Merge "ARM: dts: msm: Update DMIC clock frequency for VA usecase on Kona"
diff --git a/Documentation/devicetree/bindings/platform/msm/ipa.txt b/Documentation/devicetree/bindings/platform/msm/ipa.txt
index 344ef92..cd279fd 100644
--- a/Documentation/devicetree/bindings/platform/msm/ipa.txt
+++ b/Documentation/devicetree/bindings/platform/msm/ipa.txt
@@ -28,7 +28,7 @@
 - qcom,lan-rx-ring-size: size of LAN rx ring, default is 192
 - qcom,arm-smmu: SMMU is present and ARM SMMU driver is used
 - qcom,msm-smmu: SMMU is present and QSMMU driver is used
-- qcom,smmu-fast-map: Boolean context flag to set SMMU to fastpath mode
+- qcom,iommu-dma = "fastmap": Context flag to set SMMU to fastpath mode
 - ipa_smmu_ap: AP general purpose SMMU device
 	compatible "qcom,ipa-smmu-ap-cb"
 - ipa_smmu_wlan: WDI SMMU device
@@ -140,13 +140,13 @@
 -compatible: "qcom,ipa-smmu-uc-cb" - represents IPA uC context bank (for uC
 					offload scenarios).
 
-- qcom,smmu-s1-bypass: Boolean context flag to set SMMU to S1 bypass.
+- qcom,iommu-dma = "bypass": Context flag to set SMMU to S1 bypass.
 
 - dma-coherent: Indicate using dma-coherent or not in SMMU block
 
 - iommus : the phandle and stream IDs for the SMMU used by this root
 
-- qcom,iova-mapping: specifies the start address and size of iova space.
+- qcom,iommu-dma-addr-pool: specifies the start address and size of iova space.
 
 - qcom,additional-mapping: specifies any addtional mapping needed for this
 				context bank. The format is <iova pa size>
@@ -195,7 +195,7 @@
 	ipa_smmu_ap: ipa_smmu_ap {
 		compatible = "qcom,ipa-smmu-ap-cb";
 		iommus = <&apps_smmu 0x720>;
-		qcom,iova-mapping = <0x20000000 0x40000000>;
+		qcom,iommu-dma-addr-pool = <0x20000000 0x40000000>;
 		qcom,additional-mapping =
 		/* modem tables in IMEM */
 		<0x146bd000 0x146bd000 0x2000>;
@@ -212,6 +212,6 @@
 	ipa_smmu_uc: ipa_smmu_uc {
 		compatible = "qcom,ipa-smmu-uc-cb";
 		iommus = <&apps_smmu 0x722>;
-		qcom,iova-mapping = <0x40000000 0x20000000>;
+		qcom,iommu-dma-addr-pool = <0x40000000 0x20000000>;
 	};
 };
diff --git a/arch/arm64/boot/dts/qcom/kona-camera-sensor-cdp.dtsi b/arch/arm64/boot/dts/qcom/kona-camera-sensor-cdp.dtsi
index 8174da3..084610d 100644
--- a/arch/arm64/boot/dts/qcom/kona-camera-sensor-cdp.dtsi
+++ b/arch/arm64/boot/dts/qcom/kona-camera-sensor-cdp.dtsi
@@ -616,7 +616,7 @@
 		rgltr-cntrl-support;
 		rgltr-min-voltage = <0 3600000 0>;
 		rgltr-max-voltage = <0 3600000 0>;
-		rgltr-load-current = <0 1200000 0>;
+		rgltr-load-current = <150000 120000 0>;
 		gpio-no-mux = <0>;
 		pinctrl-names = "cam_default", "cam_suspend";
 		pinctrl-0 = <&cam_sensor_mclk3_active
diff --git a/arch/arm64/boot/dts/qcom/kona-camera-sensor-mtp.dtsi b/arch/arm64/boot/dts/qcom/kona-camera-sensor-mtp.dtsi
index 677e0ed..a1858f2 100644
--- a/arch/arm64/boot/dts/qcom/kona-camera-sensor-mtp.dtsi
+++ b/arch/arm64/boot/dts/qcom/kona-camera-sensor-mtp.dtsi
@@ -617,7 +617,7 @@
 		rgltr-cntrl-support;
 		rgltr-min-voltage = <0 3600000 0>;
 		rgltr-max-voltage = <0 3600000 0>;
-		rgltr-load-current = <0 1200000 0>;
+		rgltr-load-current = <150000 120000 0>;
 		gpio-no-mux = <0>;
 		pinctrl-names = "cam_default", "cam_suspend";
 		pinctrl-0 = <&cam_sensor_mclk3_active
diff --git a/arch/arm64/boot/dts/qcom/kona-camera-sensor-qrd.dtsi b/arch/arm64/boot/dts/qcom/kona-camera-sensor-qrd.dtsi
index 6792d3c..a17e182 100644
--- a/arch/arm64/boot/dts/qcom/kona-camera-sensor-qrd.dtsi
+++ b/arch/arm64/boot/dts/qcom/kona-camera-sensor-qrd.dtsi
@@ -617,7 +617,7 @@
 		rgltr-cntrl-support;
 		rgltr-min-voltage = <0 3600000 0>;
 		rgltr-max-voltage = <0 3600000 0>;
-		rgltr-load-current = <0 1200000 0>;
+		rgltr-load-current = <150000 120000 0>;
 		gpio-no-mux = <0>;
 		pinctrl-names = "cam_default", "cam_suspend";
 		pinctrl-0 = <&cam_sensor_mclk3_active
diff --git a/arch/arm64/boot/dts/qcom/kona-npu.dtsi b/arch/arm64/boot/dts/qcom/kona-npu.dtsi
index bf79abb..e704a2e 100644
--- a/arch/arm64/boot/dts/qcom/kona-npu.dtsi
+++ b/arch/arm64/boot/dts/qcom/kona-npu.dtsi
@@ -10,12 +10,15 @@
 		reg = <0x9900000 0x20000>,
 			<0x99F0000 0x10000>,
 			<0x9800000 0x100000>,
+			<0x9980000 0x10000>,
 			<0x17c00000 0x10000>;
-		reg-names = "tcm", "core", "qdsp", "apss_shared";
-		interrupts = <GIC_SPI 364 IRQ_TYPE_EDGE_RISING>,
+		reg-names = "tcm", "core", "qdsp", "cc", "apss_shared";
+		interrupts = <GIC_SPI 364 IRQ_TYPE_LEVEL_HIGH>,
 				<GIC_SPI 366 IRQ_TYPE_EDGE_RISING>,
-				<GIC_SPI 368 IRQ_TYPE_EDGE_RISING>;
-		interrupt-names = "error_irq", "wdg_bite_irq", "ipc_irq";
+				<GIC_SPI 368 IRQ_TYPE_EDGE_RISING>,
+				<GIC_SPI 365 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "error_irq", "wdg_bite_irq", "ipc_irq",
+					"general_irq";
 		iommus = <&apps_smmu 0x1081 0x400>, <&apps_smmu 0x1082 0x400>,
 			<&apps_smmu 0x10A1 0x400>, <&apps_smmu 0x10A2 0x400>;
 
diff --git a/arch/arm64/boot/dts/qcom/kona-pcie.dtsi b/arch/arm64/boot/dts/qcom/kona-pcie.dtsi
index 694c5fc..25e8f42 100644
--- a/arch/arm64/boot/dts/qcom/kona-pcie.dtsi
+++ b/arch/arm64/boot/dts/qcom/kona-pcie.dtsi
@@ -71,14 +71,13 @@
 			<&clock_gcc GCC_PCIE_0_SLV_Q2A_AXI_CLK>,
 			<&clock_gcc GCC_AGGRE_NOC_PCIE_TBU_CLK>,
 			<&clock_gcc GCC_PCIE0_PHY_REFGEN_CLK>,
-			<&clock_gcc GCC_PCIE_PHY_AUX_CLK>,
 			<&clock_gcc GCC_DDRSS_PCIE_SF_TBU_CLK>;
 		clock-names = "pcie_0_pipe_clk", "pcie_0_ref_clk_src",
 				"pcie_0_aux_clk", "pcie_0_cfg_ahb_clk",
 				"pcie_0_mstr_axi_clk", "pcie_0_slv_axi_clk",
 				"pcie_0_ldo", "pcie_0_slv_q2a_axi_clk",
 				"pcie_tbu_clk", "pcie_phy_refgen_clk",
-				"pcie_phy_aux_clk", "pcie_ddrss_sf_tbu_clk";
+				"pcie_ddrss_sf_tbu_clk";
 		max-clock-frequency-hz = <0>, <0>, <19200000>, <0>, <0>, <0>,
 					<0>, <0>, <0>, <0>, <100000000>, <0>;
 
@@ -311,14 +310,13 @@
 			<&clock_gcc GCC_PCIE_1_SLV_Q2A_AXI_CLK>,
 			<&clock_gcc GCC_AGGRE_NOC_PCIE_TBU_CLK>,
 			<&clock_gcc GCC_PCIE1_PHY_REFGEN_CLK>,
-			<&clock_gcc GCC_PCIE_PHY_AUX_CLK>,
 			<&clock_gcc GCC_DDRSS_PCIE_SF_TBU_CLK>;
 		clock-names = "pcie_1_pipe_clk", "pcie_1_ref_clk_src",
 				"pcie_1_aux_clk", "pcie_1_cfg_ahb_clk",
 				"pcie_1_mstr_axi_clk", "pcie_1_slv_axi_clk",
 				"pcie_1_ldo", "pcie_1_slv_q2a_axi_clk",
 				"pcie_tbu_clk", "pcie_phy_refgen_clk",
-				"pcie_phy_aux_clk", "pcie_ddrss_sf_tbu_clk";
+				"pcie_ddrss_sf_tbu_clk";
 		max-clock-frequency-hz = <0>, <0>, <19200000>, <0>, <0>, <0>,
 					<0>, <0>, <0>, <0>, <100000000>, <0>;
 
