Merge "msm: cvp: Re-initialize the HFI queue headers after CDSP-SSR"
diff --git a/arch/arm64/configs/vendor/kona-perf_defconfig b/arch/arm64/configs/vendor/kona-perf_defconfig
index 911d711..74b58921 100644
--- a/arch/arm64/configs/vendor/kona-perf_defconfig
+++ b/arch/arm64/configs/vendor/kona-perf_defconfig
@@ -644,6 +644,7 @@
 CONFIG_RAS=y
 CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
+# CONFIG_NVMEM_SYSFS is not set
 CONFIG_QCOM_QFPROM=y
 CONFIG_NVMEM_SPMI_SDAM=y
 CONFIG_SLIMBUS_MSM_NGD=y
diff --git a/arch/arm64/configs/vendor/kona_defconfig b/arch/arm64/configs/vendor/kona_defconfig
index a40b365..46b77b9 100644
--- a/arch/arm64/configs/vendor/kona_defconfig
+++ b/arch/arm64/configs/vendor/kona_defconfig
@@ -675,6 +675,7 @@
 CONFIG_RAS=y
 CONFIG_ANDROID=y
 CONFIG_ANDROID_BINDER_IPC=y
+# CONFIG_NVMEM_SYSFS is not set
 CONFIG_QCOM_QFPROM=y
 CONFIG_NVMEM_SPMI_SDAM=y
 CONFIG_SLIMBUS_MSM_NGD=y
diff --git a/drivers/bus/mhi/core/mhi_main.c b/drivers/bus/mhi/core/mhi_main.c
index 70d15ec..9237651 100644
--- a/drivers/bus/mhi/core/mhi_main.c
+++ b/drivers/bus/mhi/core/mhi_main.c
@@ -1070,7 +1070,9 @@
 
 	result.transaction_status = (ev_code == MHI_EV_CC_OVERFLOW) ?
 		-EOVERFLOW : 0;
-	result.bytes_xferd = xfer_len;
+
+	/* truncate to buf len if xfer_len is larger */
+	result.bytes_xferd = min_t(u16, xfer_len, buf_info->len);
 	result.buf_addr = buf_info->cb_buf;
 	result.dir = mhi_chan->dir;
 
diff --git a/drivers/bus/mhi/devices/mhi_uci.c b/drivers/bus/mhi/devices/mhi_uci.c
index d16ba5c..2a7fbfa 100644
--- a/drivers/bus/mhi/devices/mhi_uci.c
+++ b/drivers/bus/mhi/devices/mhi_uci.c
@@ -408,21 +408,29 @@
 	}
 
 	uci_buf = uci_chan->cur_buf;
-	spin_unlock_bh(&uci_chan->lock);
 
 	/* Copy the buffer to user space */
 	to_copy = min_t(size_t, count, uci_chan->rx_size);
 	ptr = uci_buf->data + (uci_buf->len - uci_chan->rx_size);
+	spin_unlock_bh(&uci_chan->lock);
+
 	ret = copy_to_user(buf, ptr, to_copy);
 	if (ret)
 		return ret;
 
+	spin_lock_bh(&uci_chan->lock);
+	/* Buffer already queued from diff thread while we dropped lock ? */
+	if (to_copy && !uci_chan->rx_size) {
+		MSG_VERB("Bailout as buffer already queued (%lu %lu)\n",
+			 to_copy, uci_chan->rx_size);
+		goto read_error;
+	}
+
 	MSG_VERB("Copied %lu of %lu bytes\n", to_copy, uci_chan->rx_size);
 	uci_chan->rx_size -= to_copy;
 
 	/* we finished with this buffer, queue it back to hardware */
 	if (!uci_chan->rx_size) {
-		spin_lock_bh(&uci_chan->lock);
 		uci_chan->cur_buf = NULL;
 
 		if (uci_dev->enabled)
@@ -437,9 +445,8 @@
 			kfree(uci_buf->data);
 			goto read_error;
 		}
-
-		spin_unlock_bh(&uci_chan->lock);
 	}
+	spin_unlock_bh(&uci_chan->lock);
 
 	MSG_VERB("Returning %lu bytes\n", to_copy);
 
diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c
index 019e203..d40f2f2 100644
--- a/drivers/char/diag/diag_masks.c
+++ b/drivers/char/diag/diag_masks.c
@@ -809,7 +809,7 @@
 		write_len += sizeof(rsp_ms);
 		if (rsp_ms.id_valid) {
 			sub_index = diag_check_subid_mask_index(rsp_ms.sub_id,
-				pid);
+				0);
 			ms_ptr = diag_get_ms_ptr_index(mask_info->ms_ptr,
 				sub_index);
 			if (!ms_ptr)
@@ -1004,11 +1004,17 @@
 		req_sub = (struct diag_msg_build_mask_sub_t *)src_buf;
 		rsp_sub = *req_sub;
 		rsp_sub.status = MSG_STATUS_FAIL;
-		sub_index = diag_check_subid_mask_index(req_sub->sub_id, pid);
-		ms_ptr = diag_get_ms_ptr_index(mask_info->ms_ptr, sub_index);
-		if (!ms_ptr)
-			goto err;
-		mask = (struct diag_msg_mask_t *)ms_ptr->sub_ptr;
+		if (req_sub->id_valid) {
+			sub_index = diag_check_subid_mask_index(req_sub->sub_id,
+				0);
+			ms_ptr = diag_get_ms_ptr_index(mask_info->ms_ptr,
+				sub_index);
+			if (!ms_ptr)
+				goto err;
+			mask = (struct diag_msg_mask_t *)ms_ptr->sub_ptr;
+		} else {
+			mask = (struct diag_msg_mask_t *)mask_info->ptr;
+		}
 		ssid_range.ssid_first = req_sub->ssid_first;
 		ssid_range.ssid_last = req_sub->ssid_last;
 		header_len = sizeof(rsp_sub);
@@ -1103,7 +1109,7 @@
 		header_len = sizeof(struct diag_msg_build_mask_sub_t);
 		if (req_sub->id_valid) {
 			sub_index = diag_check_subid_mask_index(req_sub->sub_id,
-				pid);
+				0);
 			ms_ptr = diag_get_ms_ptr_index(mask_info->ms_ptr,
 				sub_index);
 			if (!ms_ptr)
@@ -1304,7 +1310,7 @@
 		header_len = sizeof(struct diag_msg_config_rsp_sub_t);
 		if (req_sub->id_valid) {
 			sub_index = diag_check_subid_mask_index(req_sub->sub_id,
-				pid);
+				0);
 			ms_ptr = diag_get_ms_ptr_index(mask_info->ms_ptr,
 				sub_index);
 			if (!ms_ptr)
@@ -1454,7 +1460,7 @@
 	if (!cmd_ver || !req->id_valid)
 		memcpy(dest_buf + write_len, event_mask.ptr, mask_size);
 	else {
-		sub_index = diag_check_subid_mask_index(req->sub_id, pid);
+		sub_index = diag_check_subid_mask_index(req->sub_id, 0);
 		ms_ptr = diag_get_ms_ptr_index(event_mask.ms_ptr, sub_index);
 		if (!ms_ptr || !ms_ptr->sub_ptr)
 			return 0;
@@ -1516,7 +1522,7 @@
 		goto err;
 	}
 	if (cmd_ver && req_sub->id_valid) {
-		sub_index = diag_check_subid_mask_index(req_sub->sub_id, pid);
+		sub_index = diag_check_subid_mask_index(req_sub->sub_id, 0);
 		if (sub_index < 0) {
 			ret = sub_index;
 			goto err;
@@ -1631,7 +1637,7 @@
 		preset = req->preset_id;
 	}
 	if (cmd_ver && req->id_valid) {
-		sub_index = diag_check_subid_mask_index(req->sub_id, pid);
+		sub_index = diag_check_subid_mask_index(req->sub_id, 0);
 		if (sub_index < 0) {
 			ret = sub_index;
 			goto err;
@@ -1751,7 +1757,7 @@
 		req_sub = (struct diag_log_config_rsp_sub_t *)src_buf;
 		if (req_sub->id_valid) {
 			sub_index = diag_check_subid_mask_index(req_sub->sub_id,
-				pid);
+				0);
 			ms_ptr = diag_get_ms_ptr_index(mask_info->ms_ptr,
 				sub_index);
 			if (!ms_ptr) {
@@ -1875,7 +1881,7 @@
 		req = (struct diag_log_config_req_sub_t *)src_buf;
 		if (req->id_valid) {
 			sub_index = diag_check_subid_mask_index(req->sub_id,
-				pid);
+				0);
 			ms_ptr = diag_get_ms_ptr_index(log_mask.ms_ptr,
 				sub_index);
 			if (!ms_ptr)
@@ -1963,7 +1969,7 @@
 		read_len += sizeof(struct diag_log_config_rsp_sub_t);
 		if (req_sub->id_valid) {
 			sub_index = diag_check_subid_mask_index(req_sub->sub_id,
-				pid);
+				0);
 			ms_ptr = diag_get_ms_ptr_index(mask_info->ms_ptr,
 				sub_index);
 			if (!ms_ptr) {
@@ -2170,7 +2176,7 @@
 		req = (struct diag_log_config_rsp_sub_t *)src_buf;
 		if (req->id_valid) {
 			sub_index = diag_check_subid_mask_index(req->sub_id,
-				pid);
+				0);
 			ms_ptr = diag_get_ms_ptr_index(mask_info->ms_ptr,
 				sub_index);
 			if (!ms_ptr) {
@@ -3425,7 +3431,9 @@
 			subid = *(uint32_t *)(buf +
 				sizeof(struct diag_pkt_header_t) +
 				2*sizeof(uint8_t));
+			mutex_lock(&driver->md_session_lock);
 			subid_index = diag_check_subid_mask_index(subid, pid);
+			mutex_unlock(&driver->md_session_lock);
 		}
 		if (subid_valid && (subid_index < 0))
 			return 0;
@@ -3608,8 +3616,8 @@
 
 	diag_subid_info[i] = subid;
 
-	mutex_lock(&driver->md_session_lock);
-	info = diag_md_session_get_pid(pid);
+	if (pid)
+		info = diag_md_session_get_pid(pid);
 
 	err = diag_multisim_msg_mask_init(i, info);
 	if (err)
@@ -3621,10 +3629,8 @@
 	if (err)
 		goto fail;
 
