Merge tag 'char-misc-4.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver updates from Greg KH:
 "Here's the big char/misc driver patchset for 4.1-rc1.

  Lots of different driver subsystem updates here, nothing major, full
  details are in the shortlog.

  All of this has been in linux-next for a while"

* tag 'char-misc-4.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (133 commits)
  mei: trace: remove unused TRACE_SYSTEM_STRING
  DTS: ARM: OMAP3-N900: Add lis3lv02d support
  Documentation: DT: lis302: update wakeup binding
  lis3lv02d: DT: add wakeup unit 2 and wakeup threshold
  lis3lv02d: DT: use s32 to support negative values
  Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case
  Drivers: hv: hv_balloon: correctly handle val.freeram<num_pages case
  mei: replace check for connection instead of transitioning
  mei: use mei_cl_is_connected consistently
  mei: fix mei_poll operation
  hv_vmbus: Add gradually increased delay for retries in vmbus_post_msg()
  Drivers: hv: hv_balloon: survive ballooning request with num_pages=0
  Drivers: hv: hv_balloon: eliminate jumps in piecewiese linear floor function
  Drivers: hv: hv_balloon: do not online pages in offline blocks
  hv: remove the per-channel workqueue
  hv: don't schedule new works in vmbus_onoffer()/vmbus_onoffer_rescind()
  hv: run non-blocking message handlers in the dispatch tasklet
  coresight: moving to new "hwtracing" directory
  coresight-tmc: Adding a status interface to sysfs
  coresight: remove the unnecessary configuration coresight-default-sink
  ...

33 files changed, 1042 insertions, 920 deletions

diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
index 4c4a59b25537..7f90ce5a569a 100644
--- a/drivers/misc/bh1780gli.c
+++ b/drivers/misc/bh1780gli.c
@@ -230,6 +230,8 @@ static const struct i2c_device_id bh1780_id[] = {
         { },
 };
 
+MODULE_DEVICE_TABLE(i2c, bh1780_id);
+
 #ifdef CONFIG_OF
 static const struct of_device_id of_bh1780_match[] = {
         { .compatible = "rohm,bh1780gli", },
diff --git a/drivers/misc/carma/carma-fpga-program.c b/drivers/misc/carma/carma-fpga-program.c
index 06166ac000e0..0b1bd85e4ae6 100644
--- a/drivers/misc/carma/carma-fpga-program.c
+++ b/drivers/misc/carma/carma-fpga-program.c
@@ -479,6 +479,7 @@ static int fpga_program_block(struct fpga_dev *priv, void *buf, size_t count)
 static noinline int fpga_program_cpu(struct fpga_dev *priv)
 {
         int ret;
+        unsigned long timeout;
 
         /* Disable the programmer */
         fpga_programmer_disable(priv);
@@ -497,8 +498,8 @@ static noinline int fpga_program_cpu(struct fpga_dev *priv)
                 goto out_disable_controller;
 
         /* Wait for the interrupt handler to signal that programming finished */
-        ret = wait_for_completion_timeout(&priv->completion, 2 * HZ);
-        if (!ret) {
+        timeout = wait_for_completion_timeout(&priv->completion, 2 * HZ);
+        if (!timeout) {
                 dev_err(priv->dev, "Timed out waiting for completion\n");
                 ret = -ETIMEDOUT;
                 goto out_disable_controller;
@@ -536,6 +537,7 @@ static noinline int fpga_program_dma(struct fpga_dev *priv)
         struct sg_table table;
         dma_cookie_t cookie;
         int ret, i;
+        unsigned long timeout;
 
         /* Disable the programmer */
         fpga_programmer_disable(priv);
@@ -623,8 +625,8 @@ static noinline int fpga_program_dma(struct fpga_dev *priv)
         dev_dbg(priv->dev, "enabled the controller\n");
 
         /* Wait for the interrupt handler to signal that programming finished */
-        ret = wait_for_completion_timeout(&priv->completion, 2 * HZ);
-        if (!ret) {
+        timeout = wait_for_completion_timeout(&priv->completion, 2 * HZ);
+        if (!timeout) {
                 dev_err(priv->dev, "Timed out waiting for completion\n");
                 ret = -ETIMEDOUT;
                 goto out_disable_controller;
@@ -1142,7 +1144,7 @@ out_return:
         return ret;
 }
 
-static struct of_device_id fpga_of_match[] = {
+static const struct of_device_id fpga_of_match[] = {
         { .compatible = "carma,fpga-programmer", },
         {},
 };
diff --git a/drivers/misc/carma/carma-fpga.c b/drivers/misc/carma/carma-fpga.c
index 68cdfe151bdb..5aba3fd789de 100644
--- a/drivers/misc/carma/carma-fpga.c
+++ b/drivers/misc/carma/carma-fpga.c
@@ -1486,7 +1486,7 @@ static int data_of_remove(struct platform_device *op)
         return 0;
 }
 
-static struct of_device_id data_of_match[] = {
+static const struct of_device_id data_of_match[] = {
         { .compatible = "carma,carma-fpga", },
         {},
 };
diff --git a/drivers/misc/lis3lv02d/lis3lv02d.c b/drivers/misc/lis3lv02d/lis3lv02d.c
index 3ef4627f9cb1..4739689d23ad 100644
--- a/drivers/misc/lis3lv02d/lis3lv02d.c
+++ b/drivers/misc/lis3lv02d/lis3lv02d.c
@@ -950,6 +950,7 @@ int lis3lv02d_init_dt(struct lis3lv02d *lis3)
         struct lis3lv02d_platform_data *pdata;
         struct device_node *np = lis3->of_node;
         u32 val;
+        s32 sval;
 
         if (!lis3->of_node)
                 return 0;
@@ -1031,6 +1032,23 @@ int lis3lv02d_init_dt(struct lis3lv02d *lis3)
                 pdata->wakeup_flags |= LIS3_WAKEUP_Z_LO;
         if (of_get_property(np, "st,wakeup-z-hi", NULL))
                 pdata->wakeup_flags |= LIS3_WAKEUP_Z_HI;
+        if (of_get_property(np, "st,wakeup-threshold", &val))
+                pdata->wakeup_thresh = val;
+
+        if (of_get_property(np, "st,wakeup2-x-lo", NULL))
+                pdata->wakeup_flags2 |= LIS3_WAKEUP_X_LO;
+        if (of_get_property(np, "st,wakeup2-x-hi", NULL))
+                pdata->wakeup_flags2 |= LIS3_WAKEUP_X_HI;
+        if (of_get_property(np, "st,wakeup2-y-lo", NULL))
+                pdata->wakeup_flags2 |= LIS3_WAKEUP_Y_LO;
+        if (of_get_property(np, "st,wakeup2-y-hi", NULL))
+                pdata->wakeup_flags2 |= LIS3_WAKEUP_Y_HI;
+        if (of_get_property(np, "st,wakeup2-z-lo", NULL))
+                pdata->wakeup_flags2 |= LIS3_WAKEUP_Z_LO;
+        if (of_get_property(np, "st,wakeup2-z-hi", NULL))
+                pdata->wakeup_flags2 |= LIS3_WAKEUP_Z_HI;
+        if (of_get_property(np, "st,wakeup2-threshold", &val))
+                pdata->wakeup_thresh2 = val;
 
         if (!of_property_read_u32(np, "st,highpass-cutoff-hz", &val)) {
                 switch (val) {
@@ -1054,29 +1072,29 @@ int lis3lv02d_init_dt(struct lis3lv02d *lis3)
         if (of_get_property(np, "st,hipass2-disable", NULL))
                 pdata->hipass_ctrl |= LIS3_HIPASS2_DISABLE;
 
-        if (of_get_property(np, "st,axis-x", &val))
-                pdata->axis_x = val;
-        if (of_get_property(np, "st,axis-y", &val))
-                pdata->axis_y = val;
-        if (of_get_property(np, "st,axis-z", &val))
-                pdata->axis_z = val;
+        if (of_property_read_s32(np, "st,axis-x", &sval) == 0)
+                pdata->axis_x = sval;
+        if (of_property_read_s32(np, "st,axis-y", &sval) == 0)
+                pdata->axis_y = sval;
+        if (of_property_read_s32(np, "st,axis-z", &sval) == 0)
+                pdata->axis_z = sval;
 
         if (of_get_property(np, "st,default-rate", NULL))
                 pdata->default_rate = val;
 
-        if (of_get_property(np, "st,min-limit-x", &val))
-                pdata->st_min_limits[0] = val;
-        if (of_get_property(np, "st,min-limit-y", &val))
-                pdata->st_min_limits[1] = val;
-        if (of_get_property(np, "st,min-limit-z", &val))
-                pdata->st_min_limits[2] = val;
-
-        if (of_get_property(np, "st,max-limit-x", &val))
-                pdata->st_max_limits[0] = val;
-        if (of_get_property(np, "st,max-limit-y", &val))
-                pdata->st_max_limits[1] = val;
-        if (of_get_property(np, "st,max-limit-z", &val))
-                pdata->st_max_limits[2] = val;
+        if (of_property_read_s32(np, "st,min-limit-x", &sval) == 0)
+                pdata->st_min_limits[0] = sval;
+        if (of_property_read_s32(np, "st,min-limit-y", &sval) == 0)
+                pdata->st_min_limits[1] = sval;
+        if (of_property_read_s32(np, "st,min-limit-z", &sval) == 0)
+                pdata->st_min_limits[2] = sval;
+
+        if (of_property_read_s32(np, "st,max-limit-x", &sval) == 0)
+                pdata->st_max_limits[0] = sval;
+        if (of_property_read_s32(np, "st,max-limit-y", &sval) == 0)
+                pdata->st_max_limits[1] = sval;
+        if (of_property_read_s32(np, "st,max-limit-z", &sval) == 0)
+                pdata->st_max_limits[2] = sval;
 
 
         lis3->pdata = pdata;
diff --git a/drivers/misc/lis3lv02d/lis3lv02d_i2c.c b/drivers/misc/lis3lv02d/lis3lv02d_i2c.c
index 63fe096d4462..e3e7f1dc27ba 100644
--- a/drivers/misc/lis3lv02d/lis3lv02d_i2c.c
+++ b/drivers/misc/lis3lv02d/lis3lv02d_i2c.c
@@ -106,7 +106,7 @@ static union axis_conversion lis3lv02d_axis_map =
         { .as_array = { LIS3_DEV_X, LIS3_DEV_Y, LIS3_DEV_Z } };
 
 #ifdef CONFIG_OF
-static struct of_device_id lis3lv02d_i2c_dt_ids[] = {
+static const struct of_device_id lis3lv02d_i2c_dt_ids[] = {
         { .compatible = "st,lis3lv02d" },
         {}
 };
diff --git a/drivers/misc/lis3lv02d/lis3lv02d_spi.c b/drivers/misc/lis3lv02d/lis3lv02d_spi.c
index bd06d0cfac45..b2f6e1651ac9 100644
--- a/drivers/misc/lis3lv02d/lis3lv02d_spi.c
+++ b/drivers/misc/lis3lv02d/lis3lv02d_spi.c
@@ -61,7 +61,7 @@ static union axis_conversion lis3lv02d_axis_normal =
         { .as_array = { 1, 2, 3 } };
 
 #ifdef CONFIG_OF
-static struct of_device_id lis302dl_spi_dt_ids[] = {
+static const struct of_device_id lis302dl_spi_dt_ids[] = {
         { .compatible = "st,lis302dl-spi" },
         {}
 };
diff --git a/drivers/misc/mei/Makefile b/drivers/misc/mei/Makefile
index 8ebc6cda1373..518914a82b83 100644
--- a/drivers/misc/mei/Makefile
+++ b/drivers/misc/mei/Makefile
@@ -21,3 +21,6 @@ mei-me-objs += hw-me.o
 obj-$(CONFIG_INTEL_MEI_TXE) += mei-txe.o
 mei-txe-objs := pci-txe.o
 mei-txe-objs += hw-txe.o
+
+mei-$(CONFIG_EVENT_TRACING) += mei-trace.o
+CFLAGS_mei-trace.o = -I$(src)
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index 40ea639fa413..d2cd53e3fac3 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -48,10 +48,7 @@ void mei_amthif_reset_params(struct mei_device *dev)
 {
         /* reset iamthif parameters. */
         dev->iamthif_current_cb = NULL;
-        dev->iamthif_msg_buf_size = 0;
-        dev->iamthif_msg_buf_index = 0;
         dev->iamthif_canceled = false;
-        dev->iamthif_ioctl = false;
         dev->iamthif_state = MEI_IAMTHIF_IDLE;
         dev->iamthif_timer = 0;
         dev->iamthif_stall_timer = 0;
@@ -69,7 +66,6 @@ int mei_amthif_host_init(struct mei_device *dev)
 {
         struct mei_cl *cl = &dev->iamthif_cl;
         struct mei_me_client *me_cl;
-        unsigned char *msg_buf;
         int ret;
 
         dev->iamthif_state = MEI_IAMTHIF_IDLE;
@@ -90,18 +86,6 @@ int mei_amthif_host_init(struct mei_device *dev)
         dev->iamthif_mtu = me_cl->props.max_msg_length;
         dev_dbg(dev->dev, "IAMTHIF_MTU = %d\n", dev->iamthif_mtu);
 
-        kfree(dev->iamthif_msg_buf);
-        dev->iamthif_msg_buf = NULL;
-
-        /* allocate storage for ME message buffer */
-        msg_buf = kcalloc(dev->iamthif_mtu,
-                        sizeof(unsigned char), GFP_KERNEL);
-        if (!msg_buf) {
-                ret = -ENOMEM;
-                goto out;
-        }
-
-        dev->iamthif_msg_buf = msg_buf;
 
         ret = mei_cl_link(cl, MEI_IAMTHIF_HOST_CLIENT_ID);
         if (ret < 0) {
@@ -194,30 +178,33 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
                 dev_dbg(dev->dev, "woke up from sleep\n");
         }
 
+        if (cb->status) {
+                rets = cb->status;
+                dev_dbg(dev->dev, "read operation failed %d\n", rets);
+                goto free;
+        }
 
         dev_dbg(dev->dev, "Got amthif data\n");
         dev->iamthif_timer = 0;
 
-        if (cb) {
-                timeout = cb->read_time +
-                        mei_secs_to_jiffies(MEI_IAMTHIF_READ_TIMER);
-                dev_dbg(dev->dev, "amthif timeout = %lud\n",
-                                timeout);
-
-                if  (time_after(jiffies, timeout)) {
-                        dev_dbg(dev->dev, "amthif Time out\n");
-                        /* 15 sec for the message has expired */
-                        list_del(&cb->list);
-                        rets = -ETIME;
-                        goto free;
-                }
+        timeout = cb->read_time +
+                mei_secs_to_jiffies(MEI_IAMTHIF_READ_TIMER);
+        dev_dbg(dev->dev, "amthif timeout = %lud\n",
+                        timeout);
+
+        if  (time_after(jiffies, timeout)) {
+                dev_dbg(dev->dev, "amthif Time out\n");
+                /* 15 sec for the message has expired */
+                list_del_init(&cb->list);
+                rets = -ETIME;
+                goto free;
         }
         /* if the whole message will fit remove it from the list */
         if (cb->buf_idx >= *offset && length >= (cb->buf_idx - *offset))
-                list_del(&cb->list);
+                list_del_init(&cb->list);
         else if (cb->buf_idx > 0 && cb->buf_idx <= *offset) {
                 /* end of the message has been reached */
-                list_del(&cb->list);
+                list_del_init(&cb->list);
                 rets = 0;
                 goto free;
         }
@@ -225,15 +212,15 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
                  * remove message from deletion list
                  */
 
-        dev_dbg(dev->dev, "amthif cb->response_buffer size - %d\n",
-            cb->response_buffer.size);
+        dev_dbg(dev->dev, "amthif cb->buf size - %d\n",
+            cb->buf.size);
         dev_dbg(dev->dev, "amthif cb->buf_idx - %lu\n", cb->buf_idx);
 
         /* length is being truncated to PAGE_SIZE, however,
          * the buf_idx may point beyond */
         length = min_t(size_t, length, (cb->buf_idx - *offset));
 
-        if (copy_to_user(ubuf, cb->response_buffer.data + *offset, length)) {
+        if (copy_to_user(ubuf, cb->buf.data + *offset, length)) {
                 dev_dbg(dev->dev, "failed to copy data to userland\n");
                 rets = -EFAULT;
         } else {
@@ -252,126 +239,88 @@ out:
 }
 
 /**
- * mei_amthif_send_cmd - send amthif command to the ME
+ * mei_amthif_read_start - queue message for sending read credential
  *
- * @dev: the device structure
- * @cb: mei call back struct
+ * @cl: host client
+ * @file: file pointer of message recipient
  *
  * Return: 0 on success, <0 on failure.
- *
  */
-static int mei_amthif_send_cmd(struct mei_device *dev, struct mei_cl_cb *cb)
+static int mei_amthif_read_start(struct mei_cl *cl, struct file *file)
 {
-        struct mei_msg_hdr mei_hdr;
-        struct mei_cl *cl;
-        int ret;
-
-        if (!dev || !cb)
-                return -ENODEV;
+        struct mei_device *dev = cl->dev;
+        struct mei_cl_cb *cb;
+        size_t length = dev->iamthif_mtu;
+        int rets;
 
-        dev_dbg(dev->dev, "write data to amthif client.\n");
+        cb = mei_io_cb_init(cl, MEI_FOP_READ, file);
+        if (!cb) {
+                rets = -ENOMEM;
+                goto err;
+        }
 
-        dev->iamthif_state = MEI_IAMTHIF_WRITING;
-        dev->iamthif_current_cb = cb;
-        dev->iamthif_file_object = cb->file_object;
-        dev->iamthif_canceled = false;
-        dev->iamthif_ioctl = true;
-        dev->iamthif_msg_buf_size = cb->request_buffer.size;
-        memcpy(dev->iamthif_msg_buf, cb->request_buffer.data,
-               cb->request_buffer.size);
-        cl = &dev->iamthif_cl;
+        rets = mei_io_cb_alloc_buf(cb, length);
+        if (rets)
+                goto err;
 
-        ret = mei_cl_flow_ctrl_creds(cl);
-        if (ret < 0)
-                return ret;
+        list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
 