@@ -590,14 +588,13 @@
 			<&clock_gcc GCC_PCIE_2_SLV_Q2A_AXI_CLK>,
 			<&clock_gcc GCC_AGGRE_NOC_PCIE_TBU_CLK>,
 			<&clock_gcc GCC_PCIE2_PHY_REFGEN_CLK>,
-			<&clock_gcc GCC_PCIE_PHY_AUX_CLK>,
 			<&clock_gcc GCC_DDRSS_PCIE_SF_TBU_CLK>;
 		clock-names = "pcie_2_pipe_clk", "pcie_2_ref_clk_src",
 				"pcie_2_aux_clk", "pcie_2_cfg_ahb_clk",
 				"pcie_2_mstr_axi_clk", "pcie_2_slv_axi_clk",
 				"pcie_2_ldo", "pcie_2_slv_q2a_axi_clk",
 				"pcie_tbu_clk", "pcie_phy_refgen_clk",
-				"pcie_phy_aux_clk", "pcie_ddrss_sf_tbu_clk";
+				"pcie_ddrss_sf_tbu_clk";
 		max-clock-frequency-hz = <0>, <0>, <19200000>, <0>, <0>, <0>,
 					<0>, <0>, <0>, <0>, <100000000>, <0>;
 
diff --git a/arch/arm64/boot/dts/qcom/kona.dtsi b/arch/arm64/boot/dts/qcom/kona.dtsi
index ddc5e4c..1307ebd 100644
--- a/arch/arm64/boot/dts/qcom/kona.dtsi
+++ b/arch/arm64/boot/dts/qcom/kona.dtsi
@@ -2385,25 +2385,25 @@
 		ipa_smmu_ap: ipa_smmu_ap {
 			compatible = "qcom,ipa-smmu-ap-cb";
 			iommus = <&apps_smmu 0x5C0 0x0>;
-			qcom,iova-mapping = <0x20000000 0x40000000>;
+			qcom,iommu-dma-addr-pool = <0x20000000 0x40000000>;
 			qcom,additional-mapping =
 				/* modem tables in IMEM */
 				<0x146BD000 0x146BD000 0x2000>;
 			dma-coherent;
-			qcom,iommu-dma = "disabled";
+			qcom,iommu-dma = "fastmap";
 		};
 
 		ipa_smmu_wlan: ipa_smmu_wlan {
 			compatible = "qcom,ipa-smmu-wlan-cb";
 			iommus = <&apps_smmu 0x5C1 0x0>;
-			qcom,iommu-dma = "disabled";
+			qcom,iommu-dma = "fastmap";
 		};
 
 		ipa_smmu_uc: ipa_smmu_uc {
 			compatible = "qcom,ipa-smmu-uc-cb";
 			iommus = <&apps_smmu 0x5C2 0x0>;
-			qcom,iova-mapping = <0x40000000 0x20000000>;
-			qcom,iommu-dma = "disabled";
+			qcom,iommu-dma-addr-pool = <0x40000000 0x20000000>;
+			qcom,iommu-dma = "fastmap";
 		};
 
 		ipa_smmu_11ad: ipa_smmu_11ad {
diff --git a/arch/arm64/boot/dts/qcom/lito-thermal.dtsi b/arch/arm64/boot/dts/qcom/lito-thermal.dtsi
new file mode 100644
index 0000000..f288882
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/lito-thermal.dtsi
@@ -0,0 +1,386 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ */
+
+#include <dt-bindings/thermal/thermal.h>
+
+&thermal_zones {
+	aoss0-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-governor = "user_space";
+		thermal-sensors = <&tsens0 0>;
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-0-0-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-governor = "user_space";
+		thermal-sensors = <&tsens0 1>;
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-0-1-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-governor = "user_space";
+		thermal-sensors = <&tsens0 2>;
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-0-2-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-governor = "user_space";
+		thermal-sensors = <&tsens0 3>;
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-0-3-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 4>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-0-4-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 5>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-0-5-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 6>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpuss-0-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 7>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpuss-1-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 8>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-1-0-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 9>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-1-1-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 10>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-1-2-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 11>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cpu-1-3-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 12>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	gpuss-0-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 13>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	gpuss-1-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens0 14>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	aoss-1-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 0>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cwlan-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 1>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	video-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 2>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	ddr-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 3>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	q6-hvx-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 4>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	cmpss-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 5>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	npu-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 6>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	camera-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 7>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	mdm-vec-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 8>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	mdm-scl-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 9>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	mdm-core-0-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-sensors = <&tsens1 10>;
+		thermal-governor = "user_space";
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+
+	mdm-core-1-usr {
+		polling-delay-passive = <0>;
+		polling-delay = <0>;
+		thermal-governor = "user_space";
+		thermal-sensors = <&tsens1 11>;
+		trips {
+			active-config0 {
+				temperature = <125000>;
+				hysteresis = <1000>;
+				type = "passive";
+			};
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/lito.dtsi b/arch/arm64/boot/dts/qcom/lito.dtsi
index 595f166..30f6a37 100644
--- a/arch/arm64/boot/dts/qcom/lito.dtsi
+++ b/arch/arm64/boot/dts/qcom/lito.dtsi
@@ -528,6 +528,9 @@
 	ranges = <0 0 0 0xffffffff>;
 	compatible = "simple-bus";
 
+	thermal_zones: thermal-zones {
+	};
+
 	intc: interrupt-controller@17a00000 {
 		compatible = "arm,gic-v3";
 		#interrupt-cells = <3>;
@@ -852,6 +855,30 @@
 		qcom,pipe-attr-ee;
 	};
 
+	tsens0: tsens@c222000 {
+		compatible = "qcom,tsens24xx";
+		reg = <0xc222000 0x8>,
+			<0xc263000 0x1ff>;
+		reg-names = "tsens_srot_physical",
+				"tsens_tm_physical";
+		interrupts = <&pdc 26 IRQ_TYPE_LEVEL_HIGH>,
+				<&pdc 28 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		#thermal-sensor-cells = <1>;
+	};
+
+	tsens1: tsens@c223000 {
+		compatible = "qcom,tsens24xx";
+		reg = <0xc223000 0x8>,
+			<0xc265000 0x1ff>;
+		reg-names = "tsens_srot_physical",
+			"tsens_tm_physical";
+		interrupts = <&pdc 27 IRQ_TYPE_LEVEL_HIGH>,
+				<&pdc 29 IRQ_TYPE_LEVEL_HIGH>;
+		interrupt-names = "tsens-upper-lower", "tsens-critical";
+		#thermal-sensor-cells = <1>;
+	};
+
 	qcom,ghd {
 		compatible = "qcom,gladiator-hang-detect-v3";
 		qcom,threshold-arr = <0x17e0041c>;
diff --git a/arch/arm64/configs/vendor/kona-perf_defconfig b/arch/arm64/configs/vendor/kona-perf_defconfig
index c94c35a..c8d48da 100644
--- a/arch/arm64/configs/vendor/kona-perf_defconfig
+++ b/arch/arm64/configs/vendor/kona-perf_defconfig
@@ -227,6 +227,7 @@
 CONFIG_NET_SCH_HTB=y
 CONFIG_NET_SCH_PRIO=y
 CONFIG_NET_SCH_MULTIQ=y
+CONFIG_NET_SCH_NETEM=y
 CONFIG_NET_SCH_INGRESS=y
 CONFIG_NET_CLS_FW=y
 CONFIG_NET_CLS_U32=y
@@ -314,6 +315,16 @@
 CONFIG_INPUT_EVDEV=y
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_XPAD=y
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_INPUT_TABLET=y
+CONFIG_TABLET_USB_ACECAD=y
+CONFIG_TABLET_USB_AIPTEK=y
+CONFIG_TABLET_USB_GTCO=y
+CONFIG_TABLET_USB_HANWANG=y
+CONFIG_TABLET_USB_KBTAB=y
 CONFIG_INPUT_TOUCHSCREEN=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_QPNP_POWER_ON=y
@@ -413,7 +424,7 @@
 CONFIG_HID_MULTITOUCH=y
 CONFIG_HID_PLANTRONICS=y
 CONFIG_HID_QVR=y
-CONFIG_USB=y
+CONFIG_USB_HIDDEV=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
@@ -604,10 +615,13 @@
 CONFIG_EXT4_ENCRYPTION=y
 CONFIG_EXT4_FS_ENCRYPTION=y
 CONFIG_EXT4_FS_ICE_ENCRYPTION=y
+CONFIG_F2FS_FS=y
+CONFIG_F2FS_FS_SECURITY=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V2=y
 CONFIG_FUSE_FS=y
+CONFIG_OVERLAY_FS=y
 CONFIG_MSDOS_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
diff --git a/arch/arm64/configs/vendor/kona_defconfig b/arch/arm64/configs/vendor/kona_defconfig
index 99d924a..5ccba2d 100644
--- a/arch/arm64/configs/vendor/kona_defconfig
+++ b/arch/arm64/configs/vendor/kona_defconfig
@@ -89,6 +89,7 @@
 CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
 CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
 CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y
+CONFIG_KPROBES=y
 CONFIG_PANIC_ON_REFCOUNT_ERROR=y
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -233,6 +234,7 @@
 CONFIG_NET_SCH_HTB=y
 CONFIG_NET_SCH_PRIO=y
 CONFIG_NET_SCH_MULTIQ=y
+CONFIG_NET_SCH_NETEM=y
 CONFIG_NET_SCH_INGRESS=y
 CONFIG_NET_CLS_FW=y
 CONFIG_NET_CLS_U32=y
@@ -309,6 +311,7 @@
 CONFIG_PPTP=y
 CONFIG_PPPOL2TP=y
 CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
 CONFIG_WIL6210=m
 CONFIG_CLD_LL_CORE=y
 CONFIG_CNSS2=y
@@ -321,6 +324,15 @@
 CONFIG_KEYBOARD_GPIO=y
 # CONFIG_INPUT_MOUSE is not set
 CONFIG_INPUT_JOYSTICK=y
+CONFIG_JOYSTICK_XPAD=y
+CONFIG_JOYSTICK_XPAD_FF=y
+CONFIG_JOYSTICK_XPAD_LEDS=y
+CONFIG_INPUT_TABLET=y
+CONFIG_TABLET_USB_ACECAD=y
+CONFIG_TABLET_USB_AIPTEK=y
+CONFIG_TABLET_USB_GTCO=y
+CONFIG_TABLET_USB_HANWANG=y
+CONFIG_TABLET_USB_KBTAB=y
 CONFIG_INPUT_TOUCHSCREEN=y
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_QPNP_POWER_ON=y
@@ -424,7 +436,7 @@
 CONFIG_HID_MULTITOUCH=y
 CONFIG_HID_PLANTRONICS=y
 CONFIG_HID_QVR=y
-CONFIG_USB=y
+CONFIG_USB_HIDDEV=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
@@ -626,10 +638,13 @@
 CONFIG_EXT4_ENCRYPTION=y
 CONFIG_EXT4_FS_ENCRYPTION=y
 CONFIG_EXT4_FS_ICE_ENCRYPTION=y
+CONFIG_F2FS_FS=y
+CONFIG_F2FS_FS_SECURITY=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V2=y
 CONFIG_FUSE_FS=y
+CONFIG_OVERLAY_FS=y
 CONFIG_MSDOS_FS=y
 CONFIG_VFAT_FS=y
 CONFIG_TMPFS=y
diff --git a/arch/arm64/configs/vendor/lito-perf_defconfig b/arch/arm64/configs/vendor/lito-perf_defconfig
index 4d0e4b8..e122c8c 100644
--- a/arch/arm64/configs/vendor/lito-perf_defconfig
+++ b/arch/arm64/configs/vendor/lito-perf_defconfig
@@ -292,6 +292,7 @@
 CONFIG_THERMAL_GOV_USER_SPACE=y
 CONFIG_DEVFREQ_THERMAL=y
 CONFIG_QCOM_SPMI_TEMP_ALARM=y
+CONFIG_THERMAL_TSENS=y
 CONFIG_MFD_SPMI_PMIC=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
diff --git a/arch/arm64/configs/vendor/lito_defconfig b/arch/arm64/configs/vendor/lito_defconfig
index 98fcdee..5019889 100644
--- a/arch/arm64/configs/vendor/lito_defconfig
+++ b/arch/arm64/configs/vendor/lito_defconfig
@@ -298,6 +298,7 @@
 CONFIG_THERMAL_GOV_USER_SPACE=y
 CONFIG_DEVFREQ_THERMAL=y
 CONFIG_QCOM_SPMI_TEMP_ALARM=y
+CONFIG_THERMAL_TSENS=y
 CONFIG_MFD_SPMI_PMIC=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
diff --git a/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c b/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c
index e4b1ed1..a8aeca9 100644
--- a/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c
+++ b/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c
@@ -383,7 +383,7 @@
 		((size_t)cmd->offset >= len - sizeof(struct cam_packet))) {
 		CAM_ERR(CAM_CTXT, "invalid buff length: %zu or offset", len);
 		rc = -EINVAL;
-		goto free_cpu_buf;
+		goto free_req;
 	}
 