-	mutex_unlock(&driver->md_session_lock);
 	return i;
 fail:
-	mutex_unlock(&driver->md_session_lock);
 	pr_err("diag: Could not initialize diag mask for subid: %d buffers\n",
 		subid);
 	return -ENOMEM;
diff --git a/drivers/gpu/drm/bridge/lt9611uxc.c b/drivers/gpu/drm/bridge/lt9611uxc.c
index 8c27c26..e37e770 100644
--- a/drivers/gpu/drm/bridge/lt9611uxc.c
+++ b/drivers/gpu/drm/bridge/lt9611uxc.c
@@ -125,6 +125,7 @@
 	u8 i2c_wbuf[WRITE_BUF_MAX_SIZE];
 	u8 i2c_rbuf[READ_BUF_MAX_SIZE];
 	bool hdmi_mode;
+	bool hpd_support;
 	enum lt9611_fw_upgrade_status fw_status;
 };
 
@@ -1302,7 +1303,7 @@
 	struct lt9611 *pdata = connector_to_lt9611(connector);
 
 	pdata->status = connector_status_disconnected;
-	if (force) {
+	if (force && pdata->hpd_support) {
 		lt9611_write_byte(pdata, 0xFF, 0x80);
 		lt9611_write_byte(pdata, 0xEE, 0x01);
 		lt9611_write_byte(pdata, 0xFF, 0xB0);
@@ -1668,6 +1669,7 @@
 {
 	struct lt9611 *pdata;
 	int ret = 0;
+	u8 chip_version = 0;
 
 	if (!client || !client->dev.of_node) {
 		pr_err("invalid input\n");
@@ -1730,8 +1732,12 @@
 		goto err_i2c_prog;
 	}
 
-	if (lt9611_get_version(pdata)) {
+	chip_version = lt9611_get_version(pdata);
+	pdata->hpd_support = false;
+	if (chip_version) {
 		pr_info("LT9611 works, no need to upgrade FW\n");
+		if (chip_version >= 0x40)
+			pdata->hpd_support = true;
 	} else {
 		ret = request_firmware_nowait(THIS_MODULE, true,
 			"lt9611_fw.bin", &client->dev, GFP_KERNEL, pdata,
diff --git a/drivers/gpu/msm/adreno-gpulist.h b/drivers/gpu/msm/adreno-gpulist.h
index 011267c..e0b945e 100644
--- a/drivers/gpu/msm/adreno-gpulist.h
+++ b/drivers/gpu/msm/adreno-gpulist.h
@@ -919,7 +919,7 @@
 	},
 	.prim_fifo_threshold = 0x0018000,
 	.gmu_major = 1,
-	.gmu_minor = 9,
+	.gmu_minor = 10,
 	.sqefw_name = "a630_sqe.fw",
 	.gmufw_name = "a619_gmu.bin",
 	.zap_name = "a615_zap",
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
index b57f388..1ac9bfd 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -90,7 +90,7 @@
 
 static void tmc_etb_disable_hw(struct tmc_drvdata *drvdata)
 {
-	coresight_disclaim_device(drvdata);
+	coresight_disclaim_device(drvdata->base);
 	__tmc_etb_disable_hw(drvdata);
 }
 
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
index e48a981..0fa3bd8 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -1354,6 +1354,14 @@
 	int ret = 0;
 
 	mutex_lock(&drvdata->mem_lock);
+	if (drvdata->out_mode != TMC_ETR_OUT_MODE_USB
+			|| drvdata->mode == CS_MODE_DISABLED) {
+		dev_err(&drvdata->csdev->dev,
+		"%s: ETR is not USB mode, or ETR is disabled.\n", __func__);
+		mutex_unlock(&drvdata->mem_lock);
+		return;
+	}
+
 	if (event == USB_QDSS_CONNECT) {
 		ret = tmc_etr_fill_usb_bam_data(drvdata);
 		if (ret)
diff --git a/drivers/input/touchscreen/nt36xxx/nt36xxx_mp_ctrlram.c b/drivers/input/touchscreen/nt36xxx/nt36xxx_mp_ctrlram.c
index c14b0c8..7aaf12d 100644
--- a/drivers/input/touchscreen/nt36xxx/nt36xxx_mp_ctrlram.c
+++ b/drivers/input/touchscreen/nt36xxx/nt36xxx_mp_ctrlram.c
@@ -1054,7 +1054,7 @@
 static int32_t nvt_selftest_open(struct inode *inode, struct file *file)
 {
 	struct device_node *np = ts->client->dev.of_node;
-	unsigned char mpcriteria[32] = {0};	//novatek-mp-criteria-default
+	unsigned char mpcriteria[64] = {0};	//novatek-mp-criteria-default
 
 	TestResult_Short = 0;
 	TestResult_Open = 0;
@@ -1093,7 +1093,8 @@
 		 * Ex. nvt_pid = 500A
 		 *     mpcriteria = "novatek-mp-criteria-500A"
 		 */
-		snprintf(mpcriteria, PAGE_SIZE, "novatek-mp-criteria-%04X", ts->nvt_pid);
+		snprintf(mpcriteria, sizeof(mpcriteria),
+				"novatek-mp-criteria-%04X", ts->nvt_pid);
 
 		if (nvt_mp_parse_dt(np, mpcriteria)) {
 			mutex_unlock(&ts->lock);
diff --git a/drivers/input/touchscreen/synaptics_tcm/synaptics_tcm_core.c b/drivers/input/touchscreen/synaptics_tcm/synaptics_tcm_core.c
index 610bff5..f095624 100644
--- a/drivers/input/touchscreen/synaptics_tcm/synaptics_tcm_core.c
+++ b/drivers/input/touchscreen/synaptics_tcm/synaptics_tcm_core.c
@@ -3732,11 +3732,6 @@
 	return 0;
 }
 
