOSYS; }
 static inline void coresight_disable(struct coresight_device *csdev) {}
 static inline int coresight_timeout(void __iomem *addr, u32 offset,
                                      int position, int value) { return 1; }
+static inline int coresight_claim_device_unlocked(void __iomem *base)
+{
+        return -EINVAL;
+}
+
+static inline int coresight_claim_device(void __iomem *base)
+{
+        return -EINVAL;
+}
+
+static inline void coresight_disclaim_device(void __iomem *base) {}
+static inline void coresight_disclaim_device_unlocked(void __iomem *base) {}
+
 #endif
 
 #ifdef CONFIG_OF
diff --git a/include/linux/fpga/fpga-bridge.h b/include/linux/fpga/fpga-bridge.h
index ce550fcf6360..817600a32c93 100644
--- a/include/linux/fpga/fpga-bridge.h
+++ b/include/linux/fpga/fpga-bridge.h
@@ -69,4 +69,8 @@ void fpga_bridge_free(struct fpga_bridge *br);
 int fpga_bridge_register(struct fpga_bridge *br);
 void fpga_bridge_unregister(struct fpga_bridge *br);
 
+struct fpga_bridge
+*devm_fpga_bridge_create(struct device *dev, const char *name,
+                         const struct fpga_bridge_ops *br_ops, void *priv);
+
 #endif /* _LINUX_FPGA_BRIDGE_H */
diff --git a/include/linux/fpga/fpga-mgr.h b/include/linux/fpga/fpga-mgr.h
index 8ab5df769923..e8ca62b2cb5b 100644
--- a/include/linux/fpga/fpga-mgr.h
+++ b/include/linux/fpga/fpga-mgr.h
@@ -198,4 +198,8 @@ void fpga_mgr_free(struct fpga_manager *mgr);
 int fpga_mgr_register(struct fpga_manager *mgr);
 void fpga_mgr_unregister(struct fpga_manager *mgr);
 
+struct fpga_manager *devm_fpga_mgr_create(struct device *dev, const char *name,
+                                          const struct fpga_manager_ops *mops,
+                                          void *priv);
+
 #endif /*_LINUX_FPGA_MGR_H */
diff --git a/include/linux/fpga/fpga-region.h b/include/linux/fpga/fpga-region.h
index 0521b7f577a4..27cb706275db 100644
--- a/include/linux/fpga/fpga-region.h
+++ b/include/linux/fpga/fpga-region.h
@@ -44,4 +44,8 @@ void fpga_region_free(struct fpga_region *region);
 int fpga_region_register(struct fpga_region *region);
 void fpga_region_unregister(struct fpga_region *region);
 
+struct fpga_region
+*devm_fpga_region_create(struct device *dev, struct fpga_manager *mgr,
+                        int (*get_bridges)(struct fpga_region *));
+
 #endif /* _FPGA_REGION_H */
diff --git a/include/linux/hyperv.h b/include/linux/hyperv.h
index efda23cf32c7..b3e24368930a 100644
--- a/include/linux/hyperv.h
+++ b/include/linux/hyperv.h
@@ -739,8 +739,9 @@ struct vmbus_channel {
         u32 ringbuffer_gpadlhandle;
 
         /* Allocated memory for ring buffer */
-        void *ringbuffer_pages;
+        struct page *ringbuffer_page;
         u32 ringbuffer_pagecount;
+        u32 ringbuffer_send_offset;
         struct hv_ring_buffer_info outbound;    /* send to parent */
         struct hv_ring_buffer_info inbound;     /* receive from parent */
 
@@ -1021,6 +1022,14 @@ struct vmbus_packet_mpb_array {
         struct hv_mpb_array range;
 } __packed;
 