 	remain_len -= (size_t)cmd->offset;
@@ -395,7 +395,7 @@
 			"request %lld has been flushed, reject packet",
 			packet->header.request_id);
 		rc = -EINVAL;
-		goto free_cpu_buf;
+		goto free_req;
 	}
 
 	if (packet->header.request_id > ctx->last_flush_req)
@@ -422,7 +422,7 @@
 			"[%s][%d] Prepare config packet failed in HW layer",
 			ctx->dev_name, ctx->ctx_id);
 		rc = -EFAULT;
-		goto free_cpu_buf;
+		goto free_req;
 	}
 	req->num_hw_update_entries = cfg.num_hw_update_entries;
 	req->num_out_map_entries = cfg.num_out_map_entries;
@@ -480,10 +480,6 @@
 		}
 	}
 
-	if (cam_mem_put_cpu_buf((int32_t) cmd->packet_handle))
-		CAM_WARN(CAM_CTXT, "[%s][%d] Can not put packet address",
-			ctx->dev_name, ctx->ctx_id);
-
 	return rc;
 
 put_ref:
@@ -492,10 +488,6 @@
 			CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d",
 				req->out_map_entries[i].sync_id);
 	}
-free_cpu_buf:
-	if (cam_mem_put_cpu_buf((int32_t) cmd->packet_handle))
-		CAM_WARN(CAM_CTXT, "[%s][%d] Can not put packet address",
-			ctx->dev_name, ctx->ctx_id);
 free_req:
 	spin_lock(&ctx->lock);
 	list_add_tail(&req->list, &ctx->free_req_list);
diff --git a/drivers/media/platform/msm/camera/cam_core/cam_hw_mgr_intf.h b/drivers/media/platform/msm/camera/cam_core/cam_hw_mgr_intf.h
index 4098445..06d2096 100644
--- a/drivers/media/platform/msm/camera/cam_core/cam_hw_mgr_intf.h
+++ b/drivers/media/platform/msm/camera/cam_core/cam_hw_mgr_intf.h
@@ -83,6 +83,11 @@
  * @num_acq:               Total number of acquire in the payload
  * @acquire_info:          Acquired resource array pointer
  * @ctxt_to_hw_map:        HW context (returned)
+ * @acquired_hw_id:        Acquired hardware mask
+ * @acquired_hw_path:      Acquired path mask for an input
+ *                         if input splits into multiple paths,
+ *                         its updated per hardware
+ * valid_acquired_hw:      Valid num of acquired hardware
  *
  */
 struct cam_hw_acquire_args {
@@ -92,6 +97,10 @@
 	uint32_t                     acquire_info_size;
 	uintptr_t                    acquire_info;
 	void                        *ctxt_to_hw_map;
+
+	uint32_t    acquired_hw_id[CAM_MAX_ACQ_RES];
+	uint32_t    acquired_hw_path[CAM_MAX_ACQ_RES][CAM_MAX_HW_SPLIT];
+	uint32_t    valid_acquired_hw;
 };
 
 /**
diff --git a/drivers/media/platform/msm/camera/cam_core/cam_node.c b/drivers/media/platform/msm/camera/cam_core/cam_node.c
index c9d2618..1ef4aa5 100644
--- a/drivers/media/platform/msm/camera/cam_core/cam_node.c
+++ b/drivers/media/platform/msm/camera/cam_core/cam_node.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-only
 /*
- * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
  */
 
 #include <linux/debugfs.h>
@@ -161,6 +161,45 @@
 	return 0;
 }
 
+static int __cam_node_handle_acquire_hw_v2(struct cam_node *node,
+	struct cam_acquire_hw_cmd_v2 *acquire)
+{
+	int rc = 0;
+	struct cam_context *ctx = NULL;
+
+	if (!acquire)
+		return -EINVAL;
+
+	if (acquire->dev_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid device handle for context");
+		return -EINVAL;
+	}
+
+	if (acquire->session_handle <= 0) {
+		CAM_ERR(CAM_CORE, "Invalid session handle for context");
+		return -EINVAL;
+	}
+
+	ctx = (struct cam_context *)cam_get_device_priv(acquire->dev_handle);
+	if (!ctx) {
+		CAM_ERR(CAM_CORE, "Can not get context for handle %d",
+			acquire->dev_handle);
+		return -EINVAL;
+	}
+
+	rc = cam_context_handle_acquire_hw(ctx, acquire);
+	if (rc) {
+		CAM_ERR(CAM_CORE, "Acquire device failed for node %s",
+			node->name);
+		return rc;
+	}
+
+	CAM_DBG(CAM_CORE, "[%s] Acquire ctx_id %d",
+		node->name, ctx->ctx_id);
+
+	return 0;
+}
+
 static int __cam_node_handle_start_dev(struct cam_node *node,
 	struct cam_start_stop_dev_cmd *start)
 {
@@ -624,6 +663,8 @@
 
 		if (api_version == 1) {
 			acquire_size = sizeof(struct cam_acquire_hw_cmd_v1);
+		} else if (api_version == 2) {
+			acquire_size = sizeof(struct cam_acquire_hw_cmd_v2);
 		} else {
 			CAM_ERR(CAM_CORE, "Unsupported api version %d",
 				api_version);
@@ -652,6 +693,14 @@
 				goto acquire_kfree;
 			}
 			CAM_INFO(CAM_CORE, "Acquire HW successful");
+		} else if (api_version == 2) {
+			rc = __cam_node_handle_acquire_hw_v2(node, acquire_ptr);
+			if (rc) {
+				CAM_ERR(CAM_CORE,
+					"acquire device failed(rc = %d)", rc);
+				goto acquire_kfree;
+			}
+			CAM_INFO(CAM_CORE, "Acquire HW successful");
 		}
 
 		if (copy_to_user((void __user *)cmd->handle, acquire_ptr,
diff --git a/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c b/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
index 5a7748d..fad7caf 100644
--- a/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
@@ -603,7 +603,7 @@
 						io_cfg[i].direction,
 						io_cfg[i].resource_type, plane,
 						rc);
-					goto rel_cpu_buf;
+					return rc;
 				}
 				if (io_cfg[i].offsets[plane] >= size) {
 					CAM_ERR(CAM_FD,
@@ -611,7 +611,7 @@
 						io_cfg[i].direction,
 						io_cfg[i].resource_type, plane);
 					rc = -EINVAL;
-					goto rel_cpu_buf;
+					return rc;
 				}
 				cpu_addr[plane] += io_cfg[i].offsets[plane];
 			}
@@ -663,31 +663,11 @@
 			rc = -EINVAL;
 			break;
 		}
-
-		for (j = 0; j < plane; j++) {
-			if (need_cpu_map) {
-				if (cam_mem_put_cpu_buf(
-					io_cfg[i].mem_handle[j]))
-					CAM_WARN(CAM_FD,
-						"Invalid cpu buf %d %d %d",
-						io_cfg[i].direction,
-						io_cfg[i].resource_type, j);
-			}
-		}
 	}
 
 	prepare->num_in_map_entries  = num_in_buf;
 	prepare->num_out_map_entries = num_out_buf;
 	return rc;
-
-rel_cpu_buf:
-	for (j = plane - 1; j >= 0; j--) {
-		if (cam_mem_put_cpu_buf(io_cfg[i].mem_handle[j]))
-			CAM_WARN(CAM_FD, "Fail to put cpu buf %d %d %d",
-				io_cfg[i].direction,
-				io_cfg[i].resource_type, j);
-	}
-	return rc;
 }
 
 static int cam_fd_mgr_util_prepare_hw_update_entries(
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
index 8397cde..7d7e277 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
@@ -3370,25 +3370,6 @@
 	return 0;
 }
 