-static void syna_tcm_shutdown(struct platform_device *pdev)
-{
-	syna_tcm_remove(pdev);
-}
-
 #ifdef CONFIG_PM
 static const struct dev_pm_ops syna_tcm_dev_pm_ops = {
 #if !defined(CONFIG_DRM) && !defined(CONFIG_FB)
@@ -3756,7 +3751,6 @@
 	},
 	.probe = syna_tcm_probe,
 	.remove = syna_tcm_remove,
-	.shutdown = syna_tcm_shutdown,
 };
 
 static int __init syna_tcm_module_init(void)
diff --git a/drivers/media/platform/msm/npu/npu_mgr.c b/drivers/media/platform/msm/npu/npu_mgr.c
index 876dc23..d497a7f 100644
--- a/drivers/media/platform/msm/npu/npu_mgr.c
+++ b/drivers/media/platform/msm/npu/npu_mgr.c
@@ -49,7 +49,7 @@
 	int64_t id);
 static int network_get(struct npu_network *network);
 static int network_put(struct npu_network *network);
-static void app_msg_proc(struct npu_host_ctx *host_ctx, uint32_t *msg);
+static int app_msg_proc(struct npu_host_ctx *host_ctx, uint32_t *msg);
 static void log_msg_proc(struct npu_device *npu_dev, uint32_t *msg);
 static void host_session_msg_hdlr(struct npu_device *npu_dev);
 static void host_session_log_hdlr(struct npu_device *npu_dev);
@@ -1630,7 +1630,7 @@
 	return ret;
 }
 
-static void app_msg_proc(struct npu_host_ctx *host_ctx, uint32_t *msg)
+static int app_msg_proc(struct npu_host_ctx *host_ctx, uint32_t *msg)
 {
 	uint32_t msg_id;
 	struct npu_network *network = NULL;
@@ -1638,6 +1638,7 @@
 	struct npu_device *npu_dev = host_ctx->npu_dev;
 	struct npu_network_cmd *network_cmd = NULL;
 	struct npu_misc_cmd *misc_cmd = NULL;
+	int need_ctx_switch = 0;
 
 	msg_id = msg[1];
 	switch (msg_id) {
@@ -1682,7 +1683,7 @@
 				NPU_ERR("queue npu event failed\n");
 		}
 		network_put(network);
-
+		need_ctx_switch = 1;
 		break;
 	}
 	case NPU_IPC_MSG_EXECUTE_V2_DONE:
@@ -1742,6 +1743,7 @@
 			complete(&network_cmd->cmd_done);
 		}
 		network_put(network);
+		need_ctx_switch = 1;
 		break;
 	}
 	case NPU_IPC_MSG_LOAD_DONE:
@@ -1780,6 +1782,7 @@
 
 		complete(&network_cmd->cmd_done);
 		network_put(network);
+		need_ctx_switch = 1;
 		break;
 	}
 	case NPU_IPC_MSG_UNLOAD_DONE:
@@ -1812,6 +1815,7 @@
 
 		complete(&network_cmd->cmd_done);
 		network_put(network);
+		need_ctx_switch = 1;
 		break;
 	}
 	case NPU_IPC_MSG_LOOPBACK_DONE:
@@ -1832,6 +1836,7 @@
 
 		misc_cmd->ret_status = lb_rsp_pkt->header.status;
 		complete_all(&misc_cmd->cmd_done);
+		need_ctx_switch = 1;
 		break;
 	}
 	case NPU_IPC_MSG_SET_PROPERTY_DONE:
@@ -1855,6 +1860,7 @@
 
 		misc_cmd->ret_status = prop_rsp_pkt->header.status;
 		complete(&misc_cmd->cmd_done);
+		need_ctx_switch = 1;
 		break;
 	}
 	case NPU_IPC_MSG_GET_PROPERTY_DONE:
@@ -1893,6 +1899,7 @@
 		}
 
 		complete_all(&misc_cmd->cmd_done);
+		need_ctx_switch = 1;
 		break;
 	}
 	case NPU_IPC_MSG_GENERAL_NOTIFY:
@@ -1923,12 +1930,15 @@
 			msg_id);
 		break;
 	}
+
+	return need_ctx_switch;
 }
 
 static void host_session_msg_hdlr(struct npu_device *npu_dev)
 {
 	struct npu_host_ctx *host_ctx = &npu_dev->host_ctx;
 