-        if (ret && mei_hbuf_acquire(dev)) {
-                ret = 0;
-                if (cb->request_buffer.size > mei_hbuf_max_len(dev)) {
-                        mei_hdr.length = mei_hbuf_max_len(dev);
-                        mei_hdr.msg_complete = 0;
-                } else {
-                        mei_hdr.length = cb->request_buffer.size;
-                        mei_hdr.msg_complete = 1;
-                }
+        dev->iamthif_state = MEI_IAMTHIF_READING;
+        dev->iamthif_file_object = cb->file_object;
+        dev->iamthif_current_cb = cb;
 
-                mei_hdr.host_addr = cl->host_client_id;
-                mei_hdr.me_addr = cl->me_client_id;
-                mei_hdr.reserved = 0;
-                mei_hdr.internal = 0;
-                dev->iamthif_msg_buf_index += mei_hdr.length;
-                ret = mei_write_message(dev, &mei_hdr, dev->iamthif_msg_buf);
-                if (ret)
-                        return ret;
-
-                if (mei_hdr.msg_complete) {
-                        if (mei_cl_flow_ctrl_reduce(cl))
-                                return -EIO;
-                        dev->iamthif_flow_control_pending = true;
-                        dev->iamthif_state = MEI_IAMTHIF_FLOW_CONTROL;
-                        dev_dbg(dev->dev, "add amthif cb to write waiting list\n");
-                        dev->iamthif_current_cb = cb;
-                        dev->iamthif_file_object = cb->file_object;
-                        list_add_tail(&cb->list, &dev->write_waiting_list.list);
-                } else {
-                        dev_dbg(dev->dev, "message does not complete, so add amthif cb to write list.\n");
-                        list_add_tail(&cb->list, &dev->write_list.list);
-                }
-        } else {
-                list_add_tail(&cb->list, &dev->write_list.list);
-        }
         return 0;
+err:
+        mei_io_cb_free(cb);
+        return rets;
 }
 
 /**
- * mei_amthif_write - write amthif data to amthif client
+ * mei_amthif_send_cmd - send amthif command to the ME
  *
- * @dev: the device structure
+ * @cl: the host client
  * @cb: mei call back struct
  *
  * Return: 0 on success, <0 on failure.
- *
  */
-int mei_amthif_write(struct mei_device *dev, struct mei_cl_cb *cb)
+static int mei_amthif_send_cmd(struct mei_cl *cl, struct mei_cl_cb *cb)
 {
+        struct mei_device *dev;
         int ret;
 
-        if (!dev || !cb)
+        if (!cl->dev || !cb)
                 return -ENODEV;
 
-        ret = mei_io_cb_alloc_resp_buf(cb, dev->iamthif_mtu);
-        if (ret)
+        dev = cl->dev;
+
+        dev->iamthif_state = MEI_IAMTHIF_WRITING;
+        dev->iamthif_current_cb = cb;
+        dev->iamthif_file_object = cb->file_object;
+        dev->iamthif_canceled = false;
+
+        ret = mei_cl_write(cl, cb, false);
+        if (ret < 0)
                 return ret;
 
-        cb->fop_type = MEI_FOP_WRITE;
+        if (cb->completed)
+                cb->status = mei_amthif_read_start(cl, cb->file_object);
 
-        if (!list_empty(&dev->amthif_cmd_list.list) ||
-            dev->iamthif_state != MEI_IAMTHIF_IDLE) {
-                dev_dbg(dev->dev,
-                        "amthif state = %d\n", dev->iamthif_state);
-                dev_dbg(dev->dev, "AMTHIF: add cb to the wait list\n");
-                list_add_tail(&cb->list, &dev->amthif_cmd_list.list);
-                return 0;
-        }
-        return mei_amthif_send_cmd(dev, cb);
+        return 0;
 }
+
 /**
  * mei_amthif_run_next_cmd - send next amt command from queue
  *
  * @dev: the device structure
+ *
+ * Return: 0 on success, <0 on failure.
  */
-void mei_amthif_run_next_cmd(struct mei_device *dev)
+int mei_amthif_run_next_cmd(struct mei_device *dev)
 {
+        struct mei_cl *cl = &dev->iamthif_cl;
         struct mei_cl_cb *cb;
-        int ret;
-
-        if (!dev)
-                return;
 
-        dev->iamthif_msg_buf_size = 0;
-        dev->iamthif_msg_buf_index = 0;
         dev->iamthif_canceled = false;
-        dev->iamthif_ioctl = true;
         dev->iamthif_state = MEI_IAMTHIF_IDLE;
         dev->iamthif_timer = 0;
         dev->iamthif_file_object = NULL;
@@ -381,13 +330,48 @@ void mei_amthif_run_next_cmd(struct mei_device *dev)
         cb = list_first_entry_or_null(&dev->amthif_cmd_list.list,
                                         typeof(*cb), list);
         if (!cb)
-                return;
-        list_del(&cb->list);
-        ret =  mei_amthif_send_cmd(dev, cb);
-        if (ret)
-                dev_warn(dev->dev, "amthif write failed status = %d\n", ret);
+                return 0;
+
+        list_del_init(&cb->list);
+        return mei_amthif_send_cmd(cl, cb);
 }
 
+/**
+ * mei_amthif_write - write amthif data to amthif client
+ *
+ * @cl: host client
+ * @cb: mei call back struct
+ *
+ * Return: 0 on success, <0 on failure.
+ */
+int mei_amthif_write(struct mei_cl *cl, struct mei_cl_cb *cb)
+{
+
+        struct mei_device *dev;
+
+        if (WARN_ON(!cl || !cl->dev))
+                return -ENODEV;
+
+        if (WARN_ON(!cb))
+                return -EINVAL;
+
+        dev = cl->dev;
+
+        list_add_tail(&cb->list, &dev->amthif_cmd_list.list);
+        return mei_amthif_run_next_cmd(dev);
+}
+
+/**
+ * mei_amthif_poll - the amthif poll function
+ *
+ * @dev: the device structure
+ * @file: pointer to file structure
+ * @wait: pointer to poll_table structure
+ *
+ * Return: poll mask
+ *
+ * Locking: called under "dev->device_lock" lock
+ */
 
 unsigned int mei_amthif_poll(struct mei_device *dev,
                 struct file *file, poll_table *wait)
@@ -396,19 +380,12 @@ unsigned int mei_amthif_poll(struct mei_device *dev,
 
         poll_wait(file, &dev->iamthif_cl.wait, wait);
 
-        mutex_lock(&dev->device_lock);
-        if (!mei_cl_is_connected(&dev->iamthif_cl)) {
-
-                mask = POLLERR;
-
-        } else if (dev->iamthif_state == MEI_IAMTHIF_READ_COMPLETE &&
-                   dev->iamthif_file_object == file) {
+        if (dev->iamthif_state == MEI_IAMTHIF_READ_COMPLETE &&
+            dev->iamthif_file_object == file) {
 
-                mask |= (POLLIN | POLLRDNORM);
-                dev_dbg(dev->dev, "run next amthif cb\n");
+                mask |= POLLIN | POLLRDNORM;
                 mei_amthif_run_next_cmd(dev);
         }
-        mutex_unlock(&dev->device_lock);
 
         return mask;
 }
@@ -427,71 +404,14 @@ unsigned int mei_amthif_poll(struct mei_device *dev,
 int mei_amthif_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
                          struct mei_cl_cb *cmpl_list)
 {
-        struct mei_device *dev = cl->dev;
-        struct mei_msg_hdr mei_hdr;
-        size_t len = dev->iamthif_msg_buf_size - dev->iamthif_msg_buf_index;
-        u32 msg_slots = mei_data2slots(len);
-        int slots;
-        int rets;
-
-        rets = mei_cl_flow_ctrl_creds(cl);
-        if (rets < 0)
-                return rets;
-
-        if (rets == 0) {
-                cl_dbg(dev, cl, "No flow control credentials: not sending.\n");
-                return 0;
-        }
-
-        mei_hdr.host_addr = cl->host_client_id;
-        mei_hdr.me_addr = cl->me_client_id;
-        mei_hdr.reserved = 0;
-        mei_hdr.internal = 0;
-
-        slots = mei_hbuf_empty_slots(dev);
-
-        if (slots >= msg_slots) {
-                mei_hdr.length = len;
-                mei_hdr.msg_complete = 1;
-        /* Split the message only if we can write the whole host buffer */
-        } else if (slots == dev->hbuf_depth) {
-                msg_slots = slots;
-                len = (slots * sizeof(u32)) - sizeof(struct mei_msg_hdr);
-                mei_hdr.length = len;
-                mei_hdr.msg_complete = 0;
-        } else {
-                /* wait for next time the host buffer is empty */
-                return 0;
-        }
-
-        dev_dbg(dev->dev, MEI_HDR_FMT,  MEI_HDR_PRM(&mei_hdr));
-
-        rets = mei_write_message(dev, &mei_hdr,
-                        dev->iamthif_msg_buf + dev->iamthif_msg_buf_index);
-        if (rets) {
-                dev->iamthif_state = MEI_IAMTHIF_IDLE;
-                cl->status = rets;
-                list_del(&cb->list);
-                return rets;
-        }
-
-        if (mei_cl_flow_ctrl_reduce(cl))
-                return -EIO;
-
-        dev->iamthif_msg_buf_index += mei_hdr.length;
-        cl->status = 0;
-
-        if (mei_hdr.msg_complete) {
-                dev->iamthif_state = MEI_IAMTHIF_FLOW_CONTROL;
-                dev->iamthif_flow_control_pending = true;
-
-                /* save iamthif cb sent to amthif client */
-                cb->buf_idx = dev->iamthif_msg_buf_index;
-                dev->iamthif_current_cb = cb;
+        int ret;
 
-                list_move_tail(&cb->list, &dev->write_waiting_list.list);
-        }
+        ret = mei_cl_irq_write(cl, cb, cmpl_list);
+        if (ret)
+                return ret;
 
+        if (cb->completed)
+                cb->status = mei_amthif_read_start(cl, cb->file_object);
 
         return 0;
 }
@@ -500,83 +420,35 @@ int mei_amthif_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
  * mei_amthif_irq_read_msg - read routine after ISR to
  *                      handle the read amthif message
  *
- * @dev: the device structure
+ * @cl: mei client
  * @mei_hdr: header of amthif message
- * @complete_list: An instance of our list structure
+ * @cmpl_list: completed callbacks list
  *
- * Return: 0 on success, <0 on failure.
+ * Return: -ENODEV if cb is NULL 0 otherwise; error message is in cb->status
  */
-int mei_amthif_irq_read_msg(struct mei_device *dev,
+int mei_amthif_irq_read_msg(struct mei_cl *cl,
                             struct mei_msg_hdr *mei_hdr,
-                            struct mei_cl_cb *complete_list)
+                            struct mei_cl_cb *cmpl_list)
 {
-        struct mei_cl_cb *cb;
-        unsigned char *buffer;
-
-        BUG_ON(mei_hdr->me_addr != dev->iamthif_cl.me_client_id);
-        BUG_ON(dev->iamthif_state != MEI_IAMTHIF_READING);
+        struct mei_device *dev;
+        int ret;
 
-        buffer = dev->iamthif_msg_buf + dev->iamthif_msg_buf_index;
-        BUG_ON(dev->iamthif_mtu < dev->iamthif_msg_buf_index + mei_hdr->length);
+        dev = cl->dev;
 
-        mei_read_slots(dev, buffer, mei_hdr->length);
+        if (dev->iamthif_state != MEI_IAMTHIF_READING)
+                return 0;
 
-        dev->iamthif_msg_buf_index += mei_hdr->length;
+        ret = mei_cl_irq_read_msg(cl, mei_hdr, cmpl_list);
+        if (ret)
+                return ret;
 
         if (!mei_hdr->msg_complete)
                 return 0;
 
-        dev_dbg(dev->dev, "amthif_message_buffer_index =%d\n",
-                        mei_hdr->length);
-
         dev_dbg(dev->dev, "completed amthif read.\n ");
-        if (!dev->iamthif_current_cb)
-                return -ENODEV;
-
-        cb = dev->iamthif_current_cb;
         dev->iamthif_current_cb = NULL;
-
         dev->iamthif_stall_timer = 0;
-        cb->buf_idx = dev->iamthif_msg_buf_index;
-        cb->read_time = jiffies;
-        if (dev->iamthif_ioctl) {
-                /* found the iamthif cb */
-                dev_dbg(dev->dev, "complete the amthif read cb.\n ");
-                dev_dbg(dev->dev, "add the amthif read cb to complete.\n ");
-                list_add_tail(&cb->list, &complete_list->list);
-        }
-        return 0;
-}
-
-/**
- * mei_amthif_irq_read - prepares to read amthif data.
- *
- * @dev: the device structure.
- * @slots: free slots.
- *
- * Return: 0, OK; otherwise, error.
- */
-int mei_amthif_irq_read(struct mei_device *dev, s32 *slots)
-{
-        u32 msg_slots = mei_data2slots(sizeof(struct hbm_flow_control));
-
-        if (*slots < msg_slots)
-                return -EMSGSIZE;
-
-        *slots -= msg_slots;
-
-        if (mei_hbm_cl_flow_control_req(dev, &dev->iamthif_cl)) {
-                dev_dbg(dev->dev, "iamthif flow control failed\n");
-                return -EIO;
-        }
 
-        dev_dbg(dev->dev, "iamthif flow control success\n");
-        dev->iamthif_state = MEI_IAMTHIF_READING;
-        dev->iamthif_flow_control_pending = false;
-        dev->iamthif_msg_buf_index = 0;
-        dev->iamthif_msg_buf_size = 0;
-        dev->iamthif_stall_timer = MEI_IAMTHIF_STALL_TIMER;
-        dev->hbuf_is_ready = mei_hbuf_is_ready(dev);
         return 0;
 }
 
@@ -588,17 +460,30 @@ int mei_amthif_irq_read(struct mei_device *dev, s32 *slots)
  */
 void mei_amthif_complete(struct mei_device *dev, struct mei_cl_cb *cb)
 {
+
+        if (cb->fop_type == MEI_FOP_WRITE) {
+                if (!cb->status) {
+                        dev->iamthif_stall_timer = MEI_IAMTHIF_STALL_TIMER;
+                        mei_io_cb_free(cb);
+                        return;
+                }
+                /*
+                 * in case of error enqueue the write cb to complete read list
+                 * so it can be propagated to the reader
+                 */
+                list_add_tail(&cb->list, &dev->amthif_rd_complete_list.list);
+                wake_up_interruptible(&dev->iamthif_cl.wait);
+                return;
+        }
+
         if (dev->iamthif_canceled != 1) {
                 dev->iamthif_state = MEI_IAMTHIF_READ_COMPLETE;
                 dev->iamthif_stall_timer = 0;
-                memcpy(cb->response_buffer.data,
-                                dev->iamthif_msg_buf,
-                                dev->iamthif_msg_buf_index);
                 list_add_tail(&cb->list, &dev->amthif_rd_complete_list.list);
                 dev_dbg(dev->dev, "amthif read completed\n");
                 dev->iamthif_timer = jiffies;
                 dev_dbg(dev->dev, "dev->iamthif_timer = %ld\n",
-                                dev->iamthif_timer);
+                        dev->iamthif_timer);
         } else {
                 mei_amthif_run_next_cmd(dev);
         }
@@ -623,26 +508,22 @@ void mei_amthif_complete(struct mei_device *dev, struct mei_cl_cb *cb)
 static bool mei_clear_list(struct mei_device *dev,
                 const struct file *file, struct list_head *mei_cb_list)
 {
-        struct mei_cl_cb *cb_pos = NULL;
-        struct mei_cl_cb *cb_next = NULL;
+        struct mei_cl *cl = &dev->iamthif_cl;
+        struct mei_cl_cb *cb, *next;
         bool removed = false;
 
         /* list all list member */
-        list_for_each_entry_safe(cb_pos, cb_next, mei_cb_list, list) {
+        list_for_each_entry_safe(cb, next, mei_cb_list, list) {
                 /* check if list member associated with a file */
-                if (file == cb_pos->file_object) {
-                        /* remove member from the list */
-                        list_del(&cb_pos->list);
+                if (file == cb->file_object) {
                         /* check if cb equal to current iamthif cb */
-                        if (dev->iamthif_current_cb == cb_pos) {
+                        if (dev->iamthif_current_cb == cb) {
                                 dev->iamthif_current_cb = NULL;
                                 /* send flow control to iamthif client */
-                                mei_hbm_cl_flow_control_req(dev,
-                                                        &dev->iamthif_cl);
+                                mei_hbm_cl_flow_control_req(dev, cl);
                         }
                         /* free all allocated buffers */
-                        mei_io_cb_free(cb_pos);
-                        cb_pos = NULL;
+                        mei_io_cb_free(cb);
                         removed = true;
                 }
         }
diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
index be767f4db26a..4cf38c39878a 100644
--- a/drivers/misc/mei/bus.c
+++ b/drivers/misc/mei/bus.c
@@ -238,7 +238,7 @@ static ssize_t ___mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
         dev = cl->dev;
 
         mutex_lock(&dev->device_lock);
-        if (cl->state != MEI_FILE_CONNECTED) {
+        if (!mei_cl_is_connected(cl)) {
                 rets = -ENODEV;
                 goto out;
         }
@@ -255,17 +255,13 @@ static ssize_t ___mei_cl_send(struct mei_cl *cl, u8 *buf, size_t length,
                 goto out;
         }
 
-        cb = mei_io_cb_init(cl, NULL);
+        cb = mei_cl_alloc_cb(cl, length, MEI_FOP_WRITE, NULL);
         if (!cb) {
                 rets = -ENOMEM;
                 goto out;
         }
 
-        rets = mei_io_cb_alloc_req_buf(cb, length);
-        if (rets < 0)
-                goto out;
-
-        memcpy(cb->request_buffer.data, buf, length);
+        memcpy(cb->buf.data, buf, length);
 
         rets = mei_cl_write(cl, cb, blocking);
 
@@ -292,20 +288,21 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
 
         mutex_lock(&dev->device_lock);
 
-        if (!cl->read_cb) {
-                rets = mei_cl_read_start(cl, length);
-                if (rets < 0)
-                        goto out;
-        }
+        cb = mei_cl_read_cb(cl, NULL);
+        if (cb)
+                goto copy;
 