-static int cam_icp_mgr_put_cmd_buf(struct cam_packet *packet)
-{
-	int i = 0;
-	struct cam_cmd_buf_desc *cmd_desc = NULL;
-
-	cmd_desc = (struct cam_cmd_buf_desc *)
-		((uint32_t *) &packet->payload + packet->cmd_buf_offset/4);
-
-	for (i = 0; i < packet->num_cmd_buf; i++) {
-		if (cmd_desc[i].type == CAM_CMD_BUF_FW) {
-			if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-				CAM_WARN(CAM_ICP, "put cmd buf failed: 0x%x",
-					cmd_desc[i].mem_handle);
-		}
-	}
-
-	return 0;
-}
-
 static int cam_icp_mgr_process_cmd_desc(struct cam_icp_hw_mgr *hw_mgr,
 	struct cam_packet *packet, struct cam_icp_hw_ctx_data *ctx_data,
 	uint32_t *fw_cmd_buf_iova_addr)
@@ -3419,7 +3400,7 @@
 
 				if (num_cmd_buf > 0)
 					num_cmd_buf--;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			*fw_cmd_buf_iova_addr = addr;
 			*fw_cmd_buf_iova_addr =
@@ -3433,14 +3414,14 @@
 
 				if (num_cmd_buf > 0)
 					num_cmd_buf--;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			if ((len <= cmd_desc[i].offset) ||
 				(cmd_desc[i].size < cmd_desc[i].length) ||
 				((len - cmd_desc[i].offset) <
 				cmd_desc[i].length)) {
 				CAM_ERR(CAM_ICP, "Invalid offset or length");
-				goto rel_cmd_buf;
+				return -EINVAL;
 			}
 			cpu_addr = cpu_addr + cmd_desc[i].offset;
 		}
@@ -3495,18 +3476,6 @@
 	}
 
 	return rc;
-
-rel_cmd_buf:
-	for (i = num_cmd_buf; i >= 0; i--) {
-		if (cmd_desc[i].type == CAM_CMD_BUF_FW) {
-			if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle)) {
-				CAM_WARN(CAM_ICP, "put cmd buf failed 0x%x",
-					cmd_desc[i].mem_handle);
-			}
-		}
-	}
-
-	return rc;
 }
 
 static int cam_icp_mgr_process_io_cfg(struct cam_icp_hw_mgr *hw_mgr,
@@ -4080,7 +4049,6 @@
 
 	CAM_DBG(CAM_ICP, "X: req id = %lld ctx_id = %u",
 		packet->header.request_id, ctx_data->ctx_id);
-	cam_icp_mgr_put_cmd_buf(packet);
 	mutex_unlock(&ctx_data->ctx_mutex);
 	return rc;
 }
diff --git a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
index 211fee4..0485e35 100644
--- a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
+++ b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
@@ -123,7 +123,6 @@
 	uint32_t *buf_addr;
 	uint32_t *buf_start, *buf_end;
 	size_t   remain_len = 0;
-	bool     need_put = false;
 
 	for (i = 0; i < req_isp->num_cfg; i++) {
 		rc = cam_packet_util_get_cmd_mem_addr(
@@ -133,25 +132,21 @@
 				"Failed to get_cmd_mem_addr, rc=%d",
 				rc);
 		} else {
-			if (req_isp->cfg[i].offset >= len) {
-				CAM_ERR(CAM_ISP, "Invalid offset");
-				need_put = true;
-				goto put;
+			if (req_isp->cfg[i].offset >= ((uint32_t)len)) {
+				CAM_ERR(CAM_ISP,
+					"Invalid offset exp %u actual %u",
+					req_isp->cfg[i].offset, (uint32_t)len);
+				return;
 			}
 			remain_len = len - req_isp->cfg[i].offset;
 
-			if (req_isp->cfg[i].len > remain_len) {
-				CAM_ERR(CAM_ISP, "Invalid offset");
-				need_put = true;
-			}
-put:
-			if (need_put) {
-				if (cam_mem_put_cpu_buf(req_isp->cfg[i].handle))
-					CAM_WARN(CAM_ISP,
-						"Failed to put cpu buf: 0x%x",
-						req_isp->cfg[i].handle);
-				need_put = false;
-				continue;
+			if (req_isp->cfg[i].len >
+				((uint32_t)remain_len)) {
+				CAM_ERR(CAM_ISP,
+					"Invalid len exp %u remain_len %u",
+					req_isp->cfg[i].len,
+					(uint32_t)remain_len);
+				return;
 			}
 
 			buf_start = (uint32_t *)((uint8_t *) buf_addr +
@@ -159,9 +154,6 @@
 			buf_end = (uint32_t *)((uint8_t *) buf_start +
 				req_isp->cfg[i].len - 1);
 			cam_cdm_util_dump_cmd_buf(buf_start, buf_end);
-			if (cam_mem_put_cpu_buf(req_isp->cfg[i].handle))
-				CAM_WARN(CAM_ISP, "Failed to put cpu buf: 0x%x",
-					req_isp->cfg[i].handle);
 		}
 	}
 }
@@ -2606,7 +2598,7 @@
 		((size_t)cmd->offset >= len - sizeof(struct cam_packet))) {
 		CAM_ERR(CAM_ISP, "invalid buff length: %zu or offset", len);
 		rc = -EINVAL;
-		goto free_cpu_buf;
+		goto free_req;
 	}
 
 	remain_len -= (size_t)cmd->offset;
@@ -2626,7 +2618,7 @@
 			"request %lld has been flushed, reject packet",
 			packet->header.request_id);
 		rc = -EINVAL;
-		goto free_cpu_buf;
+		goto free_req;
 	}
 
 	/* preprocess the configuration */
@@ -2650,7 +2642,7 @@
 	if (rc != 0) {
 		CAM_ERR(CAM_ISP, "Prepare config packet failed in HW layer");
 		rc = -EFAULT;
-		goto free_cpu_buf;
+		goto free_req;
 	}
 	req_isp->num_cfg = cfg.num_hw_update_entries;
 	req_isp->num_fence_map_out = cfg.num_out_map_entries;
@@ -2711,10 +2703,6 @@
 	if (rc)
 		goto put_ref;
 
-	if (cam_mem_put_cpu_buf((int32_t) cmd->packet_handle))
-		CAM_WARN(CAM_ISP, "Can not put packet address : 0x%llx",
-			cmd->packet_handle);
-
 	CAM_DBG(CAM_REQ,
 		"Preprocessing Config req_id %lld successful on ctx %u",
 		req->request_id, ctx->ctx_id);
@@ -2727,10 +2715,6 @@
 			CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d",
 				req_isp->fence_map_out[i].sync_id);
 	}
-free_cpu_buf:
-	if (cam_mem_put_cpu_buf((int32_t) cmd->packet_handle))
-		CAM_WARN(CAM_ISP, "Can not put packet address: 0x%llx",
-			cmd->packet_handle);
 free_req:
 	spin_lock_bh(&ctx->lock);
 	list_add_tail(&req->list, &ctx->free_req_list);
@@ -2949,6 +2933,7 @@
 		goto free_res;
 	}
 
+	memset(&param, 0, sizeof(param));
 	param.context_data = ctx;
 	param.event_cb = ctx->irq_cb_intf;
 	param.num_acq = CAM_API_COMPAT_CONSTANT;
@@ -3023,6 +3008,147 @@
 	return rc;
 }
 