+int vmbus_alloc_ring(struct vmbus_channel *channel,
+                     u32 send_size, u32 recv_size);
+void vmbus_free_ring(struct vmbus_channel *channel);
+
+int vmbus_connect_ring(struct vmbus_channel *channel,
+                       void (*onchannel_callback)(void *context),
+                       void *context);
+int vmbus_disconnect_ring(struct vmbus_channel *channel);
 
 extern int vmbus_open(struct vmbus_channel *channel,
                             u32 send_ringbuffersize,
@@ -1125,6 +1134,7 @@ struct hv_device {
         u16 device_id;
 
         struct device device;
+        char *driver_override; /* Driver name to force a match */
 
         struct vmbus_channel *channel;
         struct kset          *channels_kset;
@@ -1442,7 +1452,7 @@ extern bool vmbus_prep_negotiate_resp(struct icmsg_hdr *icmsghdrp, u8 *buf,
                                 const int *srv_version, int srv_vercnt,
                                 int *nego_fw_version, int *nego_srv_version);
 
-void hv_process_channel_removal(u32 relid);
+void hv_process_channel_removal(struct vmbus_channel *channel);
 
 void vmbus_setevent(struct vmbus_channel *channel);
 /*
diff --git a/include/linux/nvmem-consumer.h b/include/linux/nvmem-consumer.h
index 4e85447f7860..312bfa5efd80 100644
--- a/include/linux/nvmem-consumer.h
+++ b/include/linux/nvmem-consumer.h
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * nvmem framework consumer.
  *
  * Copyright (C) 2015 Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
  * Copyright (C) 2013 Maxime Ripard <maxime.ripard@free-electrons.com>
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2.  This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
  */
 
 #ifndef _LINUX_NVMEM_CONSUMER_H
@@ -14,6 +11,7 @@
 
 #include <linux/err.h>
 #include <linux/errno.h>
+#include <linux/notifier.h>
 
 struct device;
 struct device_node;
@@ -29,11 +27,36 @@ struct nvmem_cell_info {
         unsigned int            nbits;
 };
 
+/**
+ * struct nvmem_cell_lookup - cell lookup entry
+ *
+ * @nvmem_name: Name of the provider.
+ * @cell_name:  Name of the nvmem cell as defined in the name field of
+ *              struct nvmem_cell_info.
+ * @dev_id:     Name of the consumer device that will be associated with
+ *              this cell.
+ * @con_id:     Connector id for this cell lookup.
+ */
+struct nvmem_cell_lookup {
+        const char              *nvmem_name;
+        const char              *cell_name;
+        const char              *dev_id;
+        const char              *con_id;
+        struct list_head        node;
+};
+
+enum {
+        NVMEM_ADD = 1,
+        NVMEM_REMOVE,
+        NVMEM_CELL_ADD,
+        NVMEM_CELL_REMOVE,
+};
+
 #if IS_ENABLED(CONFIG_NVMEM)
 
 /* Cell based interface */
-struct nvmem_cell *nvmem_cell_get(struct device *dev, const char *name);
-struct nvmem_cell *devm_nvmem_cell_get(struct device *dev, const char *name);
+struct nvmem_cell *nvmem_cell_get(struct device *dev, const char *id);
+struct nvmem_cell *devm_nvmem_cell_get(struct device *dev, const char *id);
 void nvmem_cell_put(struct nvmem_cell *cell);
 void devm_nvmem_cell_put(struct device *dev, struct nvmem_cell *cell);
 void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len);
@@ -55,18 +78,28 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
 int nvmem_device_cell_write(struct nvmem_device *nvmem,
                             struct nvmem_cell_info *info, void *buf);
 
+const char *nvmem_dev_name(struct nvmem_device *nvmem);
+
+void nvmem_add_cell_lookups(struct nvmem_cell_lookup *entries,
+                            size_t nentries);
+void nvmem_del_cell_lookups(struct nvmem_cell_lookup *entries,
+                            size_t nentries);
+
+int nvmem_register_notifier(struct notifier_block *nb);
+int nvmem_unregister_notifier(struct notifier_block *nb);
+
 #else
 
 static inline struct nvmem_cell *nvmem_cell_get(struct device *dev,
-                                                const char *name)
+                                                const char *id)
 {
-        return ERR_PTR(-ENOSYS);
+        return ERR_PTR(-EOPNOTSUPP);
 }
 