-        if (cl->reading_state != MEI_READ_COMPLETE &&
-            !waitqueue_active(&cl->rx_wait)) {
+        rets = mei_cl_read_start(cl, length, NULL);
+        if (rets && rets != -EBUSY)
+                goto out;
+
+        if (list_empty(&cl->rd_completed) && !waitqueue_active(&cl->rx_wait)) {
 
                 mutex_unlock(&dev->device_lock);
 
                 if (wait_event_interruptible(cl->rx_wait,
-                                cl->reading_state == MEI_READ_COMPLETE  ||
-                                mei_cl_is_transitioning(cl))) {
+                                (!list_empty(&cl->rd_completed)) ||
+                                (!mei_cl_is_connected(cl)))) {
 
                         if (signal_pending(current))
                                 return -EINTR;
@@ -313,23 +310,31 @@ ssize_t __mei_cl_recv(struct mei_cl *cl, u8 *buf, size_t length)
                 }
 
                 mutex_lock(&dev->device_lock);
-        }
 
-        cb = cl->read_cb;
+                if (!mei_cl_is_connected(cl)) {
+                        rets = -EBUSY;
+                        goto out;
+                }
+        }
 
-        if (cl->reading_state != MEI_READ_COMPLETE) {
+        cb = mei_cl_read_cb(cl, NULL);
+        if (!cb) {
                 rets = 0;
                 goto out;
         }
 
+copy:
+        if (cb->status) {
+                rets = cb->status;
+                goto free;
+        }
+
         r_length = min_t(size_t, length, cb->buf_idx);
-        memcpy(buf, cb->response_buffer.data, r_length);
+        memcpy(buf, cb->buf.data, r_length);
         rets = r_length;
 
+free:
         mei_io_cb_free(cb);
-        cl->reading_state = MEI_IDLE;
-        cl->read_cb = NULL;
-
 out:
         mutex_unlock(&dev->device_lock);
 
@@ -386,7 +391,7 @@ static void mei_bus_event_work(struct work_struct *work)
         device->events = 0;
 
         /* Prepare for the next read */
-        mei_cl_read_start(device->cl, 0);
+        mei_cl_read_start(device->cl, 0, NULL);
 }
 
 int mei_cl_register_event_cb(struct mei_cl_device *device,
@@ -400,7 +405,7 @@ int mei_cl_register_event_cb(struct mei_cl_device *device,
         device->event_context = context;
         INIT_WORK(&device->event_work, mei_bus_event_work);
 
-        mei_cl_read_start(device->cl, 0);
+        mei_cl_read_start(device->cl, 0, NULL);
 
         return 0;
 }
@@ -441,8 +446,8 @@ int mei_cl_enable_device(struct mei_cl_device *device)
 
         mutex_unlock(&dev->device_lock);
 
-        if (device->event_cb && !cl->read_cb)
-                mei_cl_read_start(device->cl, 0);
+        if (device->event_cb)
+                mei_cl_read_start(device->cl, 0, NULL);
 
         if (!device->ops || !device->ops->enable)
                 return 0;
@@ -462,54 +467,34 @@ int mei_cl_disable_device(struct mei_cl_device *device)
 
         dev = cl->dev;
 
+        if (device->ops && device->ops->disable)
+                device->ops->disable(device);
+
+        device->event_cb = NULL;
+
         mutex_lock(&dev->device_lock);
 
-        if (cl->state != MEI_FILE_CONNECTED) {
-                mutex_unlock(&dev->device_lock);
+        if (!mei_cl_is_connected(cl)) {
                 dev_err(dev->dev, "Already disconnected");
-
-                return 0;
+                err = 0;
+                goto out;
         }
 
         cl->state = MEI_FILE_DISCONNECTING;
 
         err = mei_cl_disconnect(cl);
         if (err < 0) {
-                mutex_unlock(&dev->device_lock);
-                dev_err(dev->dev,
-                        "Could not disconnect from the ME client");
-
-                return err;
+                dev_err(dev->dev, "Could not disconnect from the ME client");
+                goto out;
         }
 
         /* Flush queues and remove any pending read */
-        mei_cl_flush_queues(cl);
-
-        if (cl->read_cb) {
-                struct mei_cl_cb *cb = NULL;
-
-                cb = mei_cl_find_read_cb(cl);
-                /* Remove entry from read list */
-                if (cb)
-                        list_del(&cb->list);
-
-                cb = cl->read_cb;
-                cl->read_cb = NULL;
-
-                if (cb) {
-                        mei_io_cb_free(cb);
-                        cb = NULL;
-                }
-        }
-
-        device->event_cb = NULL;
+        mei_cl_flush_queues(cl, NULL);
 
+out:
         mutex_unlock(&dev->device_lock);
+        return err;
 
-        if (!device->ops || !device->ops->disable)
-                return 0;
-
-        return device->ops->disable(device);
 }
 EXPORT_SYMBOL_GPL(mei_cl_disable_device);
 
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index dfbddfe1c7a0..1e99ef6a54a2 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -48,14 +48,14 @@ void mei_me_cl_init(struct mei_me_client *me_cl)
  */
 struct mei_me_client *mei_me_cl_get(struct mei_me_client *me_cl)
 {
-        if (me_cl)
-                kref_get(&me_cl->refcnt);
+        if (me_cl && kref_get_unless_zero(&me_cl->refcnt))
+                return me_cl;
 
-        return me_cl;
+        return NULL;
 }
 
 /**
- * mei_me_cl_release - unlink and free me client
+ * mei_me_cl_release - free me client
  *
  * Locking: called under "dev->device_lock" lock
  *
@@ -65,9 +65,10 @@ static void mei_me_cl_release(struct kref *ref)
 {
         struct mei_me_client *me_cl =
                 container_of(ref, struct mei_me_client, refcnt);
-        list_del(&me_cl->list);
+
         kfree(me_cl);
 }
+
 /**
  * mei_me_cl_put - decrease me client refcount and free client if necessary
  *
@@ -82,51 +83,146 @@ void mei_me_cl_put(struct mei_me_client *me_cl)
 }
 
 /**
- * mei_me_cl_by_uuid - locate me client by uuid
+ * __mei_me_cl_del  - delete me client form the list and decrease
+ *     reference counter
+ *
+ * @dev: mei device
+ * @me_cl: me client
+ *
+ * Locking: dev->me_clients_rwsem
+ */
+static void __mei_me_cl_del(struct mei_device *dev, struct mei_me_client *me_cl)
+{
+        if (!me_cl)
+                return;
+
+        list_del(&me_cl->list);
+        mei_me_cl_put(me_cl);
+}
+
+/**
+ * mei_me_cl_add - add me client to the list
+ *
+ * @dev: mei device
+ * @me_cl: me client
+ */
+void mei_me_cl_add(struct mei_device *dev, struct mei_me_client *me_cl)
+{
+        down_write(&dev->me_clients_rwsem);
+        list_add(&me_cl->list, &dev->me_clients);
+        up_write(&dev->me_clients_rwsem);
+}
+
+/**
+ * __mei_me_cl_by_uuid - locate me client by uuid
  *      increases ref count
  *
  * @dev: mei device
  * @uuid: me client uuid
  *
- * Locking: called under "dev->device_lock" lock
- *
  * Return: me client or NULL if not found
+ *
+ * Locking: dev->me_clients_rwsem
  */
-struct mei_me_client *mei_me_cl_by_uuid(const struct mei_device *dev,
+static struct mei_me_client *__mei_me_cl_by_uuid(struct mei_device *dev,
                                         const uuid_le *uuid)
 {
         struct mei_me_client *me_cl;
+        const uuid_le *pn;
 
-        list_for_each_entry(me_cl, &dev->me_clients, list)
-                if (uuid_le_cmp(*uuid, me_cl->props.protocol_name) == 0)
+        WARN_ON(!rwsem_is_locked(&dev->me_clients_rwsem));
+
+        list_for_each_entry(me_cl, &dev->me_clients, list) {
+                pn = &me_cl->props.protocol_name;
+                if (uuid_le_cmp(*uuid, *pn) == 0)
                         return mei_me_cl_get(me_cl);
+        }
 
         return NULL;
 }
 
 /**
+ * mei_me_cl_by_uuid - locate me client by uuid
+ *      increases ref count
+ *
+ * @dev: mei device
+ * @uuid: me client uuid
+ *
+ * Return: me client or NULL if not found
+ *
+ * Locking: dev->me_clients_rwsem
+ */
+struct mei_me_client *mei_me_cl_by_uuid(struct mei_device *dev,
+                                        const uuid_le *uuid)
+{
+        struct mei_me_client *me_cl;
+
+        down_read(&dev->me_clients_rwsem);
+        me_cl = __mei_me_cl_by_uuid(dev, uuid);
+        up_read(&dev->me_clients_rwsem);
+
+        return me_cl;
+}
+
+/**
  * mei_me_cl_by_id - locate me client by client id
  *      increases ref count
  *
  * @dev: the device structure
  * @client_id: me client id
  *
- * Locking: called under "dev->device_lock" lock
- *
  * Return: me client or NULL if not found
+ *
+ * Locking: dev->me_clients_rwsem
  */
 struct mei_me_client *mei_me_cl_by_id(struct mei_device *dev, u8 client_id)
 {
 
+        struct mei_me_client *__me_cl, *me_cl = NULL;
+
+        down_read(&dev->me_clients_rwsem);
+        list_for_each_entry(__me_cl, &dev->me_clients, list) {
+                if (__me_cl->client_id == client_id) {
+                        me_cl = mei_me_cl_get(__me_cl);
+                        break;
+                }
+        }
+        up_read(&dev->me_clients_rwsem);
+
+        return me_cl;
+}
+
+/**
+ * __mei_me_cl_by_uuid_id - locate me client by client id and uuid
+ *      increases ref count
+ *
+ * @dev: the device structure
+ * @uuid: me client uuid
+ * @client_id: me client id
+ *
+ * Return: me client or null if not found
+ *
+ * Locking: dev->me_clients_rwsem
+ */
+static struct mei_me_client *__mei_me_cl_by_uuid_id(struct mei_device *dev,
+                                           const uuid_le *uuid, u8 client_id)
+{
         struct mei_me_client *me_cl;
+        const uuid_le *pn;
+
+        WARN_ON(!rwsem_is_locked(&dev->me_clients_rwsem));
 
-        list_for_each_entry(me_cl, &dev->me_clients, list)
-                if (me_cl->client_id == client_id)
+        list_for_each_entry(me_cl, &dev->me_clients, list) {
+                pn = &me_cl->props.protocol_name;
+                if (uuid_le_cmp(*uuid, *pn) == 0 &&
+                    me_cl->client_id == client_id)
                         return mei_me_cl_get(me_cl);
+        }
 
         return NULL;
 }
 
+
 /**
  * mei_me_cl_by_uuid_id - locate me client by client id and uuid
  *      increases ref count
@@ -135,21 +231,18 @@ struct mei_me_client *mei_me_cl_by_id(struct mei_device *dev, u8 client_id)
  * @uuid: me client uuid
  * @client_id: me client id
  *
- * Locking: called under "dev->device_lock" lock
- *
- * Return: me client or NULL if not found
+ * Return: me client or null if not found
  */
 struct mei_me_client *mei_me_cl_by_uuid_id(struct mei_device *dev,
                                            const uuid_le *uuid, u8 client_id)
 {
         struct mei_me_client *me_cl;
 
-        list_for_each_entry(me_cl, &dev->me_clients, list)
-                if (uuid_le_cmp(*uuid, me_cl->props.protocol_name) == 0 &&
-                    me_cl->client_id == client_id)
-                        return mei_me_cl_get(me_cl);
+        down_read(&dev->me_clients_rwsem);
+        me_cl = __mei_me_cl_by_uuid_id(dev, uuid, client_id);
+        up_read(&dev->me_clients_rwsem);
 
-        return NULL;
+        return me_cl;
 }
 
 /**
@@ -162,12 +255,14 @@ struct mei_me_client *mei_me_cl_by_uuid_id(struct mei_device *dev,
  */
 void mei_me_cl_rm_by_uuid(struct mei_device *dev, const uuid_le *uuid)
 {
-        struct mei_me_client *me_cl, *next;
+        struct mei_me_client *me_cl;
 
         dev_dbg(dev->dev, "remove %pUl\n", uuid);
-        list_for_each_entry_safe(me_cl, next, &dev->me_clients, list)
-                if (uuid_le_cmp(*uuid, me_cl->props.protocol_name) == 0)
-                        mei_me_cl_put(me_cl);
+
+        down_write(&dev->me_clients_rwsem);
+        me_cl = __mei_me_cl_by_uuid(dev, uuid);
+        __mei_me_cl_del(dev, me_cl);
+        up_write(&dev->me_clients_rwsem);
 }
 
 /**
@@ -181,15 +276,14 @@ void mei_me_cl_rm_by_uuid(struct mei_device *dev, const uuid_le *uuid)
  */
 void mei_me_cl_rm_by_uuid_id(struct mei_device *dev, const uuid_le *uuid, u8 id)
 {
-        struct mei_me_client *me_cl, *next;
-        const uuid_le *pn;
+        struct mei_me_client *me_cl;
 
         dev_dbg(dev->dev, "remove %pUl %d\n", uuid, id);
-        list_for_each_entry_safe(me_cl, next, &dev->me_clients, list) {
-                pn =  &me_cl->props.protocol_name;
-                if (me_cl->client_id == id && uuid_le_cmp(*uuid, *pn) == 0)
-                        mei_me_cl_put(me_cl);
-        }
+
+        down_write(&dev->me_clients_rwsem);
+        me_cl = __mei_me_cl_by_uuid_id(dev, uuid, id);
+        __mei_me_cl_del(dev, me_cl);
+        up_write(&dev->me_clients_rwsem);
 }
 
 /**
@@ -203,12 +297,12 @@ void mei_me_cl_rm_all(struct mei_device *dev)
 {
         struct mei_me_client *me_cl, *next;
 
+        down_write(&dev->me_clients_rwsem);
         list_for_each_entry_safe(me_cl, next, &dev->me_clients, list)
-                        mei_me_cl_put(me_cl);
+                __mei_me_cl_del(dev, me_cl);
+        up_write(&dev->me_clients_rwsem);
 }
 
-
-
 /**
  * mei_cl_cmp_id - tells if the clients are the same
  *
@@ -227,7 +321,48 @@ static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
 }
 
 /**
- * mei_io_list_flush - removes cbs belonging to cl.
+ * mei_io_cb_free - free mei_cb_private related memory
+ *
+ * @cb: mei callback struct
+ */
+void mei_io_cb_free(struct mei_cl_cb *cb)
+{
+        if (cb == NULL)
+                return;
+
+        list_del(&cb->list);
+        kfree(cb->buf.data);
+        kfree(cb);
+}
+
+/**
+ * mei_io_cb_init - allocate and initialize io callback
+ *
+ * @cl: mei client
+ * @type: operation type
+ * @fp: pointer to file structure
+ *
+ * Return: mei_cl_cb pointer or NULL;
+ */
+struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, enum mei_cb_file_ops type,
+                                 struct file *fp)
+{
+        struct mei_cl_cb *cb;
+
+        cb = kzalloc(sizeof(struct mei_cl_cb), GFP_KERNEL);
+        if (!cb)
+                return NULL;
+
+        INIT_LIST_HEAD(&cb->list);
+        cb->file_object = fp;
+        cb->cl = cl;
+        cb->buf_idx = 0;
+        cb->fop_type = type;
+        return cb;
+}
+
+/**
+ * __mei_io_list_flush - removes and frees cbs belonging to cl.
  *
  * @list:  an instance of our list structure
  * @cl:    host client, can be NULL for flushing the whole list
@@ -236,13 +371,12 @@ static inline bool mei_cl_cmp_id(const struct mei_cl *cl1,
 static void __mei_io_list_flush(struct mei_cl_cb *list,
                                 struct mei_cl *cl, bool free)
 {
-        struct mei_cl_cb *cb;
-        struct mei_cl_cb *next;
+        struct mei_cl_cb *cb, *next;
 
         /* enable removing everything if no cl is specified */
         list_for_each_entry_safe(cb, next, &list->list, list) {
                 if (!cl || mei_cl_cmp_id(cl, cb->cl)) {
-                        list_del(&cb->list);
+                        list_del_init(&cb->list);
                         if (free)
                                 mei_io_cb_free(cb);
                 }
@@ -260,7 +394,6 @@ void mei_io_list_flush(struct mei_cl_cb *list, struct mei_cl *cl)
         __mei_io_list_flush(list, cl, false);
 }
 
-
 /**
  * mei_io_list_free - removes cb belonging to cl and free them
  *
@@ -273,103 +406,107 @@ static inline void mei_io_list_free(struct mei_cl_cb *list, struct mei_cl *cl)
 }
 
 /**
- * mei_io_cb_free - free mei_cb_private related memory
+ * mei_io_cb_alloc_buf - allocate callback buffer
  *
- * @cb: mei callback struct
+ * @cb: io callback structure
+ * @length: size of the buffer
+ *
+ * Return: 0 on success
+ *         -EINVAL if cb is NULL
+ *         -ENOMEM if allocation failed
  */
-void mei_io_cb_free(struct mei_cl_cb *cb)
+int mei_io_cb_alloc_buf(struct mei_cl_cb *cb, size_t length)
 {
-        if (cb == NULL)
-                return;
+        if (!cb)
+                return -EINVAL;
 
-        kfree(cb->request_buffer.data);
-        kfree(cb->response_buffer.data);
-        kfree(cb);
+        if (length == 0)
+                return 0;
+
+        cb->buf.data = kmalloc(length, GFP_KERNEL);
+        if (!cb->buf.data)
+                return -ENOMEM;
+        cb->buf.size = length;
+        return 0;
 }
 
 /**
- * mei_io_cb_init - allocate and initialize io callback
+ * mei_cl_alloc_cb - a convenient wrapper for allocating read cb
  *
- * @cl: mei client
- * @fp: pointer to file structure
+ * @cl: host client
+ * @length: size of the buffer
+ * @type: operation type
+ * @fp: associated file pointer (might be NULL)
  *
- * Return: mei_cl_cb pointer or NULL;
+ * Return: cb on success and NULL on failure
  */
-struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, struct file *fp)
+struct mei_cl_cb *mei_cl_alloc_cb(struct mei_cl *cl, size_t length,
+                                  enum mei_cb_file_ops type, struct file *fp)
 {
         struct mei_cl_cb *cb;
 
-        cb = kzalloc(sizeof(struct mei_cl_cb), GFP_KERNEL);
+        cb = mei_io_cb_init(cl, type, fp);
         if (!cb)
                 return NULL;
 
-        mei_io_list_init(cb);
+        if (mei_io_cb_alloc_buf(cb, length)) {
+                mei_io_cb_free(cb);
+                return NULL;
+        }
 