+static int __cam_isp_ctx_acquire_hw_v2(struct cam_context *ctx,
+	void *args)
+{
+	int rc = 0, i, j;
+	struct cam_acquire_hw_cmd_v2 *cmd =
+		(struct cam_acquire_hw_cmd_v2 *)args;
+	struct cam_hw_acquire_args       param;
+	struct cam_hw_release_args       release;
+	struct cam_isp_context          *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
+	struct cam_hw_cmd_args           hw_cmd_args;
+	struct cam_isp_hw_cmd_args       isp_hw_cmd_args;
+	struct cam_isp_acquire_hw_info  *acquire_hw_info = NULL;
+
+	if (!ctx->hw_mgr_intf) {
+		CAM_ERR(CAM_ISP, "HW interface is not ready");
+		rc = -EFAULT;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP,
+		"session_hdl 0x%x, hdl type %d, res %lld",
+		cmd->session_handle, cmd->handle_type, cmd->resource_hdl);
+
+	/* for now we only support user pointer */
+	if (cmd->handle_type != 1)  {
+		CAM_ERR(CAM_ISP, "Only user pointer is supported");
+		rc = -EINVAL;
+		goto end;
+	}
+
+	if (cmd->data_size < sizeof(*acquire_hw_info)) {
+		CAM_ERR(CAM_ISP, "data_size is not a valid value");
+		goto end;
+	}
+
+	acquire_hw_info = kzalloc(cmd->data_size, GFP_KERNEL);
+	if (!acquire_hw_info) {
+		rc = -ENOMEM;
+		goto end;
+	}
+
+	CAM_DBG(CAM_ISP, "start copy resources from user");
+
+	if (copy_from_user(acquire_hw_info, (void __user *)cmd->resource_hdl,
+		cmd->data_size)) {
+		rc = -EFAULT;
+		goto free_res;
+	}
+
+	memset(&param, 0, sizeof(param));
+	param.context_data = ctx;
+	param.event_cb = ctx->irq_cb_intf;
+	param.num_acq = CAM_API_COMPAT_CONSTANT;
+	param.acquire_info_size = cmd->data_size;
+	param.acquire_info = (uint64_t) acquire_hw_info;
+
+	/* call HW manager to reserve the resource */
+	rc = ctx->hw_mgr_intf->hw_acquire(ctx->hw_mgr_intf->hw_mgr_priv,
+		&param);
+	if (rc != 0) {
+		CAM_ERR(CAM_ISP, "Acquire device failed");
+		goto free_res;
+	}
+
+	/* Query the context has rdi only resource */
+	hw_cmd_args.ctxt_to_hw_map = param.ctxt_to_hw_map;
+	hw_cmd_args.cmd_type = CAM_HW_MGR_CMD_INTERNAL;
+	isp_hw_cmd_args.cmd_type = CAM_ISP_HW_MGR_CMD_CTX_TYPE;
+	hw_cmd_args.u.internal_args = (void *)&isp_hw_cmd_args;
+	rc = ctx->hw_mgr_intf->hw_cmd(ctx->hw_mgr_intf->hw_mgr_priv,
+				&hw_cmd_args);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "HW command failed");
+		goto free_hw;
+	}
+
+	if (param.valid_acquired_hw) {
+		for (i = 0; i < CAM_MAX_ACQ_RES; i++)
+			cmd->hw_info.acquired_hw_id[i] =
+				param.acquired_hw_id[i];
+
+		for (i = 0; i < CAM_MAX_ACQ_RES; i++)
+			for (j = 0; j < CAM_MAX_HW_SPLIT; j++)
+				cmd->hw_info.acquired_hw_path[i][j] =
+					param.acquired_hw_path[i][j];
+	}
+	cmd->hw_info.valid_acquired_hw =
+		param.valid_acquired_hw;
+
+	cmd->hw_info.valid_acquired_hw = param.valid_acquired_hw;
+
+	if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_RDI) {
+		/*
+		 * this context has rdi only resource assign rdi only
+		 * state machine
+		 */
+		CAM_DBG(CAM_ISP, "RDI only session Context");
+
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_rdi_only_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_rdi_only_activated_state_machine;
+		ctx_isp->rdi_only_context = true;
+	} else if (isp_hw_cmd_args.u.ctx_type == CAM_ISP_CTX_FS2) {
+		CAM_DBG(CAM_ISP, "FS2 Session has PIX ,RD and RDI");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_fs2_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_fs2_state_machine;
+	} else {
+		CAM_DBG(CAM_ISP, "Session has PIX or PIX and RDI resources");
+		ctx_isp->substate_machine_irq =
+			cam_isp_ctx_activated_state_machine_irq;
+		ctx_isp->substate_machine =
+			cam_isp_ctx_activated_state_machine;
+	}
+
+	ctx_isp->hw_ctx = param.ctxt_to_hw_map;
+	ctx_isp->hw_acquired = true;
+	ctx->ctxt_to_hw_map = param.ctxt_to_hw_map;
+
+	trace_cam_context_state("ISP", ctx);
+	CAM_DBG(CAM_ISP,
+		"Acquire success on session_hdl 0x%xs ctx_type %d ctx_id %u",
+		ctx->session_hdl, isp_hw_cmd_args.u.ctx_type, ctx->ctx_id);
+	kfree(acquire_hw_info);
+	return rc;
+
+free_hw:
+	release.ctxt_to_hw_map = ctx_isp->hw_ctx;
+	ctx->hw_mgr_intf->hw_release(ctx->hw_mgr_intf->hw_mgr_priv, &release);
+	ctx_isp->hw_ctx = NULL;
+	ctx_isp->hw_acquired = false;
+free_res:
+	kfree(acquire_hw_info);
+end:
+	return rc;
+}
+
+
 static int __cam_isp_ctx_acquire_hw_in_acquired(struct cam_context *ctx,
 	void *args)
 {
@@ -3037,6 +3163,8 @@
 	api_version = *((uint32_t *)args);
 	if (api_version == 1)
 		rc = __cam_isp_ctx_acquire_hw_v1(ctx, args);
+	else if (api_version == 2)
+		rc = __cam_isp_ctx_acquire_hw_v2(ctx, args);
 	else
 		CAM_ERR(CAM_ISP, "Unsupported api version %d", api_version);
 
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
index 741da8e..3ee4471 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
@@ -671,7 +671,7 @@
 
 static int cam_ife_hw_mgr_acquire_res_bus_rd(
 	struct cam_ife_hw_mgr_ctx       *ife_ctx,
-	struct cam_isp_in_port_info     *in_port)
+	struct cam_isp_in_port_generic_info *in_port)
 {
 	int rc = -EINVAL;
 	struct cam_vfe_acquire_args               vfe_acquire;
@@ -757,11 +757,11 @@
 static int cam_ife_hw_mgr_acquire_res_ife_out_rdi(
 	struct cam_ife_hw_mgr_ctx       *ife_ctx,
 	struct cam_ife_hw_mgr_res       *ife_src_res,
-	struct cam_isp_in_port_info     *in_port)
+	struct cam_isp_in_port_generic_info *in_port)
 {
 	int rc = -EINVAL;
 	struct cam_vfe_acquire_args               vfe_acquire;
-	struct cam_isp_out_port_info             *out_port = NULL;
+	struct cam_isp_out_port_generic_info     *out_port = NULL;
 	struct cam_ife_hw_mgr_res                *ife_out_res;
 	struct cam_hw_intf                       *hw_intf;
 	uint32_t  i, vfe_out_res_id, vfe_in_res_id;
@@ -843,15 +843,15 @@
 }
 
 static int cam_ife_hw_mgr_acquire_res_ife_out_pixel(
-	struct cam_ife_hw_mgr_ctx       *ife_ctx,
-	struct cam_ife_hw_mgr_res       *ife_src_res,
-	struct cam_isp_in_port_info     *in_port,
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_ife_hw_mgr_res *ife_src_res,
+	struct cam_isp_in_port_generic_info *in_port,
 	bool                             acquire_lcr)
 {
 	int rc = -1;
 	uint32_t  i, j, k;
 	struct cam_vfe_acquire_args               vfe_acquire;
-	struct cam_isp_out_port_info             *out_port;
+	struct cam_isp_out_port_generic_info     *out_port;
 	struct cam_ife_hw_mgr_res                *ife_out_res;
 	struct cam_hw_intf                       *hw_intf;
 
@@ -947,8 +947,8 @@
 }
 
 static int cam_ife_hw_mgr_acquire_res_ife_out(
-	struct cam_ife_hw_mgr_ctx     *ife_ctx,
-	struct cam_isp_in_port_info   *in_port)
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
 {
 	int rc = -EINVAL;
 	struct cam_ife_hw_mgr_res       *ife_src_res;
@@ -991,8 +991,8 @@
 }
 
 static int cam_ife_hw_mgr_acquire_res_ife_rd_src(
-	struct cam_ife_hw_mgr_ctx     *ife_ctx,
-	struct cam_isp_in_port_info   *in_port)
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
 {
 	int rc                = -1;
 	struct cam_ife_hw_mgr_res                  *csid_res;
@@ -1116,10 +1116,45 @@
 	return rc;
 }
 
+static int cam_convert_hw_idx_to_ife_hw_num(int hw_idx)
+{
+	if (hw_idx == 0)
+		return CAM_ISP_IFE0_HW;
+	else if (hw_idx == 1)
+		return CAM_ISP_IFE1_HW;
+	else if (hw_idx == 2)
+		return CAM_ISP_IFE0_LITE_HW;
+	else if (hw_idx == 3)
+		return CAM_ISP_IFE1_LITE_HW;
+	else if (hw_idx == 4)
+		return CAM_ISP_IFE2_LITE_HW;
+	return 0;
+}
+
+static int cam_convert_res_id_to_hw_path(int path, bool acquire_lcr)
+{
+	if (path == CAM_IFE_PIX_PATH_RES_IPP && acquire_lcr)
+		return CAM_ISP_LCR_PATH;
+	else if (path == CAM_IFE_PIX_PATH_RES_PPP)
+		return CAM_ISP_PPP_PATH;
+	else if (path == CAM_IFE_PIX_PATH_RES_IPP)
+		return CAM_ISP_PXL_PATH;
+	else if (path == CAM_IFE_PIX_PATH_RES_RDI_0)
+		return CAM_ISP_RDI0_PATH;
+	else if (path == CAM_IFE_PIX_PATH_RES_RDI_1)
+		return CAM_ISP_RDI1_PATH;
+	else if (path == CAM_IFE_PIX_PATH_RES_RDI_2)
+		return CAM_ISP_RDI2_PATH;
+	else if (path == CAM_IFE_PIX_PATH_RES_RDI_3)
+		return CAM_ISP_RDI3_PATH;
+	return 0;
+}
+
 static int cam_ife_hw_mgr_acquire_res_ife_src(
-	struct cam_ife_hw_mgr_ctx     *ife_ctx,
-	struct cam_isp_in_port_info   *in_port,
-	bool                           acquire_lcr)
+	struct cam_ife_hw_mgr_ctx *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	bool acquire_lcr, uint32_t *acquired_hw_id,
+	uint32_t *acquired_hw_path)
 {
 	int rc                = -1;
 	int i;
@@ -1225,6 +1260,19 @@
 				goto err;
 			}
 			ife_src_res->hw_res[i] = vfe_acquire.vfe_in.rsrc_node;
+
+			*acquired_hw_id |=
+				cam_convert_hw_idx_to_ife_hw_num(
+				hw_intf->hw_idx);
+
+			if (i >= CAM_MAX_HW_SPLIT) {
+				CAM_ERR(CAM_ISP, "HW split is invalid: %d", i);
+				return -EINVAL;
+			}
+
+			acquired_hw_path[i] |= cam_convert_res_id_to_hw_path(
+				ife_src_res->hw_res[i]->res_id, acquire_lcr);
+
 			CAM_DBG(CAM_ISP,
 				"acquire success IFE:%d  res type :0x%x res id:0x%x",
 				hw_intf->hw_idx,
@@ -1248,19 +1296,19 @@
 }
 