 static inline struct nvmem_cell *devm_nvmem_cell_get(struct device *dev,
-                                       const char *name)
+                                                     const char *id)
 {
-        return ERR_PTR(-ENOSYS);
+        return ERR_PTR(-EOPNOTSUPP);
 }
 
 static inline void devm_nvmem_cell_put(struct device *dev,
@@ -80,31 +113,31 @@ static inline void nvmem_cell_put(struct nvmem_cell *cell)
 
 static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
 {
-        return ERR_PTR(-ENOSYS);
+        return ERR_PTR(-EOPNOTSUPP);
 }
 
 static inline int nvmem_cell_write(struct nvmem_cell *cell,
                                     const char *buf, size_t len)
 {
-        return -ENOSYS;
+        return -EOPNOTSUPP;
 }
 
 static inline int nvmem_cell_read_u32(struct device *dev,
                                       const char *cell_id, u32 *val)
 {
-        return -ENOSYS;
+        return -EOPNOTSUPP;
 }
 
 static inline struct nvmem_device *nvmem_device_get(struct device *dev,
                                                     const char *name)
 {
-        return ERR_PTR(-ENOSYS);
+        return ERR_PTR(-EOPNOTSUPP);
 }
 
 static inline struct nvmem_device *devm_nvmem_device_get(struct device *dev,
                                                          const char *name)
 {
-        return ERR_PTR(-ENOSYS);
+        return ERR_PTR(-EOPNOTSUPP);
 }
 
 static inline void nvmem_device_put(struct nvmem_device *nvmem)
@@ -120,47 +153,68 @@ static inline ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem,
                                          struct nvmem_cell_info *info,
                                          void *buf)
 {
-        return -ENOSYS;
+        return -EOPNOTSUPP;
 }
 
 static inline int nvmem_device_cell_write(struct nvmem_device *nvmem,
                                           struct nvmem_cell_info *info,
                                           void *buf)
 {
-        return -ENOSYS;
+        return -EOPNOTSUPP;
 }
 
 static inline int nvmem_device_read(struct nvmem_device *nvmem,
                                     unsigned int offset, size_t bytes,
                                     void *buf)
 {
-        return -ENOSYS;
+        return -EOPNOTSUPP;
 }
 
 static inline int nvmem_device_write(struct nvmem_device *nvmem,
                                      unsigned int offset, size_t bytes,
                                      void *buf)
 {
-        return -ENOSYS;
+        return -EOPNOTSUPP;
 }
+
+static inline const char *nvmem_dev_name(struct nvmem_device *nvmem)
+{
+        return NULL;
+}
+
+static inline void
+nvmem_add_cell_lookups(struct nvmem_cell_lookup *entries, size_t nentries) {}
+static inline void
+nvmem_del_cell_lookups(struct nvmem_cell_lookup *entries, size_t nentries) {}
+
+static inline int nvmem_register_notifier(struct notifier_block *nb)
+{
+        return -EOPNOTSUPP;
+}
+
+static inline int nvmem_unregister_notifier(struct notifier_block *nb)
+{
+        return -EOPNOTSUPP;
+}
+
 #endif /* CONFIG_NVMEM */
 
 #if IS_ENABLED(CONFIG_NVMEM) && IS_ENABLED(CONFIG_OF)
 struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
-                                     const char *name);
+                                     const char *id);
 struct nvmem_device *of_nvmem_device_get(struct device_node *np,
                                          const char *name);
 #else
 static inline struct nvmem_cell *of_nvmem_cell_get(struct device_node *np,
-                                     const char *name)
+                                                   const char *id)
 {
-        return ERR_PTR(-ENOSYS);
+        return ERR_PTR(-EOPNOTSUPP);
 }
 
 static inline struct nvmem_device *of_nvmem_device_get(struct device_node *np,
                                                        const char *name)
 {
-        return ERR_PTR(-ENOSYS);
+        return ERR_PTR(-EOPNOTSUPP);
 }
 #endif /* CONFIG_NVMEM && CONFIG_OF */
 
diff --git a/include/linux/nvmem-provider.h b/include/linux/nvmem-provider.h
index 24def6ad09bb..1e3283c2af77 100644
--- a/include/linux/nvmem-provider.h
+++ b/include/linux/nvmem-provider.h
@@ -1,12 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * nvmem framework provider.
  *
  * Copyright (C) 2015 Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
  * Copyright (C) 2013 Maxime Ripard <maxime.ripard@free-electrons.com>
- *
- * This file is licensed under the terms of the GNU General Public
- * License version 2.  This program is licensed "as is" without any
- * warranty of any kind, whether express or implied.
  */
 