-        cb->file_object = fp;
-        cb->cl = cl;
-        cb->buf_idx = 0;
         return cb;
 }
 
 /**
- * mei_io_cb_alloc_req_buf - allocate request buffer
+ * mei_cl_read_cb - find this cl's callback in the read list
+ *     for a specific file
  *
- * @cb: io callback structure
- * @length: size of the buffer
+ * @cl: host client
+ * @fp: file pointer (matching cb file object), may be NULL
  *
- * Return: 0 on success
- *         -EINVAL if cb is NULL
- *         -ENOMEM if allocation failed
+ * Return: cb on success, NULL if cb is not found
  */
-int mei_io_cb_alloc_req_buf(struct mei_cl_cb *cb, size_t length)
+struct mei_cl_cb *mei_cl_read_cb(const struct mei_cl *cl, const struct file *fp)
 {
-        if (!cb)
-                return -EINVAL;
+        struct mei_cl_cb *cb;
 
-        if (length == 0)
-                return 0;
+        list_for_each_entry(cb, &cl->rd_completed, list)
+                if (!fp || fp == cb->file_object)
+                        return cb;
 
-        cb->request_buffer.data = kmalloc(length, GFP_KERNEL);
-        if (!cb->request_buffer.data)
-                return -ENOMEM;
-        cb->request_buffer.size = length;
-        return 0;
+        return NULL;
 }
+
 /**
- * mei_io_cb_alloc_resp_buf - allocate response buffer
- *
- * @cb: io callback structure
- * @length: size of the buffer
+ * mei_cl_read_cb_flush - free client's read pending and completed cbs
+ *   for a specific file
  *
- * Return: 0 on success
- *         -EINVAL if cb is NULL
- *         -ENOMEM if allocation failed
+ * @cl: host client
+ * @fp: file pointer (matching cb file object), may be NULL
  */
-int mei_io_cb_alloc_resp_buf(struct mei_cl_cb *cb, size_t length)
+void mei_cl_read_cb_flush(const struct mei_cl *cl, const struct file *fp)
 {
-        if (!cb)
-                return -EINVAL;
+        struct mei_cl_cb *cb, *next;
 
-        if (length == 0)
-                return 0;
-
-        cb->response_buffer.data = kmalloc(length, GFP_KERNEL);
-        if (!cb->response_buffer.data)
-                return -ENOMEM;
-        cb->response_buffer.size = length;
-        return 0;
-}
+        list_for_each_entry_safe(cb, next, &cl->rd_completed, list)
+                if (!fp || fp == cb->file_object)
+                        mei_io_cb_free(cb);
 
 
+        list_for_each_entry_safe(cb, next, &cl->rd_pending, list)
+                if (!fp || fp == cb->file_object)
+                        mei_io_cb_free(cb);
+}
 
 /**
  * mei_cl_flush_queues - flushes queue lists belonging to cl.
  *
  * @cl: host client
+ * @fp: file pointer (matching cb file object), may be NULL
  *
  * Return: 0 on success, -EINVAL if cl or cl->dev is NULL.
  */
-int mei_cl_flush_queues(struct mei_cl *cl)
+int mei_cl_flush_queues(struct mei_cl *cl, const struct file *fp)
 {
         struct mei_device *dev;
 
@@ -379,13 +516,15 @@ int mei_cl_flush_queues(struct mei_cl *cl)
         dev = cl->dev;
 
         cl_dbg(dev, cl, "remove list entry belonging to cl\n");
-        mei_io_list_flush(&cl->dev->read_list, cl);
         mei_io_list_free(&cl->dev->write_list, cl);
         mei_io_list_free(&cl->dev->write_waiting_list, cl);
         mei_io_list_flush(&cl->dev->ctrl_wr_list, cl);
         mei_io_list_flush(&cl->dev->ctrl_rd_list, cl);
         mei_io_list_flush(&cl->dev->amthif_cmd_list, cl);
         mei_io_list_flush(&cl->dev->amthif_rd_complete_list, cl);
+
+        mei_cl_read_cb_flush(cl, fp);
+
         return 0;
 }
 
@@ -402,9 +541,10 @@ void mei_cl_init(struct mei_cl *cl, struct mei_device *dev)
         init_waitqueue_head(&cl->wait);
         init_waitqueue_head(&cl->rx_wait);
         init_waitqueue_head(&cl->tx_wait);
+        INIT_LIST_HEAD(&cl->rd_completed);
+        INIT_LIST_HEAD(&cl->rd_pending);
         INIT_LIST_HEAD(&cl->link);
         INIT_LIST_HEAD(&cl->device_link);
-        cl->reading_state = MEI_IDLE;
         cl->writing_state = MEI_IDLE;
         cl->dev = dev;
 }
@@ -429,31 +569,14 @@ struct mei_cl *mei_cl_allocate(struct mei_device *dev)
 }
 
 /**
- * mei_cl_find_read_cb - find this cl's callback in the read list
+ * mei_cl_link - allocate host id in the host map
  *
  * @cl: host client
- *
- * Return: cb on success, NULL on error
- */
-struct mei_cl_cb *mei_cl_find_read_cb(struct mei_cl *cl)
-{
-        struct mei_device *dev = cl->dev;
-        struct mei_cl_cb *cb;
-
-        list_for_each_entry(cb, &dev->read_list.list, list)
-                if (mei_cl_cmp_id(cl, cb->cl))
-                        return cb;
-        return NULL;
-}
-
-/** mei_cl_link: allocate host id in the host map
- *
- * @cl - host client
- * @id - fixed host id or -1 for generic one
+ * @id: fixed host id or MEI_HOST_CLIENT_ID_ANY (-1) for generic one
  *
  * Return: 0 on success
  *      -EINVAL on incorrect values
- *      -ENONET if client not found
+ *      -EMFILE if open count exceeded.
  */
 int mei_cl_link(struct mei_cl *cl, int id)
 {
@@ -535,28 +658,31 @@ int mei_cl_unlink(struct mei_cl *cl)
 
 void mei_host_client_init(struct work_struct *work)
 {
-        struct mei_device *dev = container_of(work,
-                                              struct mei_device, init_work);
+        struct mei_device *dev =
+                container_of(work, struct mei_device, init_work);
         struct mei_me_client *me_cl;
-        struct mei_client_properties *props;
 
         mutex_lock(&dev->device_lock);
 
-        list_for_each_entry(me_cl, &dev->me_clients, list) {
-                props = &me_cl->props;
 
-                if (!uuid_le_cmp(props->protocol_name, mei_amthif_guid))
-                        mei_amthif_host_init(dev);
-                else if (!uuid_le_cmp(props->protocol_name, mei_wd_guid))
-                        mei_wd_host_init(dev);
-                else if (!uuid_le_cmp(props->protocol_name, mei_nfc_guid))
-                        mei_nfc_host_init(dev);
+        me_cl = mei_me_cl_by_uuid(dev, &mei_amthif_guid);
+        if (me_cl)
+                mei_amthif_host_init(dev);
+        mei_me_cl_put(me_cl);
+
+        me_cl = mei_me_cl_by_uuid(dev, &mei_wd_guid);
+        if (me_cl)
+                mei_wd_host_init(dev);
+        mei_me_cl_put(me_cl);
+
+        me_cl = mei_me_cl_by_uuid(dev, &mei_nfc_guid);
+        if (me_cl)
+                mei_nfc_host_init(dev);
+        mei_me_cl_put(me_cl);
 
-        }
 
         dev->dev_state = MEI_DEV_ENABLED;
         dev->reset_count = 0;
-
         mutex_unlock(&dev->device_lock);
 
         pm_runtime_mark_last_busy(dev->dev);
@@ -620,13 +746,10 @@ int mei_cl_disconnect(struct mei_cl *cl)
                 return rets;
         }
 
-        cb = mei_io_cb_init(cl, NULL);
-        if (!cb) {
-                rets = -ENOMEM;
+        cb = mei_io_cb_init(cl, MEI_FOP_DISCONNECT, NULL);
+        rets = cb ? 0 : -ENOMEM;
+        if (rets)
                 goto free;
-        }
-
-        cb->fop_type = MEI_FOP_DISCONNECT;
 
         if (mei_hbuf_acquire(dev)) {
                 if (mei_hbm_cl_disconnect_req(dev, cl)) {
@@ -727,13 +850,10 @@ int mei_cl_connect(struct mei_cl *cl, struct file *file)
                 return rets;
         }
 
-        cb = mei_io_cb_init(cl, file);
-        if (!cb) {
-                rets = -ENOMEM;
+        cb = mei_io_cb_init(cl, MEI_FOP_CONNECT, file);
+        rets = cb ? 0 : -ENOMEM;
+        if (rets)
                 goto out;
-        }
-
-        cb->fop_type = MEI_FOP_CONNECT;
 
         /* run hbuf acquire last so we don't have to undo */
         if (!mei_cl_is_other_connecting(cl) && mei_hbuf_acquire(dev)) {
@@ -756,7 +876,7 @@ int mei_cl_connect(struct mei_cl *cl, struct file *file)
                         mei_secs_to_jiffies(MEI_CL_CONNECT_TIMEOUT));
         mutex_lock(&dev->device_lock);
 
-        if (cl->state != MEI_FILE_CONNECTED) {
+        if (!mei_cl_is_connected(cl)) {
                 cl->state = MEI_FILE_DISCONNECTED;
                 /* something went really wrong */
                 if (!cl->status)
@@ -778,6 +898,37 @@ out:
 }
 
 /**
+ * mei_cl_alloc_linked - allocate and link host client
+ *
+ * @dev: the device structure
+ * @id: fixed host id or MEI_HOST_CLIENT_ID_ANY (-1) for generic one
+ *
+ * Return: cl on success ERR_PTR on failure
+ */
+struct mei_cl *mei_cl_alloc_linked(struct mei_device *dev, int id)
+{
+        struct mei_cl *cl;
+        int ret;
+
+        cl = mei_cl_allocate(dev);
+        if (!cl) {
+                ret = -ENOMEM;
+                goto err;
+        }
+
+        ret = mei_cl_link(cl, id);
+        if (ret)
+                goto err;
+
+        return cl;
+err:
+        kfree(cl);
+        return ERR_PTR(ret);
+}
+
+
+
+/**
  * mei_cl_flow_ctrl_creds - checks flow_control credits for cl.
  *
  * @cl: private data of the file object
@@ -866,10 +1017,11 @@ out:
  *
  * @cl: host client
  * @length: number of bytes to read
+ * @fp: pointer to file structure
  *
  * Return: 0 on success, <0 on failure.
  */
-int mei_cl_read_start(struct mei_cl *cl, size_t length)
+int mei_cl_read_start(struct mei_cl *cl, size_t length, struct file *fp)
 {
         struct mei_device *dev;
         struct mei_cl_cb *cb;
@@ -884,10 +1036,10 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
         if (!mei_cl_is_connected(cl))
                 return -ENODEV;
 
-        if (cl->read_cb) {
-                cl_dbg(dev, cl, "read is pending.\n");
+        /* HW currently supports only one pending read */
+        if (!list_empty(&cl->rd_pending))
                 return -EBUSY;
-        }
+
         me_cl = mei_me_cl_by_uuid_id(dev, &cl->cl_uuid, cl->me_client_id);
         if (!me_cl) {
                 cl_err(dev, cl, "no such me client %d\n", cl->me_client_id);
@@ -904,29 +1056,21 @@ int mei_cl_read_start(struct mei_cl *cl, size_t length)
                 return rets;
         }
 
-        cb = mei_io_cb_init(cl, NULL);
-        if (!cb) {
-                rets = -ENOMEM;
-                goto out;
-        }
-
-        rets = mei_io_cb_alloc_resp_buf(cb, length);
+        cb = mei_cl_alloc_cb(cl, length, MEI_FOP_READ, fp);
+        rets = cb ? 0 : -ENOMEM;
         if (rets)
                 goto out;
 
-        cb->fop_type = MEI_FOP_READ;
         if (mei_hbuf_acquire(dev)) {
                 rets = mei_hbm_cl_flow_control_req(dev, cl);
                 if (rets < 0)
                         goto out;
 
-                list_add_tail(&cb->list, &dev->read_list.list);
+                list_add_tail(&cb->list, &cl->rd_pending);
         } else {
                 list_add_tail(&cb->list, &dev->ctrl_wr_list.list);
         }
 
-        cl->read_cb = cb;
-
 out:
         cl_dbg(dev, cl, "rpm: autosuspend\n");
         pm_runtime_mark_last_busy(dev->dev);
@@ -964,7 +1108,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
 
         dev = cl->dev;
 
-        buf = &cb->request_buffer;
+        buf = &cb->buf;
 
         rets = mei_cl_flow_ctrl_creds(cl);
         if (rets < 0)
@@ -999,7 +1143,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         }
 
         cl_dbg(dev, cl, "buf: size = %d idx = %lu\n",
-                        cb->request_buffer.size, cb->buf_idx);
+                        cb->buf.size, cb->buf_idx);
 
         rets = mei_write_message(dev, &mei_hdr, buf->data + cb->buf_idx);
         if (rets) {
@@ -1011,6 +1155,7 @@ int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
         cl->status = 0;
         cl->writing_state = MEI_WRITING;
         cb->buf_idx += mei_hdr.length;
+        cb->completed = mei_hdr.msg_complete == 1;
 
         if (mei_hdr.msg_complete) {
                 if (mei_cl_flow_ctrl_reduce(cl))
@@ -1048,7 +1193,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
         dev = cl->dev;
 
 
-        buf = &cb->request_buffer;
+        buf = &cb->buf;
 
         cl_dbg(dev, cl, "size=%d\n", buf->size);
 
@@ -1059,7 +1204,6 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
                 return rets;
         }
 
-        cb->fop_type = MEI_FOP_WRITE;
         cb->buf_idx = 0;
         cl->writing_state = MEI_IDLE;
 
@@ -1099,6 +1243,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
 
         cl->writing_state = MEI_WRITING;
         cb->buf_idx = mei_hdr.length;
+        cb->completed = mei_hdr.msg_complete == 1;
 
 out:
         if (mei_hdr.msg_complete) {
@@ -1151,11 +1296,10 @@ void mei_cl_complete(struct mei_cl *cl, struct mei_cl_cb *cb)
                 if (waitqueue_active(&cl->tx_wait))
                         wake_up_interruptible(&cl->tx_wait);
 
-        } else if (cb->fop_type == MEI_FOP_READ &&
-                        MEI_READING == cl->reading_state) {
-                cl->reading_state = MEI_READ_COMPLETE;
+        } else if (cb->fop_type == MEI_FOP_READ) {
+                list_add_tail(&cb->list, &cl->rd_completed);
                 if (waitqueue_active(&cl->rx_wait))
-                        wake_up_interruptible(&cl->rx_wait);
+                        wake_up_interruptible_all(&cl->rx_wait);
                 else
                         mei_cl_bus_rx_event(cl);
 
diff --git a/drivers/misc/mei/client.h b/drivers/misc/mei/client.h
index cfcde8e97fc4..0a39e5d45171 100644
--- a/drivers/misc/mei/client.h
+++ b/drivers/misc/mei/client.h
@@ -31,7 +31,10 @@ void mei_me_cl_init(struct mei_me_client *me_cl);
 void mei_me_cl_put(struct mei_me_client *me_cl);
 struct mei_me_client *mei_me_cl_get(struct mei_me_client *me_cl);
 
-struct mei_me_client *mei_me_cl_by_uuid(const struct mei_device *dev,
+void mei_me_cl_add(struct mei_device *dev, struct mei_me_client *me_cl);
+void mei_me_cl_del(struct mei_device *dev, struct mei_me_client *me_cl);
+
+struct mei_me_client *mei_me_cl_by_uuid(struct mei_device *dev,
                                         const uuid_le *uuid);
 struct mei_me_client *mei_me_cl_by_id(struct mei_device *dev, u8 client_id);
 struct mei_me_client *mei_me_cl_by_uuid_id(struct mei_device *dev,
@@ -44,10 +47,10 @@ void mei_me_cl_rm_all(struct mei_device *dev);
 /*
  * MEI IO Functions
  */
-struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, struct file *fp);
+struct mei_cl_cb *mei_io_cb_init(struct mei_cl *cl, enum mei_cb_file_ops type,
+                                 struct file *fp);
 void mei_io_cb_free(struct mei_cl_cb *priv_cb);
-int mei_io_cb_alloc_req_buf(struct mei_cl_cb *cb, size_t length);
-int mei_io_cb_alloc_resp_buf(struct mei_cl_cb *cb, size_t length);
+int mei_io_cb_alloc_buf(struct mei_cl_cb *cb, size_t length);
 
 
 /**
@@ -72,9 +75,14 @@ void mei_cl_init(struct mei_cl *cl, struct mei_device *dev);
 int mei_cl_link(struct mei_cl *cl, int id);
 int mei_cl_unlink(struct mei_cl *cl);
 
-int mei_cl_flush_queues(struct mei_cl *cl);
-struct mei_cl_cb *mei_cl_find_read_cb(struct mei_cl *cl);
+struct mei_cl *mei_cl_alloc_linked(struct mei_device *dev, int id);
 
+struct mei_cl_cb *mei_cl_read_cb(const struct mei_cl *cl,
+                                 const struct file *fp);
+void mei_cl_read_cb_flush(const struct mei_cl *cl, const struct file *fp);
+struct mei_cl_cb *mei_cl_alloc_cb(struct mei_cl *cl, size_t length,
+                                  enum mei_cb_file_ops type, struct file *fp);
+int mei_cl_flush_queues(struct mei_cl *cl, const struct file *fp);
 
 int mei_cl_flow_ctrl_creds(struct mei_cl *cl);
 