 static int cam_ife_mgr_acquire_cid_res(
-	struct cam_ife_hw_mgr_ctx          *ife_ctx,
-	struct cam_isp_in_port_info        *in_port,
-	struct cam_ife_hw_mgr_res         **cid_res,
-	enum cam_ife_pix_path_res_id        path_res_id)
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	struct cam_ife_hw_mgr_res          **cid_res,
+	enum cam_ife_pix_path_res_id         path_res_id)
 {
 	int rc = -1;
 	int i, j;
-	struct cam_ife_hw_mgr               *ife_hw_mgr;
-	struct cam_hw_intf                  *hw_intf;
-	struct cam_ife_hw_mgr_res           *cid_res_temp, *cid_res_iterator;
+	struct cam_ife_hw_mgr                *ife_hw_mgr;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_ife_hw_mgr_res            *cid_res_temp, *cid_res_iterator;
 	struct cam_csid_hw_reserve_resource_args  csid_acquire;
 	uint32_t acquired_cnt = 0;
-	struct cam_isp_out_port_info        *out_port = NULL;
+	struct cam_isp_out_port_generic_info *out_port = NULL;
 
 	ife_hw_mgr = ife_ctx->hw_mgr;
 	*cid_res = NULL;
@@ -1289,10 +1337,15 @@
 			if (!cid_res_iterator->hw_res[i])
 				continue;
 
-			if (cid_res_iterator->is_secure == 1 ||
+			if (in_port->num_out_res &&
+				((cid_res_iterator->is_secure == 1 &&
+				out_port->secure_mode == 0) ||
 				(cid_res_iterator->is_secure == 0 &&
-				in_port->num_out_res &&
-				out_port->secure_mode == 1))
+				out_port->secure_mode == 1)))
+				continue;
+
+			if (!in_port->num_out_res &&
+				cid_res_iterator->is_secure == 1)
 				continue;
 
 			hw_intf = cid_res_iterator->hw_res[i]->hw_intf;
@@ -1445,8 +1498,8 @@
 }
 
 static int cam_ife_hw_mgr_acquire_res_ife_csid_pxl(
-	struct cam_ife_hw_mgr_ctx          *ife_ctx,
-	struct cam_isp_in_port_info        *in_port,
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
 	bool                                is_ipp)
 {
 	int rc = -1;
@@ -1585,17 +1638,17 @@
 }
 
 static int cam_ife_hw_mgr_acquire_res_ife_csid_rdi(
-	struct cam_ife_hw_mgr_ctx     *ife_ctx,
-	struct cam_isp_in_port_info   *in_port)
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
 {
 	int rc = -EINVAL;
 	int i;
 
-	struct cam_ife_hw_mgr               *ife_hw_mgr;
-	struct cam_ife_hw_mgr_res           *csid_res;
-	struct cam_ife_hw_mgr_res           *cid_res;
-	struct cam_hw_intf                  *hw_intf;
-	struct cam_isp_out_port_info        *out_port;
+	struct cam_ife_hw_mgr                *ife_hw_mgr;
+	struct cam_ife_hw_mgr_res            *csid_res;
+	struct cam_ife_hw_mgr_res            *cid_res;
+	struct cam_hw_intf                   *hw_intf;
+	struct cam_isp_out_port_generic_info *out_port;
 	struct cam_csid_hw_reserve_resource_args  csid_acquire;
 	enum cam_ife_pix_path_res_id         path_res_id;
 
@@ -1674,8 +1727,8 @@
 }
 
 static int cam_ife_hw_mgr_acquire_res_root(
-	struct cam_ife_hw_mgr_ctx          *ife_ctx,
-	struct cam_isp_in_port_info        *in_port)
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port)
 {
 	int rc = -1;
 
@@ -1697,7 +1750,7 @@
 	return rc;
 }
 
-static int cam_ife_mgr_check_and_update_fe(
+static int cam_ife_mgr_check_and_update_fe_v0(
 	struct cam_ife_hw_mgr_ctx         *ife_ctx,
 	struct cam_isp_acquire_hw_info    *acquire_hw_info)
 {
@@ -1742,9 +1795,82 @@
 	return 0;
 }
 
+static int cam_ife_mgr_check_and_update_fe_v2(
+	struct cam_ife_hw_mgr_ctx         *ife_ctx,
+	struct cam_isp_acquire_hw_info    *acquire_hw_info)
+{
+	int i;
+	struct cam_isp_in_port_info_v2    *in_port = NULL;
+	uint32_t                           in_port_length = 0;
+	uint32_t                           total_in_port_length = 0;
+
+	in_port = (struct cam_isp_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset);
+	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
+
+		if ((in_port->num_out_res > CAM_IFE_HW_OUT_RES_MAX) ||
+			(in_port->num_out_res <= 0)) {
+			CAM_ERR(CAM_ISP, "Invalid num output res %u",
+				in_port->num_out_res);
+			return -EINVAL;
+		}
+
+		in_port_length = sizeof(struct cam_isp_in_port_info_v2) +
+			(in_port->num_out_res - 1) *
+			sizeof(struct cam_isp_out_port_info_v2);
+		total_in_port_length += in_port_length;
+
+		if (total_in_port_length > acquire_hw_info->input_info_size) {
+			CAM_ERR(CAM_ISP, "buffer size is not enough");
+			return -EINVAL;
+		}
+		CAM_DBG(CAM_ISP, "in_port%d res_type %d", i,
+			in_port->res_type);
+		if (in_port->res_type == CAM_ISP_IFE_IN_RES_RD) {
+			ife_ctx->is_fe_enable = true;
+			break;
+		}
+
+		in_port = (struct cam_isp_in_port_info_v2 *)
+			((uint8_t *)in_port + in_port_length);
+	}
+	CAM_DBG(CAM_ISP, "is_fe_enable %d", ife_ctx->is_fe_enable);
+
+	return 0;
+}
+
+static int cam_ife_mgr_check_and_update_fe(
+	struct cam_ife_hw_mgr_ctx         *ife_ctx,
+	struct cam_isp_acquire_hw_info    *acquire_hw_info)
+{
+	uint32_t major_ver = 0, minor_ver = 0;
+
+	if (acquire_hw_info == NULL || ife_ctx == NULL)
+		return -EINVAL;
+
+	major_ver = (acquire_hw_info->common_info_version >> 12) & 0xF;
+	minor_ver = (acquire_hw_info->common_info_version) & 0xFFF;
+
+	switch (major_ver) {
+	case 1:
+		return cam_ife_mgr_check_and_update_fe_v0(
+			ife_ctx, acquire_hw_info);
+	case 2:
+		return cam_ife_mgr_check_and_update_fe_v2(
+			ife_ctx, acquire_hw_info);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid ver of common info from user");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int cam_ife_hw_mgr_preprocess_port(
 	struct cam_ife_hw_mgr_ctx   *ife_ctx,
-	struct cam_isp_in_port_info *in_port,
+	struct cam_isp_in_port_generic_info *in_port,
 	int                         *ipp_count,
 	int                         *rdi_count,
 	int                         *ppp_count,
@@ -1757,8 +1883,8 @@
 	int ife_rd_num     = 0;
 	int lcr_num        = 0;
 	uint32_t i;
-	struct cam_isp_out_port_info      *out_port;
-	struct cam_ife_hw_mgr             *ife_hw_mgr;
+	struct cam_isp_out_port_generic_info *out_port;
+	struct cam_ife_hw_mgr *ife_hw_mgr;
 
 	ife_hw_mgr = ife_ctx->hw_mgr;
 
@@ -1794,9 +1920,10 @@
 }
 
 static int cam_ife_mgr_acquire_hw_for_ctx(
-	struct cam_ife_hw_mgr_ctx          *ife_ctx,
-	struct cam_isp_in_port_info        *in_port,
-	uint32_t  *num_pix_port, uint32_t  *num_rdi_port)
+	struct cam_ife_hw_mgr_ctx           *ife_ctx,
+	struct cam_isp_in_port_generic_info *in_port,
+	uint32_t  *num_pix_port, uint32_t  *num_rdi_port,
+	uint32_t *acquired_hw_id, uint32_t *acquired_hw_path)
 {
 	int rc                                    = -1;
 	int is_dual_vfe                           = 0;
@@ -1857,7 +1984,6 @@
 		}
 	}
 