 #ifndef _LINUX_NVMEM_PROVIDER_H
@@ -67,30 +64,46 @@ struct nvmem_config {
         struct device           *base_dev;
 };
 
+/**
+ * struct nvmem_cell_table - NVMEM cell definitions for given provider
+ *
+ * @nvmem_name:         Provider name.
+ * @cells:              Array of cell definitions.
+ * @ncells:             Number of cell definitions in the array.
+ * @node:               List node.
+ *
+ * This structure together with related helper functions is provided for users
+ * that don't can't access the nvmem provided structure but wish to register
+ * cell definitions for it e.g. board files registering an EEPROM device.
+ */
+struct nvmem_cell_table {
+        const char              *nvmem_name;
+        const struct nvmem_cell_info    *cells;
+        size_t                  ncells;
+        struct list_head        node;
+};
+
 #if IS_ENABLED(CONFIG_NVMEM)
 
 struct nvmem_device *nvmem_register(const struct nvmem_config *cfg);
-int nvmem_unregister(struct nvmem_device *nvmem);
+void nvmem_unregister(struct nvmem_device *nvmem);
 
 struct nvmem_device *devm_nvmem_register(struct device *dev,
                                          const struct nvmem_config *cfg);
 
 int devm_nvmem_unregister(struct device *dev, struct nvmem_device *nvmem);
 
-int nvmem_add_cells(struct nvmem_device *nvmem,
-                    const struct nvmem_cell_info *info,
-                    int ncells);
+void nvmem_add_cell_table(struct nvmem_cell_table *table);
+void nvmem_del_cell_table(struct nvmem_cell_table *table);
+
 #else
 
 static inline struct nvmem_device *nvmem_register(const struct nvmem_config *c)
 {
-        return ERR_PTR(-ENOSYS);
+        return ERR_PTR(-EOPNOTSUPP);
 }
 
-static inline int nvmem_unregister(struct nvmem_device *nvmem)
-{
-        return -ENOSYS;
-}
+static inline void nvmem_unregister(struct nvmem_device *nvmem) {}
 
 static inline struct nvmem_device *
 devm_nvmem_register(struct device *dev, const struct nvmem_config *c)
@@ -101,16 +114,11 @@ devm_nvmem_register(struct device *dev, const struct nvmem_config *c)
 static inline int
 devm_nvmem_unregister(struct device *dev, struct nvmem_device *nvmem)
 {
-        return nvmem_unregister(nvmem);
-
+        return -EOPNOTSUPP;
 }
 
-static inline int nvmem_add_cells(struct nvmem_device *nvmem,
-                                  const struct nvmem_cell_info *info,
-                                  int ncells)
-{
-        return -ENOSYS;
-}
+static inline void nvmem_add_cell_table(struct nvmem_cell_table *table) {}
+static inline void nvmem_del_cell_table(struct nvmem_cell_table *table) {}
 
 #endif /* CONFIG_NVMEM */
 #endif  /* ifndef _LINUX_NVMEM_PROVIDER_H */
diff --git a/include/linux/soundwire/sdw.h b/include/linux/soundwire/sdw.h
index 962971e6a9c7..df313913e856 100644
--- a/include/linux/soundwire/sdw.h
+++ b/include/linux/soundwire/sdw.h
@@ -678,6 +678,9 @@ struct sdw_master_ops {
  * @defer_msg: Defer message
  * @clk_stop_timeout: Clock stop timeout computed
  * @bank_switch_timeout: Bank switch timeout computed
+ * @multi_link: Store bus property that indicates if multi links
+ * are supported. This flag is populated by drivers after reading
+ * appropriate firmware (ACPI/DT).
  */
 struct sdw_bus {
         struct device *dev;
@@ -694,6 +697,7 @@ struct sdw_bus {
         struct sdw_defer defer_msg;
         unsigned int clk_stop_timeout;
         u32 bank_switch_timeout;
+        bool multi_link;
 };
 