@@ -82,23 +90,25 @@ int mei_cl_flow_ctrl_reduce(struct mei_cl *cl);
 /*
  *  MEI input output function prototype
  */
+
+/**
+ * mei_cl_is_connected - host client is connected
+ *
+ * @cl: host clinet
+ *
+ * Return: true if the host clinet is connected
+ */
 static inline bool mei_cl_is_connected(struct mei_cl *cl)
 {
-        return  cl->dev &&
-                cl->dev->dev_state == MEI_DEV_ENABLED &&
-                cl->state == MEI_FILE_CONNECTED;
-}
-static inline bool mei_cl_is_transitioning(struct mei_cl *cl)
-{
-        return  MEI_FILE_INITIALIZING == cl->state ||
-                MEI_FILE_DISCONNECTED == cl->state ||
-                MEI_FILE_DISCONNECTING == cl->state;
+        return  cl->state == MEI_FILE_CONNECTED;
 }
 
 bool mei_cl_is_other_connecting(struct mei_cl *cl);
 int mei_cl_disconnect(struct mei_cl *cl);
 int mei_cl_connect(struct mei_cl *cl, struct file *file);
-int mei_cl_read_start(struct mei_cl *cl, size_t length);
+int mei_cl_read_start(struct mei_cl *cl, size_t length, struct file *fp);
+int mei_cl_irq_read_msg(struct mei_cl *cl, struct mei_msg_hdr *hdr,
+                        struct mei_cl_cb *cmpl_list);
 int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking);
 int mei_cl_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
                      struct mei_cl_cb *cmpl_list);
diff --git a/drivers/misc/mei/debugfs.c b/drivers/misc/mei/debugfs.c
index b125380ee871..d9cd7e6ee484 100644
--- a/drivers/misc/mei/debugfs.c
+++ b/drivers/misc/mei/debugfs.c
@@ -28,7 +28,7 @@ static ssize_t mei_dbgfs_read_meclients(struct file *fp, char __user *ubuf,
                                         size_t cnt, loff_t *ppos)
 {
         struct mei_device *dev = fp->private_data;
-        struct mei_me_client *me_cl, *n;
+        struct mei_me_client *me_cl;
         size_t bufsz = 1;
         char *buf;
         int i = 0;
@@ -38,15 +38,14 @@ static ssize_t mei_dbgfs_read_meclients(struct file *fp, char __user *ubuf,
 #define HDR \
 "  |id|fix|         UUID                       |con|msg len|sb|refc|\n"
 
-        mutex_lock(&dev->device_lock);
-
+        down_read(&dev->me_clients_rwsem);
         list_for_each_entry(me_cl, &dev->me_clients, list)
                 bufsz++;
 
         bufsz *= sizeof(HDR) + 1;
         buf = kzalloc(bufsz, GFP_KERNEL);
         if (!buf) {
-                mutex_unlock(&dev->device_lock);
+                up_read(&dev->me_clients_rwsem);
                 return -ENOMEM;
         }
 
@@ -56,10 +55,9 @@ static ssize_t mei_dbgfs_read_meclients(struct file *fp, char __user *ubuf,
         if (dev->dev_state != MEI_DEV_ENABLED)
                 goto out;
 
-        list_for_each_entry_safe(me_cl, n, &dev->me_clients, list) {
+        list_for_each_entry(me_cl, &dev->me_clients, list) {
 
-                me_cl = mei_me_cl_get(me_cl);
-                if (me_cl) {
+                if (mei_me_cl_get(me_cl)) {
                         pos += scnprintf(buf + pos, bufsz - pos,
                                 "%2d|%2d|%3d|%pUl|%3d|%7d|%2d|%4d|\n",
                                 i++, me_cl->client_id,
@@ -69,12 +67,13 @@ static ssize_t mei_dbgfs_read_meclients(struct file *fp, char __user *ubuf,
                                 me_cl->props.max_msg_length,
                                 me_cl->props.single_recv_buf,
                                 atomic_read(&me_cl->refcnt.refcount));
-                }
 
-                mei_me_cl_put(me_cl);
+                        mei_me_cl_put(me_cl);
+                }
         }
+
 out:
-        mutex_unlock(&dev->device_lock);
+        up_read(&dev->me_clients_rwsem);
         ret = simple_read_from_buffer(ubuf, cnt, ppos, buf, pos);
         kfree(buf);
         return ret;
@@ -118,7 +117,7 @@ static ssize_t mei_dbgfs_read_active(struct file *fp, char __user *ubuf,
                 pos += scnprintf(buf + pos, bufsz - pos,
                         "%2d|%2d|%4d|%5d|%2d|%2d|\n",
                         i, cl->me_client_id, cl->host_client_id, cl->state,
-                        cl->reading_state, cl->writing_state);
+                        !list_empty(&cl->rd_completed), cl->writing_state);
                 i++;
         }
 out:
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index c8412d41e4f1..58da92565c5e 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -338,7 +338,8 @@ static int mei_hbm_me_cl_add(struct mei_device *dev,
         me_cl->client_id = res->me_addr;
         me_cl->mei_flow_ctrl_creds = 0;
 
-        list_add(&me_cl->list, &dev->me_clients);
+        mei_me_cl_add(dev, me_cl);
+
         return 0;
 }
 
@@ -638,7 +639,7 @@ static void mei_hbm_cl_res(struct mei_device *dev,
                         continue;
 
                 if (mei_hbm_cl_addr_equal(cl, rs)) {
-                        list_del(&cb->list);
+                        list_del_init(&cb->list);
                         break;
                 }
         }
@@ -683,10 +684,9 @@ static int mei_hbm_fw_disconnect_req(struct mei_device *dev,
                 cl->state = MEI_FILE_DISCONNECTED;
                 cl->timer_count = 0;
 
-                cb = mei_io_cb_init(cl, NULL);
+                cb = mei_io_cb_init(cl, MEI_FOP_DISCONNECT_RSP, NULL);
                 if (!cb)
                         return -ENOMEM;
-                cb->fop_type = MEI_FOP_DISCONNECT_RSP;
                 cl_dbg(dev, cl, "add disconnect response as first\n");
                 list_add(&cb->list, &dev->ctrl_wr_list.list);
         }
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index f8fd503dfbd6..6fb75e62a764 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -25,6 +25,8 @@
 #include "hw-me.h"
 #include "hw-me-regs.h"
 
+#include "mei-trace.h"
+
 /**
  * mei_me_reg_read - Reads 32bit data from the mei device
  *
@@ -61,45 +63,79 @@ static inline void mei_me_reg_write(const struct mei_me_hw *hw,
  *
  * Return: ME_CB_RW register value (u32)
  */
-static u32 mei_me_mecbrw_read(const struct mei_device *dev)
+static inline u32 mei_me_mecbrw_read(const struct mei_device *dev)
 {
         return mei_me_reg_read(to_me_hw(dev), ME_CB_RW);
 }
+
+/**
+ * mei_me_hcbww_write - write 32bit data to the host circular buffer
+ *
+ * @dev: the device structure
+ * @data: 32bit data to be written to the host circular buffer
+ */
+static inline void mei_me_hcbww_write(struct mei_device *dev, u32 data)
+{
+        mei_me_reg_write(to_me_hw(dev), H_CB_WW, data);
+}
+
 /**
  * mei_me_mecsr_read - Reads 32bit data from the ME CSR
  *
- * @hw: the me hardware structure
+ * @dev: the device structure
  *
  * Return: ME_CSR_HA register value (u32)
  */
-static inline u32 mei_me_mecsr_read(const struct mei_me_hw *hw)
+static inline u32 mei_me_mecsr_read(const struct mei_device *dev)
 {
-        return mei_me_reg_read(hw, ME_CSR_HA);
+        u32 reg;
+
+        reg = mei_me_reg_read(to_me_hw(dev), ME_CSR_HA);
+        trace_mei_reg_read(dev->dev, "ME_CSR_HA", ME_CSR_HA, reg);
+
+        return reg;
 }
 
 /**
  * mei_hcsr_read - Reads 32bit data from the host CSR
  *
- * @hw: the me hardware structure
+ * @dev: the device structure
  *
  * Return: H_CSR register value (u32)
  */
-static inline u32 mei_hcsr_read(const struct mei_me_hw *hw)
+static inline u32 mei_hcsr_read(const struct mei_device *dev)
+{
+        u32 reg;
+
+        reg = mei_me_reg_read(to_me_hw(dev), H_CSR);
+        trace_mei_reg_read(dev->dev, "H_CSR", H_CSR, reg);
+
+        return reg;
+}
+
+/**
+ * mei_hcsr_write - writes H_CSR register to the mei device
+ *
+ * @dev: the device structure
+ * @reg: new register value
+ */
+static inline void mei_hcsr_write(struct mei_device *dev, u32 reg)
 {
-        return mei_me_reg_read(hw, H_CSR);
+        trace_mei_reg_write(dev->dev, "H_CSR", H_CSR, reg);
+        mei_me_reg_write(to_me_hw(dev), H_CSR, reg);
 }
 
 /**
  * mei_hcsr_set - writes H_CSR register to the mei device,
  * and ignores the H_IS bit for it is write-one-to-zero.
  *
- * @hw: the me hardware structure
- * @hcsr: new register value
+ * @dev: the device structure
+ * @reg: new register value
  */
-static inline void mei_hcsr_set(struct mei_me_hw *hw, u32 hcsr)
+static inline void mei_hcsr_set(struct mei_device *dev, u32 reg)
 {
-        hcsr &= ~H_IS;
-        mei_me_reg_write(hw, H_CSR, hcsr);
+        reg &= ~H_IS;
+        mei_hcsr_write(dev, reg);
 }
 
 /**
@@ -141,7 +177,7 @@ static int mei_me_fw_status(struct mei_device *dev,
 static void mei_me_hw_config(struct mei_device *dev)
 {
         struct mei_me_hw *hw = to_me_hw(dev);
-        u32 hcsr = mei_hcsr_read(to_me_hw(dev));
+        u32 hcsr = mei_hcsr_read(dev);
         /* Doesn't change in runtime */
         dev->hbuf_depth = (hcsr & H_CBD) >> 24;
 
@@ -170,11 +206,10 @@ static inline enum mei_pg_state mei_me_pg_state(struct mei_device *dev)
  */
 static void mei_me_intr_clear(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 hcsr = mei_hcsr_read(hw);
+        u32 hcsr = mei_hcsr_read(dev);
 
         if ((hcsr & H_IS) == H_IS)
-                mei_me_reg_write(hw, H_CSR, hcsr);
+                mei_hcsr_write(dev, hcsr);
 }
 /**
  * mei_me_intr_enable - enables mei device interrupts
@@ -183,11 +218,10 @@ static void mei_me_intr_clear(struct mei_device *dev)
  */
 static void mei_me_intr_enable(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 hcsr = mei_hcsr_read(hw);
+        u32 hcsr = mei_hcsr_read(dev);
 
         hcsr |= H_IE;
-        mei_hcsr_set(hw, hcsr);
+        mei_hcsr_set(dev, hcsr);
 }
 
 /**
@@ -197,11 +231,10 @@ static void mei_me_intr_enable(struct mei_device *dev)
  */
 static void mei_me_intr_disable(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 hcsr = mei_hcsr_read(hw);
+        u32 hcsr = mei_hcsr_read(dev);
 
         hcsr  &= ~H_IE;
-        mei_hcsr_set(hw, hcsr);
+        mei_hcsr_set(dev, hcsr);
 }
 
 /**
@@ -211,12 +244,11 @@ static void mei_me_intr_disable(struct mei_device *dev)
  */
 static void mei_me_hw_reset_release(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 hcsr = mei_hcsr_read(hw);
+        u32 hcsr = mei_hcsr_read(dev);
 
         hcsr |= H_IG;
         hcsr &= ~H_RST;
-        mei_hcsr_set(hw, hcsr);
+        mei_hcsr_set(dev, hcsr);
 
         /* complete this write before we set host ready on another CPU */
         mmiowb();
@@ -231,8 +263,7 @@ static void mei_me_hw_reset_release(struct mei_device *dev)
  */
 static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 hcsr = mei_hcsr_read(hw);
+        u32 hcsr = mei_hcsr_read(dev);
 
         /* H_RST may be found lit before reset is started,
          * for example if preceding reset flow hasn't completed.
@@ -242,8 +273,8 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
         if ((hcsr & H_RST) == H_RST) {
                 dev_warn(dev->dev, "H_RST is set = 0x%08X", hcsr);
                 hcsr &= ~H_RST;
-                mei_hcsr_set(hw, hcsr);
-                hcsr = mei_hcsr_read(hw);
+                mei_hcsr_set(dev, hcsr);
+                hcsr = mei_hcsr_read(dev);
         }
 
         hcsr |= H_RST | H_IG | H_IS;
@@ -254,13 +285,13 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
                 hcsr &= ~H_IE;
 
         dev->recvd_hw_ready = false;
-        mei_me_reg_write(hw, H_CSR, hcsr);
+        mei_hcsr_write(dev, hcsr);
 
         /*
          * Host reads the H_CSR once to ensure that the
          * posted write to H_CSR completes.
          */
-        hcsr = mei_hcsr_read(hw);
+        hcsr = mei_hcsr_read(dev);
 
         if ((hcsr & H_RST) == 0)
                 dev_warn(dev->dev, "H_RST is not set = 0x%08X", hcsr);
@@ -281,11 +312,10 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
  */
 static void mei_me_host_set_ready(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 hcsr = mei_hcsr_read(hw);
+        u32 hcsr = mei_hcsr_read(dev);
 
         hcsr |= H_IE | H_IG | H_RDY;
-        mei_hcsr_set(hw, hcsr);
+        mei_hcsr_set(dev, hcsr);
 }
 
 /**
@@ -296,8 +326,7 @@ static void mei_me_host_set_ready(struct mei_device *dev)
  */
 static bool mei_me_host_is_ready(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 hcsr = mei_hcsr_read(hw);
+        u32 hcsr = mei_hcsr_read(dev);
 
         return (hcsr & H_RDY) == H_RDY;
 }
@@ -310,8 +339,7 @@ static bool mei_me_host_is_ready(struct mei_device *dev)
  */
 static bool mei_me_hw_is_ready(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 mecsr = mei_me_mecsr_read(hw);
+        u32 mecsr = mei_me_mecsr_read(dev);
 
         return (mecsr & ME_RDY_HRA) == ME_RDY_HRA;
 }
@@ -368,11 +396,10 @@ static int mei_me_hw_start(struct mei_device *dev)
  */
 static unsigned char mei_hbuf_filled_slots(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
         u32 hcsr;
         char read_ptr, write_ptr;
 
-        hcsr = mei_hcsr_read(hw);
+        hcsr = mei_hcsr_read(dev);
 
         read_ptr = (char) ((hcsr & H_CBRP) >> 8);
         write_ptr = (char) ((hcsr & H_CBWP) >> 16);
@@ -439,7 +466,6 @@ static int mei_me_write_message(struct mei_device *dev,
                         struct mei_msg_hdr *header,
                         unsigned char *buf)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
         unsigned long rem;
         unsigned long length = header->length;
         u32 *reg_buf = (u32 *)buf;
@@ -457,21 +483,21 @@ static int mei_me_write_message(struct mei_device *dev,
         if (empty_slots < 0 || dw_cnt > empty_slots)
                 return -EMSGSIZE;
 
-        mei_me_reg_write(hw, H_CB_WW, *((u32 *) header));
+        mei_me_hcbww_write(dev, *((u32 *) header));
 
         for (i = 0; i < length / 4; i++)
-                mei_me_reg_write(hw, H_CB_WW, reg_buf[i]);
+                mei_me_hcbww_write(dev, reg_buf[i]);
 
         rem = length & 0x3;
         if (rem > 0) {
                 u32 reg = 0;
 
                 memcpy(&reg, &buf[length - rem], rem);
-                mei_me_reg_write(hw, H_CB_WW, reg);
+                mei_me_hcbww_write(dev, reg);
         }
 
-        hcsr = mei_hcsr_read(hw) | H_IG;
-        mei_hcsr_set(hw, hcsr);
+        hcsr = mei_hcsr_read(dev) | H_IG;
+        mei_hcsr_set(dev, hcsr);
         if (!mei_me_hw_is_ready(dev))
                 return -EIO;
 
@@ -487,12 +513,11 @@ static int mei_me_write_message(struct mei_device *dev,
  */
 static int mei_me_count_full_read_slots(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
         u32 me_csr;
         char read_ptr, write_ptr;
         unsigned char buffer_depth, filled_slots;
 
-        me_csr = mei_me_mecsr_read(hw);
+        me_csr = mei_me_mecsr_read(dev);
         buffer_depth = (unsigned char)((me_csr & ME_CBD_HRA) >> 24);
         read_ptr = (char) ((me_csr & ME_CBRP_HRA) >> 8);
         write_ptr = (char) ((me_csr & ME_CBWP_HRA) >> 16);
@@ -518,7 +543,6 @@ static int mei_me_count_full_read_slots(struct mei_device *dev)
 static int mei_me_read_slots(struct mei_device *dev, unsigned char *buffer,
                     unsigned long buffer_length)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
         u32 *reg_buf = (u32 *)buffer;
         u32 hcsr;
 
@@ -531,49 +555,59 @@ static int mei_me_read_slots(struct mei_device *dev, unsigned char *buffer,
                 memcpy(reg_buf, &reg, buffer_length);
         }
 
-        hcsr = mei_hcsr_read(hw) | H_IG;
-        mei_hcsr_set(hw, hcsr);
+        hcsr = mei_hcsr_read(dev) | H_IG;
+        mei_hcsr_set(dev, hcsr);
         return 0;
 }
 
 /**
- * mei_me_pg_enter - write pg enter register
+ * mei_me_pg_set - write pg enter register
  *
  * @dev: the device structure
  */
-static void mei_me_pg_enter(struct mei_device *dev)
+static void mei_me_pg_set(struct mei_device *dev)
 {
         struct mei_me_hw *hw = to_me_hw(dev);
-        u32 reg = mei_me_reg_read(hw, H_HPG_CSR);
+        u32 reg;
+
+        reg = mei_me_reg_read(hw, H_HPG_CSR);
+        trace_mei_reg_read(dev->dev, "H_HPG_CSR", H_HPG_CSR, reg);
 
         reg |= H_HPG_CSR_PGI;
+
+        trace_mei_reg_write(dev->dev, "H_HPG_CSR", H_HPG_CSR, reg);
         mei_me_reg_write(hw, H_HPG_CSR, reg);
 }
 
 /**
- * mei_me_pg_exit - write pg exit register
+ * mei_me_pg_unset - write pg exit register
  *
  * @dev: the device structure
  */
-static void mei_me_pg_exit(struct mei_device *dev)
+static void mei_me_pg_unset(struct mei_device *dev)
 {
         struct mei_me_hw *hw = to_me_hw(dev);
-        u32 reg = mei_me_reg_read(hw, H_HPG_CSR);
+        u32 reg;
+
+        reg = mei_me_reg_read(hw, H_HPG_CSR);
+        trace_mei_reg_read(dev->dev, "H_HPG_CSR", H_HPG_CSR, reg);
 