+retry:
 	mutex_lock(&host_ctx->lock);
 	if (host_ctx->fw_state != FW_ENABLED) {
 		NPU_WARN("handle npu session msg when FW is disabled\n");
@@ -1938,7 +1948,15 @@
 	while (npu_host_ipc_read_msg(npu_dev, IPC_QUEUE_APPS_RSP,
 		host_ctx->ipc_msg_buf) == 0) {
 		NPU_DBG("received from msg queue\n");
-		app_msg_proc(host_ctx, host_ctx->ipc_msg_buf);
+		if (app_msg_proc(host_ctx, host_ctx->ipc_msg_buf)) {
+			/*
+			 * force context switch to let user
+			 * process have chance to run
+			 */
+			mutex_unlock(&host_ctx->lock);
+			usleep_range(500, 501);
+			goto retry;
+		}
 	}
 
 skip_read_msg:
@@ -2859,6 +2877,8 @@
 		exec_ioctl->stats_buf_size = 0;
 	}
 
+
+	NPU_DBG("Execute done %x\n", ret);
 free_exec_cmd:
 	npu_dequeue_network_cmd(network, exec_cmd);
 	npu_free_network_cmd(host_ctx, exec_cmd);
diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
index dddf0f5..fcda5c4 100644
--- a/drivers/media/v4l2-core/v4l2-ctrls.c
+++ b/drivers/media/v4l2-core/v4l2-ctrls.c
@@ -836,6 +836,8 @@
 	case V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_LAYER:return "H264 Number of HC Layers";
 	case V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_LAYER_QP:
 								return "H264 Set QP Value for HC Layers";
+	case V4L2_CID_MPEG_VIDEO_H264_CHROMA_QP_INDEX_OFFSET:
+					return "H264 Chroma QP Index Offset";
 	case V4L2_CID_MPEG_VIDEO_MPEG4_I_FRAME_QP:		return "MPEG4 I-Frame QP Value";
 	case V4L2_CID_MPEG_VIDEO_MPEG4_P_FRAME_QP:		return "MPEG4 P-Frame QP Value";
 	case V4L2_CID_MPEG_VIDEO_MPEG4_B_FRAME_QP:		return "MPEG4 B-Frame QP Value";
diff --git a/drivers/net/wireless/cnss2/main.h b/drivers/net/wireless/cnss2/main.h
index ea5385a..e6b4eba 100644
--- a/drivers/net/wireless/cnss2/main.h
+++ b/drivers/net/wireless/cnss2/main.h
@@ -23,6 +23,8 @@
 #define RECOVERY_TIMEOUT		60000
 #define WLAN_WD_TIMEOUT_MS		60000
 #define TIME_CLOCK_FREQ_HZ		19200000
+#define CNSS_RAMDUMP_MAGIC		0x574C414E
+#define CNSS_RAMDUMP_VERSION		0
 
 #define CNSS_EVENT_SYNC   BIT(0)
 #define CNSS_EVENT_UNINTERRUPTIBLE BIT(1)
@@ -167,6 +169,21 @@
 	CNSS_FW_IMAGE,
 	CNSS_FW_RDDM,
 	CNSS_FW_REMOTE_HEAP,
+	CNSS_FW_DUMP_TYPE_MAX,
+};
+
+struct cnss_dump_entry {
+	u32 type;
+	u32 entry_start;
+	u32 entry_num;
+};
+
+struct cnss_dump_meta_info {
+	u32 magic;
+	u32 version;
+	u32 chipset;
+	u32 total_entries;
+	struct cnss_dump_entry entry[CNSS_FW_DUMP_TYPE_MAX];
 };
 
 enum cnss_driver_event_type {
diff --git a/drivers/net/wireless/cnss2/pci.c b/drivers/net/wireless/cnss2/pci.c
index 2dd4084..9bf676c 100644
--- a/drivers/net/wireless/cnss2/pci.c
+++ b/drivers/net/wireless/cnss2/pci.c
@@ -1881,20 +1881,33 @@
 	struct cnss_dump_data *dump_data = &info_v2->dump_data;
 	struct cnss_dump_seg *dump_seg = info_v2->dump_data_vaddr;
 	struct ramdump_segment *ramdump_segs, *s;
+	struct cnss_dump_meta_info meta_info = {0};
 	int i, ret = 0;
 
 	if (!info_v2->dump_data_valid ||
 	    dump_data->nentries == 0)
 		return 0;
 
-	ramdump_segs = kcalloc(dump_data->nentries,
+	ramdump_segs = kcalloc(dump_data->nentries + 1,
 			       sizeof(*ramdump_segs),
 			       GFP_KERNEL);
 	if (!ramdump_segs)
 		return -ENOMEM;
 
-	s = ramdump_segs;
+	s = ramdump_segs + 1;
 	for (i = 0; i < dump_data->nentries; i++) {
+		if (dump_seg->type >= CNSS_FW_DUMP_TYPE_MAX) {
+			cnss_pr_err("Unsupported dump type: %d",
+				    dump_seg->type);
+			continue;
+		}
+
+		if (meta_info.entry[dump_seg->type].entry_start == 0) {
+			meta_info.entry[dump_seg->type].type = dump_seg->type;
+			meta_info.entry[dump_seg->type].entry_start = i + 1;
+		}
+		meta_info.entry[dump_seg->type].entry_num++;
+
 		s->address = dump_seg->address;
 		s->v_address = dump_seg->v_address;
 		s->size = dump_seg->size;
@@ -1902,8 +1915,16 @@
 		dump_seg++;
 	}
 