 int sdw_add_bus_master(struct sdw_bus *bus);
@@ -768,14 +772,18 @@ struct sdw_stream_params {
  * @params: Stream parameters
  * @state: Current state of the stream
  * @type: Stream type PCM or PDM
- * @m_rt: Master runtime
+ * @master_list: List of Master runtime(s) in this stream.
+ * master_list can contain only one m_rt per Master instance
+ * for a stream
+ * @m_rt_count: Count of Master runtime(s) in this stream
  */
 struct sdw_stream_runtime {
         char *name;
         struct sdw_stream_params params;
         enum sdw_stream_state state;
         enum sdw_stream_type type;
-        struct sdw_master_runtime *m_rt;
+        struct list_head master_list;
+        int m_rt_count;
 };
 
 struct sdw_stream_runtime *sdw_alloc_stream(char *stream_name);
diff --git a/include/linux/string.h b/include/linux/string.h
index 4a5a0eb7df51..27d0482e5e05 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -131,6 +131,13 @@ static inline void *memset_p(void **p, void *v, __kernel_size_t n)
                 return memset64((uint64_t *)p, (uintptr_t)v, n);
 }
 
+extern void **__memcat_p(void **a, void **b);
+#define memcat_p(a, b) ({                                       \
+        BUILD_BUG_ON_MSG(!__same_type(*(a), *(b)),              \
+                         "type mismatch in memcat_p()");        \
+        (typeof(*a) *)__memcat_p((void **)(a), (void **)(b));   \
+})
+
 #ifndef __HAVE_ARCH_MEMCPY
 extern void * memcpy(void *,const void *,__kernel_size_t);
 #endif
diff --git a/include/linux/thunderbolt.h b/include/linux/thunderbolt.h
index a3ed26082bc1..bf6ec83e60ee 100644
--- a/include/linux/thunderbolt.h
+++ b/include/linux/thunderbolt.h
@@ -1,3 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0 */
 /*
  * Thunderbolt service API
  *
@@ -5,10 +6,6 @@
  * Copyright (C) 2017, Intel Corporation
  * Authors: Michael Jamet <michael.jamet@intel.com>
  *          Mika Westerberg <mika.westerberg@linux.intel.com>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
  */
 
 #ifndef THUNDERBOLT_H_
diff --git a/include/linux/uio_driver.h b/include/linux/uio_driver.h
index 6f8b68cd460f..a3cd7cb67a69 100644
--- a/include/linux/uio_driver.h
+++ b/include/linux/uio_driver.h
@@ -133,6 +133,7 @@ extern void uio_event_notify(struct uio_info *info);
 #define UIO_MEM_PHYS    1
 #define UIO_MEM_LOGICAL 2
 #define UIO_MEM_VIRTUAL 3
+#define UIO_MEM_IOVA    4
 
 /* defines for uio_port->porttype */
 #define UIO_PORT_NONE   0
diff --git a/include/uapi/linux/android/binder.h b/include/uapi/linux/android/binder.h
index bfaec6903b8b..b9ba520f7e4b 100644
--- a/include/uapi/linux/android/binder.h
+++ b/include/uapi/linux/android/binder.h
@@ -200,6 +200,15 @@ struct binder_node_debug_info {
         __u32            has_weak_ref;
 };
 