         WARN(!(reg & H_HPG_CSR_PGI), "PGI is not set\n");
 
         reg |= H_HPG_CSR_PGIHEXR;
+
+        trace_mei_reg_write(dev->dev, "H_HPG_CSR", H_HPG_CSR, reg);
         mei_me_reg_write(hw, H_HPG_CSR, reg);
 }
 
 /**
- * mei_me_pg_set_sync - perform pg entry procedure
+ * mei_me_pg_enter_sync - perform pg entry procedure
  *
  * @dev: the device structure
  *
  * Return: 0 on success an error code otherwise
  */
-int mei_me_pg_set_sync(struct mei_device *dev)
+int mei_me_pg_enter_sync(struct mei_device *dev)
 {
         struct mei_me_hw *hw = to_me_hw(dev);
         unsigned long timeout = mei_secs_to_jiffies(MEI_PGI_TIMEOUT);
@@ -591,7 +625,7 @@ int mei_me_pg_set_sync(struct mei_device *dev)
         mutex_lock(&dev->device_lock);
 
         if (dev->pg_event == MEI_PG_EVENT_RECEIVED) {
-                mei_me_pg_enter(dev);
+                mei_me_pg_set(dev);
                 ret = 0;
         } else {
                 ret = -ETIME;
@@ -604,13 +638,13 @@ int mei_me_pg_set_sync(struct mei_device *dev)
 }
 
 /**
- * mei_me_pg_unset_sync - perform pg exit procedure
+ * mei_me_pg_exit_sync - perform pg exit procedure
  *
  * @dev: the device structure
  *
  * Return: 0 on success an error code otherwise
  */
-int mei_me_pg_unset_sync(struct mei_device *dev)
+int mei_me_pg_exit_sync(struct mei_device *dev)
 {
         struct mei_me_hw *hw = to_me_hw(dev);
         unsigned long timeout = mei_secs_to_jiffies(MEI_PGI_TIMEOUT);
@@ -621,7 +655,7 @@ int mei_me_pg_unset_sync(struct mei_device *dev)
 
         dev->pg_event = MEI_PG_EVENT_WAIT;
 
-        mei_me_pg_exit(dev);
+        mei_me_pg_unset(dev);
 
         mutex_unlock(&dev->device_lock);
         wait_event_timeout(dev->wait_pg,
@@ -649,8 +683,7 @@ reply:
  */
 static bool mei_me_pg_is_enabled(struct mei_device *dev)
 {
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 reg = mei_me_reg_read(hw, ME_CSR_HA);
+        u32 reg = mei_me_mecsr_read(dev);
 
         if ((reg & ME_PGIC_HRA) == 0)
                 goto notsupported;
@@ -683,14 +716,13 @@ notsupported:
 irqreturn_t mei_me_irq_quick_handler(int irq, void *dev_id)
 {
         struct mei_device *dev = (struct mei_device *) dev_id;
-        struct mei_me_hw *hw = to_me_hw(dev);
-        u32 csr_reg = mei_hcsr_read(hw);
+        u32 hcsr = mei_hcsr_read(dev);
 
-        if ((csr_reg & H_IS) != H_IS)
+        if ((hcsr & H_IS) != H_IS)
                 return IRQ_NONE;
 
         /* clear H_IS bit in H_CSR */
-        mei_me_reg_write(hw, H_CSR, csr_reg);
+        mei_hcsr_write(dev, hcsr);
 
         return IRQ_WAKE_THREAD;
 }
diff --git a/drivers/misc/mei/hw-me.h b/drivers/misc/mei/hw-me.h
index d6567af44377..6022d52af6f6 100644
--- a/drivers/misc/mei/hw-me.h
+++ b/drivers/misc/mei/hw-me.h
@@ -71,8 +71,8 @@ extern const struct mei_cfg mei_me_pch8_sps_cfg;
 struct mei_device *mei_me_dev_init(struct pci_dev *pdev,
                                    const struct mei_cfg *cfg);
 
-int mei_me_pg_set_sync(struct mei_device *dev);
-int mei_me_pg_unset_sync(struct mei_device *dev);
+int mei_me_pg_enter_sync(struct mei_device *dev);
+int mei_me_pg_exit_sync(struct mei_device *dev);
 
 irqreturn_t mei_me_irq_quick_handler(int irq, void *dev_id);
 irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id);
diff --git a/drivers/misc/mei/hw-txe.c b/drivers/misc/mei/hw-txe.c
index 618ea721aca8..7abafe7d120d 100644
--- a/drivers/misc/mei/hw-txe.c
+++ b/drivers/misc/mei/hw-txe.c
@@ -412,7 +412,7 @@ static void mei_txe_intr_disable(struct mei_device *dev)
         mei_txe_br_reg_write(hw, HIER_REG, 0);
 }
 /**
- * mei_txe_intr_disable - enable all interrupts
+ * mei_txe_intr_enable - enable all interrupts
  *
  * @dev: the device structure
  */
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index 6ad049a08e4d..97353cf8d9b6 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -389,6 +389,7 @@ void mei_device_init(struct mei_device *dev,
         INIT_LIST_HEAD(&dev->device_list);
         INIT_LIST_HEAD(&dev->me_clients);
         mutex_init(&dev->device_lock);
+        init_rwsem(&dev->me_clients_rwsem);
         init_waitqueue_head(&dev->wait_hw_ready);
         init_waitqueue_head(&dev->wait_pg);
         init_waitqueue_head(&dev->wait_hbm_start);
@@ -396,7 +397,6 @@ void mei_device_init(struct mei_device *dev,
         dev->dev_state = MEI_DEV_INITIALIZING;
         dev->reset_count = 0;
 
-        mei_io_list_init(&dev->read_list);
         mei_io_list_init(&dev->write_list);
         mei_io_list_init(&dev->write_waiting_list);
         mei_io_list_init(&dev->ctrl_wr_list);
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 711cddfa9c99..3f84d2edcde4 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -43,7 +43,7 @@ void mei_irq_compl_handler(struct mei_device *dev, struct mei_cl_cb *compl_list)
 
         list_for_each_entry_safe(cb, next, &compl_list->list, list) {
                 cl = cb->cl;
-                list_del(&cb->list);
+                list_del_init(&cb->list);
 
                 dev_dbg(dev->dev, "completing call back.\n");
                 if (cl == &dev->iamthif_cl)
@@ -68,91 +68,91 @@ static inline int mei_cl_hbm_equal(struct mei_cl *cl,
         return cl->host_client_id == mei_hdr->host_addr &&
                 cl->me_client_id == mei_hdr->me_addr;
 }
+
 /**
- * mei_cl_is_reading - checks if the client
- *              is the one to read this message
- *
- * @cl: mei client
- * @mei_hdr: header of mei message
+ * mei_irq_discard_msg  - discard received message
  *
- * Return: true on match and false otherwise
+ * @dev: mei device
+ * @hdr: message header
  */
-static bool mei_cl_is_reading(struct mei_cl *cl, struct mei_msg_hdr *mei_hdr)
+static inline
+void mei_irq_discard_msg(struct mei_device *dev, struct mei_msg_hdr *hdr)
 {
-        return mei_cl_hbm_equal(cl, mei_hdr) &&
-                cl->state == MEI_FILE_CONNECTED &&
-                cl->reading_state != MEI_READ_COMPLETE;
+        /*
+         * no need to check for size as it is guarantied
+         * that length fits into rd_msg_buf
+         */
+        mei_read_slots(dev, dev->rd_msg_buf, hdr->length);
+        dev_dbg(dev->dev, "discarding message " MEI_HDR_FMT "\n",
+                MEI_HDR_PRM(hdr));
 }
 
 /**
  * mei_cl_irq_read_msg - process client message
  *
- * @dev: the device structure
+ * @cl: reading client
  * @mei_hdr: header of mei client message
- * @complete_list: An instance of our list structure
+ * @complete_list: completion list
  *
- * Return: 0 on success, <0 on failure.
+ * Return: always 0
  */
-static int mei_cl_irq_read_msg(struct mei_device *dev,
-                               struct mei_msg_hdr *mei_hdr,
-                               struct mei_cl_cb *complete_list)
+int mei_cl_irq_read_msg(struct mei_cl *cl,
+                       struct mei_msg_hdr *mei_hdr,
+                       struct mei_cl_cb *complete_list)
 {
-        struct mei_cl *cl;
-        struct mei_cl_cb *cb, *next;
+        struct mei_device *dev = cl->dev;
+        struct mei_cl_cb *cb;
         unsigned char *buffer = NULL;
 
-        list_for_each_entry_safe(cb, next, &dev->read_list.list, list) {
-                cl = cb->cl;
-                if (!mei_cl_is_reading(cl, mei_hdr))
-                        continue;
-
-                cl->reading_state = MEI_READING;
+        cb = list_first_entry_or_null(&cl->rd_pending, struct mei_cl_cb, list);
+        if (!cb) {
+                cl_err(dev, cl, "pending read cb not found\n");
+                goto out;
+        }
 
-                if (cb->response_buffer.size == 0 ||
-                    cb->response_buffer.data == NULL) {
-                        cl_err(dev, cl, "response buffer is not allocated.\n");
-                        list_del(&cb->list);
-                        return -ENOMEM;
-                }
+        if (!mei_cl_is_connected(cl)) {
+                cl_dbg(dev, cl, "not connected\n");
+                cb->status = -ENODEV;
+                goto out;
+        }
 
-                if (cb->response_buffer.size < mei_hdr->length + cb->buf_idx) {
-                        cl_dbg(dev, cl, "message overflow. size %d len %d idx %ld\n",
-                                cb->response_buffer.size,
-                                mei_hdr->length, cb->buf_idx);
-                        buffer = krealloc(cb->response_buffer.data,
-                                          mei_hdr->length + cb->buf_idx,
-                                          GFP_KERNEL);
-
-                        if (!buffer) {
-                                list_del(&cb->list);
-                                return -ENOMEM;
-                        }
-                        cb->response_buffer.data = buffer;
-                        cb->response_buffer.size =
-                                mei_hdr->length + cb->buf_idx;
-                }
+        if (cb->buf.size == 0 || cb->buf.data == NULL) {
+                cl_err(dev, cl, "response buffer is not allocated.\n");
+                list_move_tail(&cb->list, &complete_list->list);
+                cb->status = -ENOMEM;
+                goto out;
+        }
 
-                buffer = cb->response_buffer.data + cb->buf_idx;
-                mei_read_slots(dev, buffer, mei_hdr->length);
+        if (cb->buf.size < mei_hdr->length + cb->buf_idx) {
+                cl_dbg(dev, cl, "message overflow. size %d len %d idx %ld\n",
+                        cb->buf.size, mei_hdr->length, cb->buf_idx);
+                buffer = krealloc(cb->buf.data, mei_hdr->length + cb->buf_idx,
+                                  GFP_KERNEL);
 
-                cb->buf_idx += mei_hdr->length;
-                if (mei_hdr->msg_complete) {
-                        cl->status = 0;
-                        list_del(&cb->list);
-                        cl_dbg(dev, cl, "completed read length = %lu\n",
-                                cb->buf_idx);
-                        list_add_tail(&cb->list, &complete_list->list);
+                if (!buffer) {
+                        cb->status = -ENOMEM;
+                        list_move_tail(&cb->list, &complete_list->list);
+                        goto out;
                 }
-                break;
+                cb->buf.data = buffer;
+                cb->buf.size = mei_hdr->length + cb->buf_idx;
         }
 
-        dev_dbg(dev->dev, "message read\n");
-        if (!buffer) {
-                mei_read_slots(dev, dev->rd_msg_buf, mei_hdr->length);
-                dev_dbg(dev->dev, "discarding message " MEI_HDR_FMT "\n",
-                                MEI_HDR_PRM(mei_hdr));
+        buffer = cb->buf.data + cb->buf_idx;
+        mei_read_slots(dev, buffer, mei_hdr->length);
+
+        cb->buf_idx += mei_hdr->length;
+
+        if (mei_hdr->msg_complete) {
+                cb->read_time = jiffies;
+                cl_dbg(dev, cl, "completed read length = %lu\n", cb->buf_idx);
+                list_move_tail(&cb->list, &complete_list->list);
         }
 
+out:
+        if (!buffer)
+                mei_irq_discard_msg(dev, mei_hdr);
+
         return 0;
 }
 
@@ -183,7 +183,6 @@ static int mei_cl_irq_disconnect_rsp(struct mei_cl *cl, struct mei_cl_cb *cb,
 
         cl->state = MEI_FILE_DISCONNECTED;
         cl->status = 0;
-        list_del(&cb->list);
         mei_io_cb_free(cb);
 
         return ret;
@@ -263,7 +262,7 @@ static int mei_cl_irq_read(struct mei_cl *cl, struct mei_cl_cb *cb,
                 return ret;
         }
 
-        list_move_tail(&cb->list, &dev->read_list.list);
+        list_move_tail(&cb->list, &cl->rd_pending);
 
         return 0;
 }
@@ -301,7 +300,7 @@ static int mei_cl_irq_connect(struct mei_cl *cl, struct mei_cl_cb *cb,
         if (ret) {
                 cl->status = ret;
                 cb->buf_idx = 0;
-                list_del(&cb->list);
+                list_del_init(&cb->list);
                 return ret;
         }
 
@@ -378,25 +377,13 @@ int mei_irq_read_handler(struct mei_device *dev,
                 goto end;
         }
 
-        if (mei_hdr->host_addr == dev->iamthif_cl.host_client_id &&
-            MEI_FILE_CONNECTED == dev->iamthif_cl.state &&
-            dev->iamthif_state == MEI_IAMTHIF_READING) {
-
-                ret = mei_amthif_irq_read_msg(dev, mei_hdr, cmpl_list);
-                if (ret) {
-                        dev_err(dev->dev, "mei_amthif_irq_read_msg failed = %d\n",
-                                        ret);
-                        goto end;
-                }
+        if (cl == &dev->iamthif_cl) {
+                ret = mei_amthif_irq_read_msg(cl, mei_hdr, cmpl_list);
         } else {
-                ret = mei_cl_irq_read_msg(dev, mei_hdr, cmpl_list);
-                if (ret) {
-                        dev_err(dev->dev, "mei_cl_irq_read_msg failed = %d\n",
-                                        ret);
-                        goto end;
-                }
+                ret = mei_cl_irq_read_msg(cl, mei_hdr, cmpl_list);
         }
 
+
 reset_slots:
         /* reset the number of slots and header */
         *slots = mei_count_full_read_slots(dev);
@@ -449,21 +436,9 @@ int mei_irq_write_handler(struct mei_device *dev, struct mei_cl_cb *cmpl_list)
                 cl = cb->cl;
 
                 cl->status = 0;
-                list_del(&cb->list);
-                if (cb->fop_type == MEI_FOP_WRITE &&
-                    cl != &dev->iamthif_cl) {
-                        cl_dbg(dev, cl, "MEI WRITE COMPLETE\n");
-                        cl->writing_state = MEI_WRITE_COMPLETE;
-                        list_add_tail(&cb->list, &cmpl_list->list);
-                }
-                if (cl == &dev->iamthif_cl) {
-                        cl_dbg(dev, cl, "check iamthif flow control.\n");
-                        if (dev->iamthif_flow_control_pending) {
-                                ret = mei_amthif_irq_read(dev, &slots);
-                                if (ret)
-                                        return ret;
-                        }
-                }
+                cl_dbg(dev, cl, "MEI WRITE COMPLETE\n");
+                cl->writing_state = MEI_WRITE_COMPLETE;
+                list_move_tail(&cb->list, &cmpl_list->list);
         }
 
         if (dev->wd_state == MEI_WD_STOPPING) {
@@ -587,10 +562,7 @@ void mei_timer(struct work_struct *work)
                 if (--dev->iamthif_stall_timer == 0) {
                         dev_err(dev->dev, "timer: amthif  hanged.\n");
                         mei_reset(dev);
-                        dev->iamthif_msg_buf_size = 0;
-                        dev->iamthif_msg_buf_index = 0;
                         dev->iamthif_canceled = false;
-                        dev->iamthif_ioctl = true;
                         dev->iamthif_state = MEI_IAMTHIF_IDLE;
                         dev->iamthif_timer = 0;
 
@@ -636,4 +608,3 @@ out:
                 schedule_delayed_work(&dev->timer_work, 2 * HZ);
         mutex_unlock(&dev->device_lock);
 }
-
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 47680c84801c..3e2968159506 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -58,24 +58,18 @@ static int mei_open(struct inode *inode, struct file *file)
 
         mutex_lock(&dev->device_lock);
 
-        cl = NULL;
-
-        err = -ENODEV;
         if (dev->dev_state != MEI_DEV_ENABLED) {
                 dev_dbg(dev->dev, "dev_state != MEI_ENABLED  dev_state = %s\n",
                     mei_dev_state_str(dev->dev_state));
+                err = -ENODEV;
                 goto err_unlock;
         }
 
-        err = -ENOMEM;
-        cl = mei_cl_allocate(dev);
-        if (!cl)
-                goto err_unlock;
-
-        /* open_handle_count check is handled in the mei_cl_link */
-        err = mei_cl_link(cl, MEI_HOST_CLIENT_ID_ANY);
-        if (err)
+        cl = mei_cl_alloc_linked(dev, MEI_HOST_CLIENT_ID_ANY);
+        if (IS_ERR(cl)) {
+                err = PTR_ERR(cl);
                 goto err_unlock;
+        }
 
         file->private_data = cl;
 
@@ -85,7 +79,6 @@ static int mei_open(struct inode *inode, struct file *file)
 
 err_unlock:
         mutex_unlock(&dev->device_lock);
-        kfree(cl);
         return err;
 }
 
@@ -100,7 +93,6 @@ err_unlock:
 static int mei_release(struct inode *inode, struct file *file)
 {
         struct mei_cl *cl = file->private_data;
-        struct mei_cl_cb *cb;
         struct mei_device *dev;
         int rets = 0;
 
@@ -114,33 +106,18 @@ static int mei_release(struct inode *inode, struct file *file)
                 rets = mei_amthif_release(dev, file);
                 goto out;
         }
-        if (cl->state == MEI_FILE_CONNECTED) {
+        if (mei_cl_is_connected(cl)) {
                 cl->state = MEI_FILE_DISCONNECTING;
                 cl_dbg(dev, cl, "disconnecting\n");
                 rets = mei_cl_disconnect(cl);
         }
-        mei_cl_flush_queues(cl);
+        mei_cl_flush_queues(cl, file);
         cl_dbg(dev, cl, "removing\n");
 
         mei_cl_unlink(cl);
 