+	meta_info.magic = CNSS_RAMDUMP_MAGIC;
+	meta_info.version = CNSS_RAMDUMP_VERSION;
+	meta_info.chipset = pci_priv->device_id;
+	meta_info.total_entries = CNSS_FW_DUMP_TYPE_MAX;
+
+	ramdump_segs->v_address = &meta_info;
+	ramdump_segs->size = sizeof(meta_info);
+
 	ret = do_elf_ramdump(info_v2->ramdump_dev, ramdump_segs,
-			     dump_data->nentries);
+			     dump_data->nentries + 1);
 	kfree(ramdump_segs);
 
 	cnss_pci_clear_dump_info(pci_priv);
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c
index 3d780fa..965e48a 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipahal/ipahal.c
@@ -1424,7 +1424,7 @@
 		ctx->hdr_add.tlv.type = IPA_PROC_CTX_TLV_TYPE_HDR_ADD;
 		ctx->hdr_add.tlv.length = 2;
 		ctx->hdr_add.tlv.value = hdr_len;
-		ctx->hdr_add.hdr_addr = is_hdr_proc_ctx ? phys_base :
+		hdr_addr = is_hdr_proc_ctx ? phys_base :
 			hdr_base_addr + offset_entry->offset;
 		IPAHAL_DBG("header address 0x%x\n",
 			ctx->hdr_add.hdr_addr);
diff --git a/drivers/power/supply/qcom/qpnp-fg-gen4.c b/drivers/power/supply/qcom/qpnp-fg-gen4.c
index dac6aaf..9c179be 100644
--- a/drivers/power/supply/qcom/qpnp-fg-gen4.c
+++ b/drivers/power/supply/qcom/qpnp-fg-gen4.c
@@ -6373,12 +6373,7 @@
 	/* Keep MEM_ATTN_IRQ disabled until we require it */
 	vote(chip->mem_attn_irq_en_votable, MEM_ATTN_IRQ_VOTER, false, 0);
 
-	rc = fg_debugfs_create(fg);
-	if (rc < 0) {
-		dev_err(fg->dev, "Error in creating debugfs entries, rc:%d\n",
-			rc);
-		goto exit;
-	}
+	fg_debugfs_create(fg);
 
 	rc = sysfs_create_groups(&fg->dev->kobj, fg_groups);
 	if (rc < 0) {
diff --git a/drivers/power/supply/qcom/smblite-lib.c b/drivers/power/supply/qcom/smblite-lib.c
index aa3da50..5c127f0 100644
--- a/drivers/power/supply/qcom/smblite-lib.c
+++ b/drivers/power/supply/qcom/smblite-lib.c
@@ -2892,23 +2892,23 @@
 	}
 
 	if (stat & DIE_TEMP_UB_BIT) {
-		icl_ua = get_effective_result(chg->usb_icl_votable)
-				- THERM_REGULATION_STEP_UA;
-
-		/* Decrement ICL by one step */
-		vote(chg->usb_icl_votable, SW_THERM_REGULATION_VOTER,
-				true, icl_ua - THERM_REGULATION_STEP_UA);
-
 		/* Check if we reached minimum ICL limit */
 		if (icl_ua < USBIN_500UA + THERM_REGULATION_STEP_UA)
 			goto exit;
 
+		/* Decrement ICL by one step */
+		icl_ua -= THERM_REGULATION_STEP_UA;
+		vote(chg->usb_icl_votable, SW_THERM_REGULATION_VOTER,
+				true, icl_ua);
+
 		goto reschedule;
 	}
 
-	if (stat & DIE_TEMP_LB_BIT) {
+	/* check if DIE_TEMP is below LB */
+	if (!(stat & DIE_TEMP_MASK)) {
+		icl_ua += THERM_REGULATION_STEP_UA;
 		vote(chg->usb_icl_votable, SW_THERM_REGULATION_VOTER,
-				true, icl_ua + THERM_REGULATION_STEP_UA);
+				true, icl_ua);
 
 		/*
 		 * Check if we need further increments:
diff --git a/drivers/power/supply/qcom/smblite-reg.h b/drivers/power/supply/qcom/smblite-reg.h
index 199922e..361d0c2f 100644
--- a/drivers/power/supply/qcom/smblite-reg.h
+++ b/drivers/power/supply/qcom/smblite-reg.h
@@ -266,6 +266,7 @@
 #define THERMREG_DISABLED_BIT			BIT(0)
 
 #define DIE_TEMP_STATUS_REG			(MISC_BASE + 0x09)
+#define DIE_TEMP_MASK				GENMASK(3, 0)
 #define DIE_TEMP_SHDN_BIT			BIT(3)
 #define DIE_TEMP_RST_BIT			BIT(2)
 #define DIE_TEMP_UB_BIT				BIT(1)
diff --git a/drivers/soc/qcom/dcc_v2.c b/drivers/soc/qcom/dcc_v2.c
index a5e2ec0..ada4be8 100644
--- a/drivers/soc/qcom/dcc_v2.c
+++ b/drivers/soc/qcom/dcc_v2.c
@@ -719,6 +719,7 @@
 	int ret = 0;
 	int list;
 	uint32_t ram_cfg_base;
+	uint32_t hw_info;
 
 	mutex_lock(&drvdata->mutex);
 