+struct binder_node_info_for_ref {
+        __u32            handle;
+        __u32            strong_count;
+        __u32            weak_count;
+        __u32            reserved1;
+        __u32            reserved2;
+        __u32            reserved3;
+};
+
 #define BINDER_WRITE_READ               _IOWR('b', 1, struct binder_write_read)
 #define BINDER_SET_IDLE_TIMEOUT         _IOW('b', 3, __s64)
 #define BINDER_SET_MAX_THREADS          _IOW('b', 5, __u32)
@@ -208,6 +217,7 @@ struct binder_node_debug_info {
 #define BINDER_THREAD_EXIT              _IOW('b', 8, __s32)
 #define BINDER_VERSION                  _IOWR('b', 9, struct binder_version)
 #define BINDER_GET_NODE_DEBUG_INFO      _IOWR('b', 11, struct binder_node_debug_info)
+#define BINDER_GET_NODE_INFO_FOR_REF    _IOWR('b', 12, struct binder_node_info_for_ref)
 
 /*
  * NOTE: Two special error codes you should check for when calling
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 8d24f4ed66fd..04adfc3b185e 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1965,6 +1965,14 @@ config TEST_DEBUG_VIRTUAL
 
           If unsure, say N.
 
+config TEST_MEMCAT_P
+        tristate "Test memcat_p() helper function"
+        help
+          Test the memcat_p() helper for correctly merging two
+          pointer arrays together.
+
+          If unsure, say N.
+
 endif # RUNTIME_TESTING_MENU
 
 config MEMTEST
diff --git a/lib/Makefile b/lib/Makefile
index 56a8d9c23ef3..fa3eb1b4c0e3 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -24,7 +24,7 @@ lib-y := ctype.o string.o vsprintf.o cmdline.o \
          flex_proportions.o ratelimit.o show_mem.o \
          is_single_threaded.o plist.o decompress.o kobject_uevent.o \
          earlycpio.o seq_buf.o siphash.o dec_and_lock.o \
-         nmi_backtrace.o nodemask.o win_minmax.o
+         nmi_backtrace.o nodemask.o win_minmax.o memcat_p.o
 
 lib-$(CONFIG_PRINTK) += dump_stack.o
 lib-$(CONFIG_MMU) += ioremap.o
@@ -71,6 +71,7 @@ obj-$(CONFIG_TEST_UUID) += test_uuid.o
 obj-$(CONFIG_TEST_PARMAN) += test_parman.o
 obj-$(CONFIG_TEST_KMOD) += test_kmod.o
 obj-$(CONFIG_TEST_DEBUG_VIRTUAL) += test_debug_virtual.o
+obj-$(CONFIG_TEST_MEMCAT_P) += test_memcat_p.o
 
 ifeq ($(CONFIG_DEBUG_KOBJECT),y)
 CFLAGS_kobject.o += -DDEBUG
diff --git a/lib/memcat_p.c b/lib/memcat_p.c
new file mode 100644
index 000000000000..b810fbc66962
--- /dev/null
+++ b/lib/memcat_p.c
@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/slab.h>
+
+/*
+ * Merge two NULL-terminated pointer arrays into a newly allocated
+ * array, which is also NULL-terminated. Nomenclature is inspired by
+ * memset_p() and memcat() found elsewhere in the kernel source tree.
+ */
+void **__memcat_p(void **a, void **b)
+{
+        void **p = a, **new;
+        int nr;
+
+        /* count the elements in both arrays */
+        for (nr = 0, p = a; *p; nr++, p++)
+                ;
+        for (p = b; *p; nr++, p++)
+                ;
+        /* one for the NULL-terminator */
+        nr++;
+
+        new = kmalloc_array(nr, sizeof(void *), GFP_KERNEL);
+        if (!new)
+                return NULL;
+
+        /* nr -> last index; p points to NULL in b[] */
+        for (nr--; nr >= 0; nr--, p = p == b ? &a[nr] : p - 1)
+                new[nr] = *p;
+
+        return new;
+}
+EXPORT_SYMBOL_GPL(__memcat_p);
+
diff --git a/lib/string.c b/lib/string.c
index 2c0900a5d51a..38e4ca08e757 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -27,6 +27,7 @@
 #include <linux/export.h>
 #include <linux/bug.h>
 #include <linux/errno.h>
+#include <linux/slab.h>
 