-
-        /* free read cb */
-        cb = NULL;
-        if (cl->read_cb) {
-                cb = mei_cl_find_read_cb(cl);
-                /* Remove entry from read list */
-                if (cb)
-                        list_del(&cb->list);
-
-                cb = cl->read_cb;
-                cl->read_cb = NULL;
-        }
-
         file->private_data = NULL;
 
-        mei_io_cb_free(cb);
-
         kfree(cl);
 out:
         mutex_unlock(&dev->device_lock);
@@ -162,9 +139,8 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                         size_t length, loff_t *offset)
 {
         struct mei_cl *cl = file->private_data;
-        struct mei_cl_cb *cb_pos = NULL;
-        struct mei_cl_cb *cb = NULL;
         struct mei_device *dev;
+        struct mei_cl_cb *cb = NULL;
         int rets;
         int err;
 
@@ -191,8 +167,8 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                 goto out;
         }
 
-        if (cl->read_cb) {
-                cb = cl->read_cb;
+        cb = mei_cl_read_cb(cl, file);
+        if (cb) {
                 /* read what left */
                 if (cb->buf_idx > *offset)
                         goto copy_buffer;
@@ -208,7 +184,7 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                 *offset = 0;
         }
 
-        err = mei_cl_read_start(cl, length);
+        err = mei_cl_read_start(cl, length, file);
         if (err && err != -EBUSY) {
                 dev_dbg(dev->dev,
                         "mei start read failure with status = %d\n", err);
@@ -216,8 +192,7 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                 goto out;
         }
 
-        if (MEI_READ_COMPLETE != cl->reading_state &&
-                        !waitqueue_active(&cl->rx_wait)) {
+        if (list_empty(&cl->rd_completed) && !waitqueue_active(&cl->rx_wait)) {
                 if (file->f_flags & O_NONBLOCK) {
                         rets = -EAGAIN;
                         goto out;
@@ -226,8 +201,8 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                 mutex_unlock(&dev->device_lock);
 
                 if (wait_event_interruptible(cl->rx_wait,
-                                MEI_READ_COMPLETE == cl->reading_state ||
-                                mei_cl_is_transitioning(cl))) {
+                                (!list_empty(&cl->rd_completed)) ||
+                                (!mei_cl_is_connected(cl)))) {
 
                         if (signal_pending(current))
                                 return -EINTR;
@@ -235,26 +210,28 @@ static ssize_t mei_read(struct file *file, char __user *ubuf,
                 }
 
                 mutex_lock(&dev->device_lock);
-                if (mei_cl_is_transitioning(cl)) {
+                if (!mei_cl_is_connected(cl)) {
                         rets = -EBUSY;
                         goto out;
                 }
         }
 
-        cb = cl->read_cb;
-
+        cb = mei_cl_read_cb(cl, file);
         if (!cb) {
-                rets = -ENODEV;
-                goto out;
-        }
-        if (cl->reading_state != MEI_READ_COMPLETE) {
                 rets = 0;
                 goto out;
         }
-        /* now copy the data to user space */
+
 copy_buffer:
+        /* now copy the data to user space */
+        if (cb->status) {
+                rets = cb->status;
+                dev_dbg(dev->dev, "read operation failed %d\n", rets);
+                goto free;
+        }
+
         dev_dbg(dev->dev, "buf.size = %d buf.idx= %ld\n",
-            cb->response_buffer.size, cb->buf_idx);
+            cb->buf.size, cb->buf_idx);
         if (length == 0 || ubuf == NULL || *offset > cb->buf_idx) {
                 rets = -EMSGSIZE;
                 goto free;
@@ -264,7 +241,7 @@ copy_buffer:
          * however buf_idx may point beyond that */
         length = min_t(size_t, length, cb->buf_idx - *offset);
 
-        if (copy_to_user(ubuf, cb->response_buffer.data + *offset, length)) {
+        if (copy_to_user(ubuf, cb->buf.data + *offset, length)) {
                 dev_dbg(dev->dev, "failed to copy data to userland\n");
                 rets = -EFAULT;
                 goto free;
@@ -276,13 +253,8 @@ copy_buffer:
                 goto out;
 
 free:
-        cb_pos = mei_cl_find_read_cb(cl);
-        /* Remove entry from read list */
-        if (cb_pos)
-                list_del(&cb_pos->list);
         mei_io_cb_free(cb);
-        cl->reading_state = MEI_IDLE;
-        cl->read_cb = NULL;
+
 out:
         dev_dbg(dev->dev, "end mei read rets= %d\n", rets);
         mutex_unlock(&dev->device_lock);
@@ -336,9 +308,8 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
                 goto out;
         }
 
-        if (cl->state != MEI_FILE_CONNECTED) {
-                dev_err(dev->dev, "host client = %d,  is not connected to ME client = %d",
-                        cl->host_client_id, cl->me_client_id);
+        if (!mei_cl_is_connected(cl)) {
+                cl_err(dev, cl, "is not connected");
                 rets = -ENODEV;
                 goto out;
         }
@@ -349,41 +320,22 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
                         timeout = write_cb->read_time +
                                 mei_secs_to_jiffies(MEI_IAMTHIF_READ_TIMER);
 
-                        if (time_after(jiffies, timeout) ||
-                            cl->reading_state == MEI_READ_COMPLETE) {
+                        if (time_after(jiffies, timeout)) {
                                 *offset = 0;
-                                list_del(&write_cb->list);
                                 mei_io_cb_free(write_cb);
                                 write_cb = NULL;
                         }
                 }
         }
 
-        /* free entry used in read */
-        if (cl->reading_state == MEI_READ_COMPLETE) {
-                *offset = 0;
-                write_cb = mei_cl_find_read_cb(cl);
-                if (write_cb) {
-                        list_del(&write_cb->list);
-                        mei_io_cb_free(write_cb);
-                        write_cb = NULL;
-                        cl->reading_state = MEI_IDLE;
-                        cl->read_cb = NULL;
-                }
-        } else if (cl->reading_state == MEI_IDLE)
-                *offset = 0;
-
-
-        write_cb = mei_io_cb_init(cl, file);
+        *offset = 0;
+        write_cb = mei_cl_alloc_cb(cl, length, MEI_FOP_WRITE, file);
         if (!write_cb) {
                 rets = -ENOMEM;
                 goto out;
         }
-        rets = mei_io_cb_alloc_req_buf(write_cb, length);
-        if (rets)
-                goto out;
 
-        rets = copy_from_user(write_cb->request_buffer.data, ubuf, length);
+        rets = copy_from_user(write_cb->buf.data, ubuf, length);
         if (rets) {
                 dev_dbg(dev->dev, "failed to copy data from userland\n");
                 rets = -EFAULT;
@@ -391,7 +343,7 @@ static ssize_t mei_write(struct file *file, const char __user *ubuf,
         }
 
         if (cl == &dev->iamthif_cl) {
-                rets = mei_amthif_write(dev, write_cb);
+                rets = mei_amthif_write(cl, write_cb);
 
                 if (rets) {
                         dev_err(dev->dev,
@@ -464,7 +416,7 @@ static int mei_ioctl_connect_client(struct file *file,
          */
         if (uuid_le_cmp(data->in_client_uuid, mei_amthif_guid) == 0) {
                 dev_dbg(dev->dev, "FW Client is amthi\n");
-                if (dev->iamthif_cl.state != MEI_FILE_CONNECTED) {
+                if (!mei_cl_is_connected(&dev->iamthif_cl)) {
                         rets = -ENODEV;
                         goto end;
                 }
@@ -588,6 +540,7 @@ static long mei_compat_ioctl(struct file *file,
  */
 static unsigned int mei_poll(struct file *file, poll_table *wait)
 {
+        unsigned long req_events = poll_requested_events(wait);
         struct mei_cl *cl = file->private_data;
         struct mei_device *dev;
         unsigned int mask = 0;
@@ -599,27 +552,26 @@ static unsigned int mei_poll(struct file *file, poll_table *wait)
 
         mutex_lock(&dev->device_lock);
 
-        if (!mei_cl_is_connected(cl)) {
+
+        if (dev->dev_state != MEI_DEV_ENABLED ||
+            !mei_cl_is_connected(cl)) {
                 mask = POLLERR;
                 goto out;
         }
 
-        mutex_unlock(&dev->device_lock);
-
-
-        if (cl == &dev->iamthif_cl)
-                return mei_amthif_poll(dev, file, wait);
-
-        poll_wait(file, &cl->tx_wait, wait);
-
-        mutex_lock(&dev->device_lock);
-
-        if (!mei_cl_is_connected(cl)) {
-                mask = POLLERR;
+        if (cl == &dev->iamthif_cl) {
+                mask = mei_amthif_poll(dev, file, wait);
                 goto out;
         }
 
-        mask |= (POLLIN | POLLRDNORM);
+        if (req_events & (POLLIN | POLLRDNORM)) {
+                poll_wait(file, &cl->rx_wait, wait);
+
+                if (!list_empty(&cl->rd_completed))
+                        mask |= POLLIN | POLLRDNORM;
+                else
+                        mei_cl_read_start(cl, 0, file);
+        }
 
 out:
         mutex_unlock(&dev->device_lock);
diff --git a/drivers/misc/mei/mei-trace.c b/drivers/misc/mei/mei-trace.c
new file mode 100644
index 000000000000..388efb519138
--- /dev/null
+++ b/drivers/misc/mei/mei-trace.c
@@ -0,0 +1,25 @@
+/*
+ *
+ * Intel Management Engine Interface (Intel MEI) Linux driver
+ * Copyright (c) 2015, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+#include <linux/module.h>
+
+/* sparse doesn't like tracepoint macros */
+#ifndef __CHECKER__
+#define CREATE_TRACE_POINTS
+#include "mei-trace.h"
+
+EXPORT_TRACEPOINT_SYMBOL(mei_reg_read);
+EXPORT_TRACEPOINT_SYMBOL(mei_reg_write);
+#endif /* __CHECKER__ */
diff --git a/drivers/misc/mei/mei-trace.h b/drivers/misc/mei/mei-trace.h
new file mode 100644
index 000000000000..47e1bc6551d4
--- /dev/null
+++ b/drivers/misc/mei/mei-trace.h
@@ -0,0 +1,74 @@
+/*
+ *
+ * Intel Management Engine Interface (Intel MEI) Linux driver
+ * Copyright (c) 2015, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ */
+
+#if !defined(_MEI_TRACE_H_) || defined(TRACE_HEADER_MULTI_READ)
+#define _MEI_TRACE_H_
+
+#include <linux/stringify.h>
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+
+#include <linux/device.h>
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM mei
+
+TRACE_EVENT(mei_reg_read,
+        TP_PROTO(const struct device *dev, const char *reg, u32 offs, u32 val),
+        TP_ARGS(dev, reg, offs, val),
+        TP_STRUCT__entry(
+                __string(dev, dev_name(dev))
+                __field(const char *, reg)
+                __field(u32, offs)
+                __field(u32, val)
+        ),
+        TP_fast_assign(
+                __assign_str(dev, dev_name(dev))
+                __entry->reg  = reg;
+                __entry->offs = offs;
+                __entry->val = val;
+        ),
+        TP_printk("[%s] read %s:[%#x] = %#x",
+                  __get_str(dev), __entry->reg, __entry->offs, __entry->val)
+);
+
+TRACE_EVENT(mei_reg_write,
+        TP_PROTO(const struct device *dev, const char *reg, u32 offs, u32 val),
+        TP_ARGS(dev, reg, offs, val),
+        TP_STRUCT__entry(
+                __string(dev, dev_name(dev))
+                __field(const char *, reg)
+                __field(u32, offs)
+                __field(u32, val)
+        ),
+        TP_fast_assign(
+                __assign_str(dev, dev_name(dev))
+                __entry->reg = reg;
+                __entry->offs = offs;
+                __entry->val = val;
+        ),
+        TP_printk("[%s] write %s[%#x] = %#x)",
+                  __get_str(dev), __entry->reg,  __entry->offs, __entry->val)
+);
+
+#endif /* _MEI_TRACE_H_ */
+
+/* This part must be outside protection */
+#undef TRACE_INCLUDE_PATH
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_PATH .
+#define TRACE_INCLUDE_FILE mei-trace
+#include <trace/define_trace.h>
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 6c6ce9381535..f066ecd71939 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -194,23 +194,25 @@ struct mei_cl;
  * @list: link in callback queue
  * @cl: file client who is running this operation
  * @fop_type: file operation type
- * @request_buffer: buffer to store request data
- * @response_buffer: buffer to store response data
+ * @buf: buffer for data associated with the callback
  * @buf_idx: last read index
  * @read_time: last read operation time stamp (iamthif)
  * @file_object: pointer to file structure
+ * @status: io status of the cb
  * @internal: communication between driver and FW flag
+ * @completed: the transfer or reception has completed
  */
 struct mei_cl_cb {
         struct list_head list;
         struct mei_cl *cl;
         enum mei_cb_file_ops fop_type;
-        struct mei_msg_data request_buffer;
-        struct mei_msg_data response_buffer;
+        struct mei_msg_data buf;
         unsigned long buf_idx;
         unsigned long read_time;
         struct file *file_object;
+        int status;
         u32 internal:1;
+        u32 completed:1;
 };
 
 /**
@@ -229,9 +231,9 @@ struct mei_cl_cb {
  * @me_client_id: me/fw id
  * @mei_flow_ctrl_creds: transmit flow credentials
  * @timer_count:  watchdog timer for operation completion
- * @reading_state: state of the rx
  * @writing_state: state of the tx
- * @read_cb: current pending reading callback
+ * @rd_pending: pending read credits
+ * @rd_completed: completed read
  *
  * @device: device on the mei client bus
  * @device_link:  link to bus clients
@@ -249,9 +251,9 @@ struct mei_cl {
         u8 me_client_id;
         u8 mei_flow_ctrl_creds;
         u8 timer_count;
-        enum mei_file_transaction_states reading_state;
         enum mei_file_transaction_states writing_state;
-        struct mei_cl_cb *read_cb;
+        struct list_head rd_pending;
+        struct list_head rd_completed;
 
         /* MEI CL bus data */
         struct mei_cl_device *device;
@@ -423,7 +425,6 @@ const char *mei_pg_state_str(enum mei_pg_state state);
  * @cdev        : character device
  * @minor       : minor number allocated for device
  *
- * @read_list   : read completion list
  * @write_list  : write pending list
  * @write_waiting_list : write completion list
  * @ctrl_wr_list : pending control write list
@@ -460,6 +461,7 @@ const char *mei_pg_state_str(enum mei_pg_state state);
  * @version     : HBM protocol version in use
  * @hbm_f_pg_supported : hbm feature pgi protocol
  *
+ * @me_clients_rwsem: rw lock over me_clients list
  * @me_clients  : list of FW clients
  * @me_clients_map : FW clients bit map
  * @host_clients_map : host clients id pool
@@ -480,12 +482,7 @@ const char *mei_pg_state_str(enum mei_pg_state state);
  * @iamthif_mtu : amthif client max message length
  * @iamthif_timer : time stamp of current amthif command completion
  * @iamthif_stall_timer : timer to detect amthif hang
- * @iamthif_msg_buf : amthif current message buffer
- * @iamthif_msg_buf_size : size of current amthif message request buffer
- * @iamthif_msg_buf_index : current index in amthif message request buffer
  * @iamthif_state : amthif processor state
- * @iamthif_flow_control_pending: amthif waits for flow control
- * @iamthif_ioctl : wait for completion if amthif control message
  * @iamthif_canceled : current amthif command is canceled
  *
  * @init_work   : work item for the device init
@@ -503,7 +500,6 @@ struct mei_device {
         struct cdev cdev;
         int minor;
 
-        struct mei_cl_cb read_list;
         struct mei_cl_cb write_list;
         struct mei_cl_cb write_waiting_list;
         struct mei_cl_cb ctrl_wr_list;
@@ -556,6 +552,7 @@ struct mei_device {
         struct hbm_version version;
         unsigned int hbm_f_pg_supported:1;
 
+        struct rw_semaphore me_clients_rwsem;
         struct list_head me_clients;
         DECLARE_BITMAP(me_clients_map, MEI_CLIENTS_MAX);
         DECLARE_BITMAP(host_clients_map, MEI_CLIENTS_MAX);
@@ -579,12 +576,7 @@ struct mei_device {
         int iamthif_mtu;
         unsigned long iamthif_timer;
         u32 iamthif_stall_timer;
-        unsigned char *iamthif_msg_buf; /* Note: memory has to be allocated */
-        u32 iamthif_msg_buf_size;
-        u32 iamthif_msg_buf_index;
         enum iamthif_states iamthif_state;
-        bool iamthif_flow_control_pending;
-        bool iamthif_ioctl;
         bool iamthif_canceled;
 
         struct work_struct init_work;
@@ -662,8 +654,6 @@ void mei_amthif_reset_params(struct mei_device *dev);
 
 int mei_amthif_host_init(struct mei_device *dev);
 
-int mei_amthif_write(struct mei_device *dev, struct mei_cl_cb *priv_cb);
-
 int mei_amthif_read(struct mei_device *dev, struct file *file,
                 char __user *ubuf, size_t length, loff_t *offset);
 
@@ -675,13 +665,13 @@ int mei_amthif_release(struct mei_device *dev, struct file *file);
 struct mei_cl_cb *mei_amthif_find_read_list_entry(struct mei_device *dev,
                                                 struct file *file);
 
-void mei_amthif_run_next_cmd(struct mei_device *dev);
-
+int mei_amthif_write(struct mei_cl *cl, struct mei_cl_cb *cb);
+int mei_amthif_run_next_cmd(struct mei_device *dev);
 int mei_amthif_irq_write(struct mei_cl *cl, struct mei_cl_cb *cb,
                         struct mei_cl_cb *cmpl_list);
 
 void mei_amthif_complete(struct mei_device *dev, struct mei_cl_cb *cb);
-int mei_amthif_irq_read_msg(struct mei_device *dev,
+int mei_amthif_irq_read_msg(struct mei_cl *cl,
                             struct mei_msg_hdr *mei_hdr,
                             struct mei_cl_cb *complete_list);
 int mei_amthif_irq_read(struct mei_device *dev, s32 *slots);
diff --git a/drivers/misc/mei/nfc.c b/drivers/misc/mei/nfc.c
index bb61a119b8bb..c3bcb63686d7 100644
--- a/drivers/misc/mei/nfc.c
+++ b/drivers/misc/mei/nfc.c
@@ -482,8 +482,8 @@ err:
 int mei_nfc_host_init(struct mei_device *dev)
 {
         struct mei_nfc_dev *ndev;
-        struct mei_cl *cl_info, *cl = NULL;
-        struct mei_me_client *me_cl;
+        struct mei_cl *cl_info, *cl;
+        struct mei_me_client *me_cl = NULL;
         int ret;
 