-
 	/* get ife src resource */
 	if (ife_rd_count) {
 		rc = cam_ife_hw_mgr_acquire_res_ife_rd_src(ife_ctx, in_port);
@@ -1869,7 +1995,8 @@
 		}
 	} else if (ipp_count || ppp_count || rdi_count) {
 		rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx,
-			in_port, false);
+			in_port, false,
+			acquired_hw_id, acquired_hw_path);
 
 		if (rc) {
 			CAM_ERR(CAM_ISP,
@@ -1879,7 +2006,8 @@
 	}
 
 	if (lcr_count) {
-		rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx, in_port, true);
+		rc = cam_ife_hw_mgr_acquire_res_ife_src(ife_ctx, in_port, true,
+		acquired_hw_id, acquired_hw_path);
 
 		if (rc) {
 			CAM_ERR(CAM_ISP, "Acquire IFE LCR SRC resource Failed");
@@ -1927,6 +2055,216 @@
 	}
 }
 
+static int cam_ife_mgr_acquire_get_unified_structure_v0(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info **in_port)
+{
+	struct cam_isp_in_port_info *in = NULL;
+	uint32_t in_port_length = 0;
+	struct cam_isp_in_port_generic_info *port_info;
+	int32_t rc = 0, i;
+
+	in = (struct cam_isp_in_port_info *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset) + (*input_size);
+
+	in_port_length = sizeof(struct cam_isp_in_port_info) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_isp_out_port_info);
+
+	*input_size += in_port_length;
+
+	if ((*input_size) > acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP, "Input is not proper");
+		rc = -EINVAL;
+	}
+
+	port_info = kzalloc(
+		sizeof(struct cam_isp_in_port_generic_info), GFP_KERNEL);
+
+	port_info->major_ver       =
+		(acquire_hw_info->input_info_version >> 16) & 0xFFFF;
+	port_info->minor_ver       =
+		acquire_hw_info->input_info_version & 0xFFFF;
+	port_info->res_type        =  in->res_type;
+	port_info->lane_type       =  in->lane_type;
+	port_info->lane_num        =  in->lane_num;
+	port_info->lane_cfg        =  in->lane_cfg;
+	port_info->vc[0]           =  in->vc;
+	port_info->dt[0]           =  in->dt;
+	port_info->num_valid_vc_dt = 1;
+	port_info->format          =  in->format;
+	port_info->test_pattern    =  in->test_pattern;
+	port_info->usage_type      =  in->usage_type;
+	port_info->left_start      =  in->left_start;
+	port_info->left_stop       =  in->left_stop;
+	port_info->left_width      =  in->left_width;
+	port_info->right_start     =  in->right_start;
+	port_info->right_stop      =  in->right_stop;
+	port_info->right_width     =  in->right_width;
+	port_info->line_start      =  in->line_start;
+	port_info->line_stop       =  in->line_stop;
+	port_info->height          =  in->height;
+	port_info->pixel_clk       =  in->pixel_clk;
+	port_info->batch_size      =  in->batch_size;
+	port_info->dsp_mode        =  in->dsp_mode;
+	port_info->hbi_cnt         =  in->hbi_cnt;
+	port_info->cust_node       =  0;
+	port_info->num_out_res     =  in->num_out_res;
+
+	port_info->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_out_port_generic_info),
+		GFP_KERNEL);
+	if (port_info->data == NULL) {
+		rc = -ENOMEM;
+		goto release_port_mem;
+	}
+
+	for (i = 0; i < in->num_out_res; i++) {
+		port_info->data[i].res_type     = in->data[i].res_type;
+		port_info->data[i].format       = in->data[i].format;
+		port_info->data[i].width        = in->data[i].width;
+		port_info->data[i].height       = in->data[i].height;
+		port_info->data[i].comp_grp_id  = in->data[i].comp_grp_id;
+		port_info->data[i].split_point  = in->data[i].split_point;
+		port_info->data[i].secure_mode  = in->data[i].secure_mode;
+		port_info->data[i].reserved     = in->data[i].reserved;
+	}
+	*in_port = port_info;
+
+	return 0;
+release_port_mem:
+	kfree(port_info);
+	return rc;
+}
+
+static int cam_ife_mgr_acquire_get_unified_structure_v2(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info **in_port)
+{
+	struct cam_isp_in_port_info_v2 *in = NULL;
+	uint32_t in_port_length = 0;
+	struct cam_isp_in_port_generic_info *port_info;
+	int32_t rc = 0, i;
+
+	in = (struct cam_isp_in_port_info_v2 *)
+		((uint8_t *)&acquire_hw_info->data +
+		 acquire_hw_info->input_info_offset) + (*input_size);
+
+	in_port_length = sizeof(struct cam_isp_in_port_info_v2) +
+		(in->num_out_res - 1) *
+		sizeof(struct cam_isp_out_port_info);
+
+	*input_size += in_port_length;
+
+	if ((*input_size) > acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP, "Input is not proper");
+		rc = -EINVAL;
+	}
+
+	port_info = kzalloc(
+		sizeof(struct cam_isp_in_port_generic_info), GFP_KERNEL);
+
+	port_info->major_ver       =
+		(acquire_hw_info->input_info_version >> 16) & 0xFFFF;
+	port_info->minor_ver       =
+		acquire_hw_info->input_info_version & 0xFFFF;
+	port_info->res_type        =  in->res_type;
+	port_info->lane_type       =  in->lane_type;
+	port_info->lane_num        =  in->lane_num;
+	port_info->lane_cfg        =  in->lane_cfg;
+	port_info->num_valid_vc_dt =  in->num_valid_vc_dt;
+
+	if (port_info->num_valid_vc_dt == 0 ||
+		port_info->num_valid_vc_dt >= CAM_ISP_VC_DT_CFG) {
+		CAM_ERR(CAM_ISP, "Invalid i/p arg invalid vc-dt: %d",
+			in->num_valid_vc_dt);
+		rc = -EINVAL;
+		goto release_mem;
+	}
+
+	for (i = 0; i < port_info->num_valid_vc_dt; i++) {
+		port_info->vc[i]      =  in->vc[i];
+		port_info->dt[i]      =  in->dt[i];
+	}
+
+	port_info->format         =  in->format;
+	port_info->test_pattern   =  in->test_pattern;
+	port_info->usage_type     =  in->usage_type;
+	port_info->left_start     =  in->left_start;
+	port_info->left_stop      =  in->left_stop;
+	port_info->left_width     =  in->left_width;
+	port_info->right_start    =  in->right_start;
+	port_info->right_stop     =  in->right_stop;
+	port_info->right_width    =  in->right_width;
+	port_info->line_start     =  in->line_start;
+	port_info->line_stop      =  in->line_stop;
+	port_info->height         =  in->height;
+	port_info->pixel_clk      =  in->pixel_clk;
+	port_info->batch_size     =  in->batch_size;
+	port_info->dsp_mode       =  in->dsp_mode;
+	port_info->hbi_cnt        =  in->hbi_cnt;
+	port_info->cust_node      =  in->cust_node;
+	port_info->num_out_res    =  in->num_out_res;
+
+	port_info->data = kcalloc(in->num_out_res,
+		sizeof(struct cam_isp_out_port_generic_info),
+		GFP_KERNEL);
+	if (port_info->data == NULL) {
+		rc = -ENOMEM;
+		goto release_mem;
+	}
+
+	for (i = 0; i < port_info->num_out_res; i++) {
+		port_info->data[i].res_type     = in->data[i].res_type;
+		port_info->data[i].format       = in->data[i].format;
+		port_info->data[i].width        = in->data[i].width;
+		port_info->data[i].height       = in->data[i].height;
+		port_info->data[i].comp_grp_id  = in->data[i].comp_grp_id;
+		port_info->data[i].split_point  = in->data[i].split_point;
+		port_info->data[i].secure_mode  = in->data[i].secure_mode;
+	}
+
+	*in_port = port_info;
+
+	return 0;
+
+release_mem:
+	kfree(port_info);
+	return rc;
+}
+
+static int cam_ife_mgr_acquire_get_unified_structure(
+	struct cam_isp_acquire_hw_info *acquire_hw_info,
+	uint32_t offset, uint32_t *input_size,
+	struct cam_isp_in_port_generic_info **in_port)
+{
+	uint32_t major_ver = 0, minor_ver = 0;
+
+	if (acquire_hw_info == NULL || input_size == NULL)
+		return -EINVAL;
+
+	major_ver = (acquire_hw_info->common_info_version >> 12) & 0xF;
+	minor_ver = (acquire_hw_info->common_info_version) & 0xFFF;
+
+	switch (major_ver) {
+	case 1:
+		return cam_ife_mgr_acquire_get_unified_structure_v0(
+			acquire_hw_info, offset, input_size, in_port);
+	case 2:
+		return cam_ife_mgr_acquire_get_unified_structure_v2(
+			acquire_hw_info, offset, input_size, in_port);
+		break;
+	default:
+		CAM_ERR(CAM_ISP, "Invalid ver of i/p port info from user");
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 /* entry function: acquire_hw */
 static int cam_ife_mgr_acquire_hw(void *hw_mgr_priv, void *acquire_hw_args)
 {
@@ -1935,15 +2273,14 @@
 	int rc                                       = -1;
 	int i, j;
 	struct cam_ife_hw_mgr_ctx         *ife_ctx;
-	struct cam_isp_in_port_info       *in_port = NULL;
+	struct cam_isp_in_port_generic_info   *in_port = NULL;
 	struct cam_cdm_acquire_data        cdm_acquire;
 	uint32_t                           num_pix_port_per_in = 0;
 	uint32_t                           num_rdi_port_per_in = 0;
 	uint32_t                           total_pix_port = 0;
 	uint32_t                           total_rdi_port = 0;
-	uint32_t                           in_port_length = 0;
-	uint32_t                           total_in_port_length = 0;
 	struct cam_isp_acquire_hw_info    *acquire_hw_info = NULL;
+	uint32_t                           input_size = 0;
 