 #include <asm/byteorder.h>
 #include <asm/word-at-a-time.h>
diff --git a/lib/test_memcat_p.c b/lib/test_memcat_p.c
new file mode 100644
index 000000000000..849c477d49d0
--- /dev/null
+++ b/lib/test_memcat_p.c
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Test cases for memcat_p() in lib/memcat_p.c
+ */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/string.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+
+struct test_struct {
+        int             num;
+        unsigned int    magic;
+};
+
+#define MAGIC           0xf00ff00f
+/* Size of each of the NULL-terminated input arrays */
+#define INPUT_MAX       128
+/* Expected number of non-NULL elements in the output array */
+#define EXPECT          (INPUT_MAX * 2 - 2)
+
+static int __init test_memcat_p_init(void)
+{
+        struct test_struct **in0, **in1, **out, **p;
+        int err = -ENOMEM, i, r, total = 0;
+
+        in0 = kcalloc(INPUT_MAX, sizeof(*in0), GFP_KERNEL);
+        if (!in0)
+                return err;
+
+        in1 = kcalloc(INPUT_MAX, sizeof(*in1), GFP_KERNEL);
+        if (!in1)
+                goto err_free_in0;
+
+        for (i = 0, r = 1; i < INPUT_MAX - 1; i++) {
+                in0[i] = kmalloc(sizeof(**in0), GFP_KERNEL);
+                if (!in0[i])
+                        goto err_free_elements;
+
+                in1[i] = kmalloc(sizeof(**in1), GFP_KERNEL);
+                if (!in1[i]) {
+                        kfree(in0[i]);
+                        goto err_free_elements;
+                }
+
+                /* lifted from test_sort.c */
+                r = (r * 725861) % 6599;
+                in0[i]->num = r;
+                in1[i]->num = -r;
+                in0[i]->magic = MAGIC;
+                in1[i]->magic = MAGIC;
+        }
+
+        in0[i] = in1[i] = NULL;
+
+        out = memcat_p(in0, in1);
+        if (!out)
+                goto err_free_all_elements;
+
+        err = -EINVAL;
+        for (i = 0, p = out; *p && (i < INPUT_MAX * 2 - 1); p++, i++) {
+                total += (*p)->num;
+
+                if ((*p)->magic != MAGIC) {
+                        pr_err("test failed: wrong magic at %d: %u\n", i,
+                               (*p)->magic);
+                        goto err_free_out;
+                }
+        }
+
+        if (total) {
+                pr_err("test failed: expected zero total, got %d\n", total);
+                goto err_free_out;
+        }
+
+        if (i != EXPECT) {
+                pr_err("test failed: expected output size %d, got %d\n",
+                       EXPECT, i);
+                goto err_free_out;
+        }
+
+        for (i = 0; i < INPUT_MAX - 1; i++)
+                if (out[i] != in0[i] || out[i + INPUT_MAX - 1] != in1[i]) {
+                        pr_err("test failed: wrong element order at %d\n", i);
+                        goto err_free_out;
+                }
+
+        err = 0;
+        pr_info("test passed\n");
+
+err_free_out:
+        kfree(out);
+err_free_all_elements:
+        i = INPUT_MAX;
+err_free_elements:
+        for (i--; i >= 0; i--) {
+                kfree(in1[i]);
+                kfree(in0[i]);
+        }
+
+        kfree(in1);
+err_free_in0:
+        kfree(in0);
+
+        return err;
+}
+
+static void __exit test_memcat_p_exit(void)
+{
+}
+
+module_init(test_memcat_p_init);
+module_exit(test_memcat_p_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/samples/mei/mei-amt-version.c b/samples/mei/mei-amt-version.c
index 57d0d871dcf7..33e67bd1dc34 100644
--- a/samples/mei/mei-amt-version.c
+++ b/samples/mei/mei-amt-version.c
@@ -370,7 +370,7 @@ static uint32_t amt_host_if_call(struct amt_host_if *acmd,
                         unsigned int expected_sz)
 {
         uint32_t in_buf_sz;
-        uint32_t out_buf_sz;
+        ssize_t out_buf_sz;
         ssize_t written;
         uint32_t status;
         struct amt_host_if_resp_header *msg_hdr;