@@ -754,6 +755,10 @@
 				drvdata->ram_offset/4, DCC_FD_BASE(list));
 		dcc_writel(drvdata, 0xFFF, DCC_LL_TIMEOUT(list));
 
+		hw_info = dcc_readl(drvdata, DCC_HW_INFO);
+		if (hw_info & 0x80)
+			dcc_writel(drvdata, 0x3F, DCC_TRANS_TIMEOUT(list));
+
 		/* 4. Clears interrupt status register */
 		dcc_writel(drvdata, 0, DCC_LL_INT_ENABLE(list));
 		dcc_writel(drvdata, (BIT(0) | BIT(1) | BIT(2)),
diff --git a/drivers/soc/qcom/eud.c b/drivers/soc/qcom/eud.c
index 0ee43a8..864bd65 100644
--- a/drivers/soc/qcom/eud.c
+++ b/drivers/soc/qcom/eud.c
@@ -92,6 +92,14 @@
 static bool eud_ready;
 static struct platform_device *eud_private;
 
+static int check_eud_mode_mgr2(struct eud_chip *chip)
+{
+	u32 val;
+
+	val = scm_io_read(chip->eud_mode_mgr2_phys_base);
+	return val & BIT(0);
+}
+
 static void enable_eud(struct platform_device *pdev)
 {
 	struct eud_chip *priv = platform_get_drvdata(pdev);
@@ -105,7 +113,7 @@
 			priv->eud_reg_base + EUD_REG_INT1_EN_MASK);
 
 	/* Enable secure eud if supported */
-	if (priv->secure_eud_en) {
+	if (priv->secure_eud_en && !check_eud_mode_mgr2(priv)) {
 		ret = scm_io_write(priv->eud_mode_mgr2_phys_base +
 				   EUD_REG_EUD_EN2, EUD_ENABLE_CMD);
 		if (ret)
@@ -564,6 +572,9 @@
 		}
 
 		chip->eud_mode_mgr2_phys_base = res->start;
+
+		if (check_eud_mode_mgr2(chip))
+			enable = 1;
 	}
 
 	chip->need_phy_clk_vote = of_property_read_bool(pdev->dev.of_node,
diff --git a/drivers/soc/qcom/qdss_bridge.c b/drivers/soc/qcom/qdss_bridge.c
index 4d15790..92af4dcb6 100644
--- a/drivers/soc/qcom/qdss_bridge.c
+++ b/drivers/soc/qcom/qdss_bridge.c
@@ -449,8 +449,12 @@
 {
 	struct qdss_bridge_drvdata *drvdata = priv;
 
-	if (!drvdata)
+	if (!drvdata || drvdata->mode != MHI_TRANSFER_TYPE_USB
+			|| drvdata->opened == DISABLE) {
+		pr_err_ratelimited("%s can't be called in invalid status.\n",
+				__func__);
 		return;
+	}
 
 	switch (event) {
 	case USB_QDSS_CONNECT:
diff --git a/drivers/tty/serial/msm_geni_serial.c b/drivers/tty/serial/msm_geni_serial.c
index f739273..462ab9a 100644
--- a/drivers/tty/serial/msm_geni_serial.c
+++ b/drivers/tty/serial/msm_geni_serial.c
@@ -10,6 +10,7 @@
 #include <linux/console.h>
 #include <linux/io.h>
 #include <linux/ipc_logging.h>
+#include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
@@ -800,8 +801,8 @@
 		 * Failure IPC logs are not added as this API is
 		 * used by early console and it doesn't have log handle.
 		 */
-		geni_write_reg(S_GENI_CMD_CANCEL, uport->membase,
-						SE_GENI_S_CMD_CTRL_REG);
+		geni_write_reg(M_GENI_CMD_CANCEL, uport->membase,
+						SE_GENI_M_CMD_CTRL_REG);
 		done = msm_geni_serial_poll_bit(uport, SE_GENI_M_IRQ_STATUS,
 						M_CMD_CANCEL_EN, true);
 		if (!done) {
@@ -2020,6 +2021,7 @@
 	/* Stop the console before stopping the current tx */
 	if (uart_console(uport)) {
 		console_stop(uport->cons);
+		disable_irq(uport->irq);
 	} else {
 		msm_geni_serial_power_on(uport);
 		wait_for_transfers_inflight(uport);
@@ -2178,6 +2180,16 @@
 	 */
 	mb();
 
+	/* Console usecase requires irq to be in enable state after early
+	 * console switch from probe to handle RX data. Hence enable IRQ
+	 * from starup and disable it form shutdown APIs for cosnole case.
+	 * BT HSUART usecase, IRQ will be enabled from runtime_resume()
+	 * and disabled in runtime_suspend to avoid spurious interrupts
+	 * after suspend.
+	 */
+	if (uart_console(uport))
+		enable_irq(uport->irq);
+
 	if (msm_port->wakeup_irq > 0) {
 		ret = request_irq(msm_port->wakeup_irq, msm_geni_wakeup_isr,
 				IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
@@ -3152,6 +3164,7 @@
 