 
@@ -500,17 +500,6 @@ int mei_nfc_host_init(struct mei_device *dev)
                 goto err;
         }
 
-        ndev->cl_info = mei_cl_allocate(dev);
-        ndev->cl = mei_cl_allocate(dev);
-
-        cl = ndev->cl;
-        cl_info = ndev->cl_info;
-
-        if (!cl || !cl_info) {
-                ret = -ENOMEM;
-                goto err;
-        }
-
         /* check for valid client id */
         me_cl = mei_me_cl_by_uuid(dev, &mei_nfc_info_guid);
         if (!me_cl) {
@@ -519,17 +508,21 @@ int mei_nfc_host_init(struct mei_device *dev)
                 goto err;
         }
 
+        cl_info = mei_cl_alloc_linked(dev, MEI_HOST_CLIENT_ID_ANY);
+        if (IS_ERR(cl_info)) {
+                ret = PTR_ERR(cl_info);
+                goto err;
+        }
+
         cl_info->me_client_id = me_cl->client_id;
         cl_info->cl_uuid = me_cl->props.protocol_name;
         mei_me_cl_put(me_cl);
-
-        ret = mei_cl_link(cl_info, MEI_HOST_CLIENT_ID_ANY);
-        if (ret)
-                goto err;
-
+        me_cl = NULL;
 
         list_add_tail(&cl_info->device_link, &dev->device_list);
 
+        ndev->cl_info = cl_info;
+
         /* check for valid client id */
         me_cl = mei_me_cl_by_uuid(dev, &mei_nfc_guid);
         if (!me_cl) {
@@ -538,16 +531,21 @@ int mei_nfc_host_init(struct mei_device *dev)
                 goto err;
         }
 
+        cl = mei_cl_alloc_linked(dev, MEI_HOST_CLIENT_ID_ANY);
+        if (IS_ERR(cl)) {
+                ret = PTR_ERR(cl);
+                goto err;
+        }
+
         cl->me_client_id = me_cl->client_id;
         cl->cl_uuid = me_cl->props.protocol_name;
         mei_me_cl_put(me_cl);
-
-        ret = mei_cl_link(cl, MEI_HOST_CLIENT_ID_ANY);
-        if (ret)
-                goto err;
+        me_cl = NULL;
 
         list_add_tail(&cl->device_link, &dev->device_list);
 
+        ndev->cl = cl;
+
         ndev->req_id = 1;
 
         INIT_WORK(&ndev->init_work, mei_nfc_init);
@@ -557,6 +555,7 @@ int mei_nfc_host_init(struct mei_device *dev)
         return 0;
 
 err:
+        mei_me_cl_put(me_cl);
         mei_nfc_free(ndev);
 
         return ret;
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index af44ee26075d..23f71f5ce4fb 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -388,7 +388,7 @@ static int mei_me_pm_runtime_suspend(struct device *device)
         mutex_lock(&dev->device_lock);
 
         if (mei_write_is_idle(dev))
-                ret = mei_me_pg_set_sync(dev);
+                ret = mei_me_pg_enter_sync(dev);
         else
                 ret = -EAGAIN;
 
@@ -413,7 +413,7 @@ static int mei_me_pm_runtime_resume(struct device *device)
 
         mutex_lock(&dev->device_lock);
 
-        ret = mei_me_pg_unset_sync(dev);
+        ret = mei_me_pg_exit_sync(dev);
 
         mutex_unlock(&dev->device_lock);
 
diff --git a/drivers/misc/mei/pci-txe.c b/drivers/misc/mei/pci-txe.c
index c86e2ddbe30a..dcfcba44b6f7 100644
--- a/drivers/misc/mei/pci-txe.c
+++ b/drivers/misc/mei/pci-txe.c
@@ -63,7 +63,7 @@ static void mei_txe_pci_iounmap(struct pci_dev *pdev, struct mei_txe_hw *hw)
         }
 }
 /**
- * mei_probe - Device Initialization Routine
+ * mei_txe_probe - Device Initialization Routine
  *
  * @pdev: PCI device structure
  * @ent: entry in mei_txe_pci_tbl
@@ -193,7 +193,7 @@ end:
 }
 
 /**
- * mei_remove - Device Removal Routine
+ * mei_txe_remove - Device Removal Routine
  *
  * @pdev: PCI device structure
  *
diff --git a/drivers/misc/mei/wd.c b/drivers/misc/mei/wd.c
index 475f1dea45bf..2725f865c3d6 100644
--- a/drivers/misc/mei/wd.c
+++ b/drivers/misc/mei/wd.c
@@ -160,9 +160,10 @@ int mei_wd_send(struct mei_device *dev)
  */
 int mei_wd_stop(struct mei_device *dev)
 {
+        struct mei_cl *cl = &dev->wd_cl;
         int ret;
 
-        if (dev->wd_cl.state != MEI_FILE_CONNECTED ||
+        if (!mei_cl_is_connected(cl) ||
             dev->wd_state != MEI_WD_RUNNING)
                 return 0;
 
@@ -170,7 +171,7 @@ int mei_wd_stop(struct mei_device *dev)
 
         dev->wd_state = MEI_WD_STOPPING;
 
-        ret = mei_cl_flow_ctrl_creds(&dev->wd_cl);
+        ret = mei_cl_flow_ctrl_creds(cl);
         if (ret < 0)
                 goto err;
 
@@ -202,22 +203,25 @@ err:
         return ret;
 }
 
-/*
+/**
  * mei_wd_ops_start - wd start command from the watchdog core.
  *
- * @wd_dev - watchdog device struct
+ * @wd_dev: watchdog device struct
  *
  * Return: 0 if success, negative errno code for failure
  */
 static int mei_wd_ops_start(struct watchdog_device *wd_dev)
 {
-        int err = -ENODEV;
         struct mei_device *dev;
+        struct mei_cl *cl;
+        int err = -ENODEV;
 
         dev = watchdog_get_drvdata(wd_dev);
         if (!dev)
                 return -ENODEV;
 
+        cl = &dev->wd_cl;
+
         mutex_lock(&dev->device_lock);
 
         if (dev->dev_state != MEI_DEV_ENABLED) {
@@ -226,8 +230,8 @@ static int mei_wd_ops_start(struct watchdog_device *wd_dev)
                 goto end_unlock;
         }
 
-        if (dev->wd_cl.state != MEI_FILE_CONNECTED)     {
-                dev_dbg(dev->dev, "MEI Driver is not connected to Watchdog Client\n");
+        if (!mei_cl_is_connected(cl)) {
+                cl_dbg(dev, cl, "MEI Driver is not connected to Watchdog Client\n");
                 goto end_unlock;
         }
 
@@ -239,10 +243,10 @@ end_unlock:
         return err;
 }
 
-/*
+/**
  * mei_wd_ops_stop -  wd stop command from the watchdog core.
  *
- * @wd_dev - watchdog device struct
+ * @wd_dev: watchdog device struct
  *
  * Return: 0 if success, negative errno code for failure
  */
@@ -261,10 +265,10 @@ static int mei_wd_ops_stop(struct watchdog_device *wd_dev)
         return 0;
 }
 
-/*
+/**
  * mei_wd_ops_ping - wd ping command from the watchdog core.
  *
- * @wd_dev - watchdog device struct
+ * @wd_dev: watchdog device struct
  *
  * Return: 0 if success, negative errno code for failure
  */
@@ -282,8 +286,8 @@ static int mei_wd_ops_ping(struct watchdog_device *wd_dev)
 
         mutex_lock(&dev->device_lock);
 
-        if (cl->state != MEI_FILE_CONNECTED) {
-                dev_err(dev->dev, "wd: not connected.\n");
+        if (!mei_cl_is_connected(cl)) {
+                cl_err(dev, cl, "wd: not connected.\n");
                 ret = -ENODEV;
                 goto end;
         }
@@ -311,11 +315,11 @@ end:
         return ret;
 }
 
-/*
+/**
  * mei_wd_ops_set_timeout - wd set timeout command from the watchdog core.
  *
- * @wd_dev - watchdog device struct
- * @timeout - timeout value to set
+ * @wd_dev: watchdog device struct
+ * @timeout: timeout value to set
  *
  * Return: 0 if success, negative errno code for failure
  */
diff --git a/drivers/misc/mic/host/mic_boot.c b/drivers/misc/mic/host/mic_boot.c
index ff2b0fb1a6be..d9fa609da061 100644
--- a/drivers/misc/mic/host/mic_boot.c
+++ b/drivers/misc/mic/host/mic_boot.c
@@ -309,7 +309,7 @@ void mic_complete_resume(struct mic_device *mdev)
  */
 void mic_prepare_suspend(struct mic_device *mdev)
 {
-        int rc;
+        unsigned long timeout;
 
 #define MIC_SUSPEND_TIMEOUT (60 * HZ)
 
@@ -331,10 +331,10 @@ void mic_prepare_suspend(struct mic_device *mdev)
                  */
                 mic_set_state(mdev, MIC_SUSPENDING);
                 mutex_unlock(&mdev->mic_mutex);
-                rc = wait_for_completion_timeout(&mdev->reset_wait,
-                                                MIC_SUSPEND_TIMEOUT);
+                timeout = wait_for_completion_timeout(&mdev->reset_wait,
+                                                      MIC_SUSPEND_TIMEOUT);
                 /* Force reset the card if the shutdown completion timed out */
-                if (!rc) {
+                if (!timeout) {
                         mutex_lock(&mdev->mic_mutex);
                         mic_set_state(mdev, MIC_SUSPENDED);
                         mutex_unlock(&mdev->mic_mutex);
@@ -348,10 +348,10 @@ void mic_prepare_suspend(struct mic_device *mdev)
                  */
                 mic_set_state(mdev, MIC_SUSPENDED);
                 mutex_unlock(&mdev->mic_mutex);
-                rc = wait_for_completion_timeout(&mdev->reset_wait,
-                                                MIC_SUSPEND_TIMEOUT);
+                timeout = wait_for_completion_timeout(&mdev->reset_wait,
+                                                      MIC_SUSPEND_TIMEOUT);
                 /* Force reset the card if the shutdown completion timed out */
-                if (!rc)
+                if (!timeout)
                         mic_stop(mdev, true);
                 break;
         default:
diff --git a/drivers/misc/mic/host/mic_intr.c b/drivers/misc/mic/host/mic_intr.c
index d686f2846ac7..b4ca6c884d19 100644
--- a/drivers/misc/mic/host/mic_intr.c
+++ b/drivers/misc/mic/host/mic_intr.c
@@ -363,8 +363,6 @@ static int mic_setup_intx(struct mic_device *mdev, struct pci_dev *pdev)
 {
         int rc;
 
-        pci_msi_off(pdev);
-
         /* Enable intx */
         pci_intx(pdev, 1);
         rc = mic_setup_callbacks(mdev);
diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
index 21181fa243df..eeaaf5fca105 100644
--- a/drivers/misc/sram.c
+++ b/drivers/misc/sram.c
@@ -69,12 +69,23 @@ static int sram_probe(struct platform_device *pdev)
         INIT_LIST_HEAD(&reserve_list);
 
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-        virt_base = devm_ioremap_resource(&pdev->dev, res);
-        if (IS_ERR(virt_base))
-                return PTR_ERR(virt_base);
+        if (!res) {
+                dev_err(&pdev->dev, "found no memory resource\n");
+                return -EINVAL;
+        }
 
         size = resource_size(res);
 
+        if (!devm_request_mem_region(&pdev->dev,
+                        res->start, size, pdev->name)) {
+                dev_err(&pdev->dev, "could not request region for resource\n");
+                return -EBUSY;
+        }
+
+        virt_base = devm_ioremap_wc(&pdev->dev, res->start, size);
+        if (IS_ERR(virt_base))
+                return PTR_ERR(virt_base);
+
         sram = devm_kzalloc(&pdev->dev, sizeof(*sram), GFP_KERNEL);
         if (!sram)
                 return -ENOMEM;
@@ -205,7 +216,7 @@ static int sram_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_OF
-static struct of_device_id sram_dt_ids[] = {
+static const struct of_device_id sram_dt_ids[] = {
         { .compatible = "mmio-sram" },
         {}
 };
diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c
index a606c8901e18..a37a42f67088 100644
--- a/drivers/misc/tifm_7xx1.c
+++ b/drivers/misc/tifm_7xx1.c
@@ -236,6 +236,7 @@ static int tifm_7xx1_resume(struct pci_dev *dev)
 {
         struct tifm_adapter *fm = pci_get_drvdata(dev);
         int rc;
+        unsigned long timeout;
         unsigned int good_sockets = 0, bad_sockets = 0;
         unsigned long flags;
         unsigned char new_ids[fm->num_sockets];
@@ -272,8 +273,8 @@ static int tifm_7xx1_resume(struct pci_dev *dev)
         if (good_sockets) {
                 fm->finish_me = &finish_resume;
                 spin_unlock_irqrestore(&fm->lock, flags);
-                rc = wait_for_completion_timeout(&finish_resume, HZ);
-                dev_dbg(&dev->dev, "wait returned %d\n", rc);
+                timeout = wait_for_completion_timeout(&finish_resume, HZ);
+                dev_dbg(&dev->dev, "wait returned %lu\n", timeout);
                 writel(TIFM_IRQ_FIFOMASK(good_sockets)
                        | TIFM_IRQ_CARDMASK(good_sockets),
                        fm->addr + FM_CLEAR_INTERRUPT_ENABLE);
diff --git a/drivers/misc/vmw_vmci/vmci_driver.c b/drivers/misc/vmw_vmci/vmci_driver.c
index 032d35cf93ca..b823f9a6e464 100644
--- a/drivers/misc/vmw_vmci/vmci_driver.c
+++ b/drivers/misc/vmw_vmci/vmci_driver.c
@@ -113,5 +113,5 @@ module_exit(vmci_drv_exit);
 
 MODULE_AUTHOR("VMware, Inc.");
 MODULE_DESCRIPTION("VMware Virtual Machine Communication Interface.");
-MODULE_VERSION("1.1.1.0-k");
+MODULE_VERSION("1.1.3.0-k");
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/misc/vmw_vmci/vmci_host.c b/drivers/misc/vmw_vmci/vmci_host.c
index 66fc9921fc85..a721b5d8a9da 100644
--- a/drivers/misc/vmw_vmci/vmci_host.c
+++ b/drivers/misc/vmw_vmci/vmci_host.c
@@ -395,6 +395,12 @@ static int vmci_host_do_send_datagram(struct vmci_host_dev *vmci_host_dev,
                 return -EFAULT;
         }
 
+        if (VMCI_DG_SIZE(dg) != send_info.len) {
+                vmci_ioctl_err("datagram size mismatch\n");
+                kfree(dg);
+                return -EINVAL;
+        }
+
         pr_devel("Datagram dst (handle=0x%x:0x%x) src (handle=0x%x:0x%x), payload (size=%llu bytes)\n",
                  dg->dst.context, dg->dst.resource,
                  dg->src.context, dg->src.resource,
diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 35f19a683822..f42d9c4e4561 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -295,12 +295,20 @@ static void *qp_alloc_queue(u64 size, u32 flags)
 {
         u64 i;
         struct vmci_queue *queue;
-        const size_t num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
-        const size_t pas_size = num_pages * sizeof(*queue->kernel_if->u.g.pas);
-        const size_t vas_size = num_pages * sizeof(*queue->kernel_if->u.g.vas);
-        const size_t queue_size =
-                sizeof(*queue) + sizeof(*queue->kernel_if) +
-                pas_size + vas_size;
+        size_t pas_size;
+        size_t vas_size;
+        size_t queue_size = sizeof(*queue) + sizeof(*queue->kernel_if);
+        const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
+
+        if (num_pages >
+                 (SIZE_MAX - queue_size) /
+                 (sizeof(*queue->kernel_if->u.g.pas) +
+                  sizeof(*queue->kernel_if->u.g.vas)))
+                return NULL;
+
+        pas_size = num_pages * sizeof(*queue->kernel_if->u.g.pas);
+        vas_size = num_pages * sizeof(*queue->kernel_if->u.g.vas);
+        queue_size += pas_size + vas_size;
 
         queue = vmalloc(queue_size);
         if (!queue)
@@ -615,10 +623,15 @@ static int qp_memcpy_from_queue_iov(void *dest,
 static struct vmci_queue *qp_host_alloc_queue(u64 size)
 {
         struct vmci_queue *queue;
-        const size_t num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
+        size_t queue_page_size;
+        const u64 num_pages = DIV_ROUND_UP(size, PAGE_SIZE) + 1;
         const size_t queue_size = sizeof(*queue) + sizeof(*(queue->kernel_if));
-        const size_t queue_page_size =
-            num_pages * sizeof(*queue->kernel_if->u.h.page);
+
+        if (num_pages > (SIZE_MAX - queue_size) /
+                 sizeof(*queue->kernel_if->u.h.page))
+                return NULL;
+
+        queue_page_size = num_pages * sizeof(*queue->kernel_if->u.h.page);
 
         queue = kzalloc(queue_size + queue_page_size, GFP_KERNEL);
         if (queue) {
@@ -737,7 +750,8 @@ static int qp_host_get_user_memory(u64 produce_uva,
                                      produce_q->kernel_if->num_pages, 1,
                                      produce_q->kernel_if->u.h.header_page);
         if (retval < produce_q->kernel_if->num_pages) {
-                pr_warn("get_user_pages(produce) failed (retval=%d)", retval);
+                pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
+                        retval);
                 qp_release_pages(produce_q->kernel_if->u.h.header_page,
                                  retval, false);
                 err = VMCI_ERROR_NO_MEM;
@@ -748,7 +762,8 @@ static int qp_host_get_user_memory(u64 produce_uva,
                                      consume_q->kernel_if->num_pages, 1,
                                      consume_q->kernel_if->u.h.header_page);
         if (retval < consume_q->kernel_if->num_pages) {
-                pr_warn("get_user_pages(consume) failed (retval=%d)", retval);
+                pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
+                        retval);
                 qp_release_pages(consume_q->kernel_if->u.h.header_page,
                                  retval, false);
                 qp_release_pages(produce_q->kernel_if->u.h.header_page,