 	dev_port->name = devm_kasprintf(uport->dev, GFP_KERNEL,
 					"msm_serial_geni%d", uport->line);
+	irq_set_status_flags(uport->irq, IRQ_NOAUTOEN);
 	ret = devm_request_irq(uport->dev, uport->irq, msm_geni_serial_isr,
 				IRQF_TRIGGER_HIGH, dev_port->name, uport);
 	if (ret) {
@@ -3159,12 +3172,6 @@
 							__func__, ret);
 		goto exit_geni_serial_probe;
 	}
-	/*
-	 * Console usecase requires irq to be in enable state to handle RX data.
-	 * disable irq only for HSUART case from here.
-	 */
-	if (!is_console)
-		disable_irq(dev_port->uport.irq);
 
 	uport->private_data = (void *)drv;
 	platform_set_drvdata(pdev, dev_port);
@@ -3188,11 +3195,6 @@
 
 	dev_info(&pdev->dev, "Serial port%d added.FifoSize %d is_console%d\n",
 				line, uport->fifosize, is_console);
-	/*
-	 * We are using this spinlock before the serial layer initialises it.
-	 * Hence, we are initializing it.
-	 */
-	spin_lock_init(&uport->lock);
 
 	device_create_file(uport->dev, &dev_attr_loopback);
 	device_create_file(uport->dev, &dev_attr_xfer_mode);
diff --git a/drivers/usb/gadget/function/f_qdss.c b/drivers/usb/gadget/function/f_qdss.c
index 329bee7..e5c179b 100644
--- a/drivers/usb/gadget/function/f_qdss.c
+++ b/drivers/usb/gadget/function/f_qdss.c
@@ -960,6 +960,7 @@
 	usb_qdss_free_req(ch);
 close:
 	ch->priv_usb = NULL;
+	ch->notify = NULL;
 	if (!qdss || !qdss->usb_connected ||
 			!strcmp(qdss->ch.name, USB_QDSS_CH_MDM)) {
 		ch->app_conn = 0;
diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index 670da21..3a02d79 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -1216,21 +1216,19 @@
 		goto retry_flush_quotas;
 	}
 
-retry_flush_nodes:
 	down_write(&sbi->node_write);
 
 	if (get_pages(sbi, F2FS_DIRTY_NODES)) {
 		up_write(&sbi->node_write);
+		up_write(&sbi->node_change);
+		f2fs_unlock_all(sbi);
 		atomic_inc(&sbi->wb_sync_req[NODE]);
 		err = f2fs_sync_node_pages(sbi, &wbc, false, FS_CP_NODE_IO);
 		atomic_dec(&sbi->wb_sync_req[NODE]);
-		if (err) {
-			up_write(&sbi->node_change);
-			f2fs_unlock_all(sbi);
+		if (err)
 			goto out;
-		}
 		cond_resched();
-		goto retry_flush_nodes;
+		goto retry_flush_quotas;
 	}
 
 	/*
diff --git a/gen_headers_arm.bp b/gen_headers_arm.bp
index b1c03a2..65319b0 100644
--- a/gen_headers_arm.bp
+++ b/gen_headers_arm.bp
@@ -638,6 +638,7 @@
     "linux/xilinx-v4l2-controls.h",
     "linux/zorro.h",
     "linux/zorro_ids.h",
+    "linux/fscrypt.h",
     "media/msm_cvp_private.h",
     "media/msm_cvp_utils.h",
     "media/msm_media_info.h",
diff --git a/gen_headers_arm64.bp b/gen_headers_arm64.bp
index 6d7fc02..3e1627b 100644
--- a/gen_headers_arm64.bp
+++ b/gen_headers_arm64.bp
@@ -632,6 +632,7 @@
     "linux/xilinx-v4l2-controls.h",
     "linux/zorro.h",
     "linux/zorro_ids.h",
+    "linux/fscrypt.h",
     "media/msm_cvp_private.h",
     "media/msm_cvp_utils.h",
     "media/msm_media_info.h",
diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
index 0d16050..f605007 100644
--- a/include/uapi/linux/v4l2-controls.h
+++ b/include/uapi/linux/v4l2-controls.h
@@ -543,6 +543,7 @@
 };
 #define V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_LAYER	(V4L2_CID_MPEG_BASE+381)
 #define V4L2_CID_MPEG_VIDEO_H264_HIERARCHICAL_CODING_LAYER_QP	(V4L2_CID_MPEG_BASE+382)
+#define V4L2_CID_MPEG_VIDEO_H264_CHROMA_QP_INDEX_OFFSET	(V4L2_CID_MPEG_BASE+384)
 #define V4L2_CID_MPEG_VIDEO_MPEG4_I_FRAME_QP	(V4L2_CID_MPEG_BASE+400)
 #define V4L2_CID_MPEG_VIDEO_MPEG4_P_FRAME_QP	(V4L2_CID_MPEG_BASE+401)
 #define V4L2_CID_MPEG_VIDEO_MPEG4_B_FRAME_QP	(V4L2_CID_MPEG_BASE+402)
@@ -1002,9 +1003,6 @@
 	V4L2_CID_MPEG_VIDC_VIDEO_ROI_TYPE_2BYTE = 2,
 };
 
-#define V4L2_CID_MPEG_VIDC_VENC_CHROMA_QP_OFFSET \
-	(V4L2_CID_MPEG_MSM_VIDC_BASE + 132)
-
 /*  Camera class control IDs */
 
 #define V4L2_CID_CAMERA_CLASS_BASE	(V4L2_CTRL_CLASS_CAMERA | 0x900)