 	CAM_DBG(CAM_ISP, "Enter...");
 
@@ -2000,43 +2337,31 @@
 		goto free_cdm;
 	}
 
-	in_port = (struct cam_isp_in_port_info *)
-		((uint8_t *)&acquire_hw_info->data +
-		 acquire_hw_info->input_info_offset);
-
 	/* acquire HW resources */
 	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
-
-		if ((in_port->num_out_res > CAM_IFE_HW_OUT_RES_MAX) ||
-			(in_port->num_out_res <= 0)) {
-			CAM_ERR(CAM_ISP, "Invalid num output res %u",
-				in_port->num_out_res);
-			rc = -EINVAL;
-			goto free_res;
-		}
-
-		in_port_length = sizeof(struct cam_isp_in_port_info) +
-			(in_port->num_out_res - 1) *
-			sizeof(struct cam_isp_out_port_info);
-		total_in_port_length += in_port_length;
-
-		if (total_in_port_length > acquire_hw_info->input_info_size) {
-			CAM_ERR(CAM_ISP, "buffer size is not enough");
-			rc = -EINVAL;
+		rc = cam_ife_mgr_acquire_get_unified_structure(acquire_hw_info,
+			i, &input_size, &in_port);
+		if (rc < 0) {
+			CAM_ERR(CAM_ISP, "Failed in parsing: %d", rc);
 			goto free_res;
 		}
 		CAM_DBG(CAM_ISP, "in_res_type %x", in_port->res_type);
+
 		rc = cam_ife_mgr_acquire_hw_for_ctx(ife_ctx, in_port,
-			&num_pix_port_per_in, &num_rdi_port_per_in);
+			&num_pix_port_per_in, &num_rdi_port_per_in,
+			&acquire_args->acquired_hw_id[i],
+			acquire_args->acquired_hw_path[i]);
+
 		total_pix_port += num_pix_port_per_in;
 		total_rdi_port += num_rdi_port_per_in;
 
 		if (rc) {
 			CAM_ERR(CAM_ISP, "can not acquire resource");
-			goto free_res;
+			goto free_mem;
 		}
-		in_port = (struct cam_isp_in_port_info *)((uint8_t *)in_port +
-			in_port_length);
+		kfree(in_port->data);
+		kfree(in_port);
+		in_port = NULL;
 	}
 
 	/* Check whether context has only RDI resource */
@@ -2055,11 +2380,17 @@
 	acquire_args->ctxt_to_hw_map = ife_ctx;
 	ife_ctx->ctx_in_use = 1;
 
+	acquire_args->valid_acquired_hw =
+		acquire_hw_info->num_inputs;
+
 	cam_ife_hw_mgr_put_ctx(&ife_hw_mgr->used_ctx_list, &ife_ctx);
 
 	CAM_DBG(CAM_ISP, "Exit...(success)");
 
 	return 0;
+free_mem:
+	kfree(in_port->data);
+	kfree(in_port);
 free_res:
 	cam_ife_hw_mgr_release_hw_for_ctx(ife_ctx);
 free_cdm:
@@ -2071,6 +2402,48 @@
 	return rc;
 }
 
+void cam_ife_mgr_acquire_get_unified_dev_str(struct cam_isp_in_port_info *in,
+	struct cam_isp_in_port_generic_info *gen_port_info)
+{
+	int i;
+
+	gen_port_info->res_type        =  in->res_type;
+	gen_port_info->lane_type       =  in->lane_type;
+	gen_port_info->lane_num        =  in->lane_num;
+	gen_port_info->lane_cfg        =  in->lane_cfg;
+	gen_port_info->vc[0]           =  in->vc;
+	gen_port_info->dt[0]           =  in->dt;
+	gen_port_info->num_valid_vc_dt = 1;
+	gen_port_info->format          =  in->format;
+	gen_port_info->test_pattern    =  in->test_pattern;
+	gen_port_info->usage_type      =  in->usage_type;
+	gen_port_info->left_start      =  in->left_start;
+	gen_port_info->left_stop       =  in->left_stop;
+	gen_port_info->left_width      =  in->left_width;
+	gen_port_info->right_start     =  in->right_start;
+	gen_port_info->right_stop      =  in->right_stop;
+	gen_port_info->right_width     =  in->right_width;
+	gen_port_info->line_start      =  in->line_start;
+	gen_port_info->line_stop       =  in->line_stop;
+	gen_port_info->height          =  in->height;
+	gen_port_info->pixel_clk       =  in->pixel_clk;
+	gen_port_info->batch_size      =  in->batch_size;
+	gen_port_info->dsp_mode        =  in->dsp_mode;
+	gen_port_info->hbi_cnt         =  in->hbi_cnt;
+	gen_port_info->cust_node       =  0;
+	gen_port_info->num_out_res     =  in->num_out_res;
+
+	for (i = 0; i < in->num_out_res; i++) {
+		gen_port_info->data[i].res_type     = in->data[i].res_type;
+		gen_port_info->data[i].format       = in->data[i].format;
+		gen_port_info->data[i].width        = in->data[i].width;
+		gen_port_info->data[i].height       = in->data[i].height;
+		gen_port_info->data[i].comp_grp_id  = in->data[i].comp_grp_id;
+		gen_port_info->data[i].split_point  = in->data[i].split_point;
+		gen_port_info->data[i].secure_mode  = in->data[i].secure_mode;
+	}
+}
+
 /* entry function: acquire_hw */
 static int cam_ife_mgr_acquire_dev(void *hw_mgr_priv, void *acquire_hw_args)
 {
@@ -2078,15 +2451,16 @@
 	struct cam_hw_acquire_args *acquire_args     = acquire_hw_args;
 	int rc                                       = -1;
 	int i, j;
-	struct cam_ife_hw_mgr_ctx         *ife_ctx;
-	struct cam_isp_in_port_info       *in_port = NULL;
-	struct cam_isp_resource           *isp_resource = NULL;
-	struct cam_cdm_acquire_data        cdm_acquire;
-	uint32_t                           num_pix_port_per_in = 0;
-	uint32_t                           num_rdi_port_per_in = 0;
-	uint32_t                           total_pix_port = 0;
-	uint32_t                           total_rdi_port = 0;
-	uint32_t                           in_port_length = 0;
+	struct cam_ife_hw_mgr_ctx             *ife_ctx;
+	struct cam_isp_in_port_info           *in_port = NULL;
+	struct cam_isp_resource               *isp_resource = NULL;
+	struct cam_cdm_acquire_data            cdm_acquire;
+	struct cam_isp_in_port_generic_info   *gen_port_info = NULL;
+	uint32_t                               num_pix_port_per_in = 0;
+	uint32_t                               num_rdi_port_per_in = 0;
+	uint32_t                               total_pix_port = 0;
+	uint32_t                               total_rdi_port = 0;
+	uint32_t                               in_port_length = 0;
 
 	CAM_DBG(CAM_ISP, "Enter...");
 
@@ -2179,12 +2553,42 @@
 				goto free_res;
 			}
 
-			rc = cam_ife_mgr_acquire_hw_for_ctx(ife_ctx, in_port,
-				&num_pix_port_per_in, &num_rdi_port_per_in);
+			gen_port_info = kzalloc(
+				sizeof(struct cam_isp_in_port_generic_info),
+				GFP_KERNEL);
+			if (gen_port_info == NULL) {
+				rc = -ENOMEM;
+				goto free_res;
+			}
+
+			gen_port_info->data = kcalloc(
+				sizeof(struct cam_isp_out_port_generic_info),
+				in_port->num_out_res, GFP_KERNEL);
+			if (gen_port_info->data == NULL) {
+				kfree(gen_port_info);
+				gen_port_info = NULL;
+				rc = -ENOMEM;
+				goto free_res;
+			}
+
+			cam_ife_mgr_acquire_get_unified_dev_str(in_port,
+				gen_port_info);
+
+			rc = cam_ife_mgr_acquire_hw_for_ctx(ife_ctx,
+				gen_port_info, &num_pix_port_per_in,
+				&num_rdi_port_per_in,
+				&acquire_args->acquired_hw_id[i],
+				acquire_args->acquired_hw_path[i]);
+
 			total_pix_port += num_pix_port_per_in;
 			total_rdi_port += num_rdi_port_per_in;
 
 			kfree(in_port);
+			if (gen_port_info != NULL) {
+				kfree(gen_port_info->data);
+				kfree(gen_port_info);
+				gen_port_info = NULL;
+			}
 			if (rc) {
 				CAM_ERR(CAM_ISP, "can not acquire resource");
 				goto free_res;
@@ -3620,7 +4024,7 @@
 	struct cam_ife_hw_mgr_res             *hw_mgr_res;
 	struct cam_hw_intf                    *hw_intf;
 	uint64_t                               clk_rate = 0;
-	int                                    rc = -EINVAL, i;
+	int                                    rc = 0, i;
 	struct cam_vfe_core_config_args        vfe_core_config;
 
 	ctx = prepare->ctxt_to_hw_map;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
index 741ffa9..6cc615d 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
@@ -102,7 +102,7 @@
 	uint32_t                                   *cpu_addr;
 	uint32_t                                    i, j;
 
-	CAM_DBG(CAM_UTIL, "cmd des size %d, length: %d",
+	CAM_DBG(CAM_ISP, "cmd des size %d, length: %d",
 		cmd_desc->size, cmd_desc->length);
 
 	rc = cam_packet_util_get_cmd_mem_addr(
@@ -113,7 +113,7 @@
 	if ((len < sizeof(struct cam_isp_dual_config)) ||
 		(cmd_desc->offset >=
 		(len - sizeof(struct cam_isp_dual_config)))) {
-		CAM_ERR(CAM_UTIL, "not enough buffer provided");
+		CAM_ERR(CAM_ISP, "not enough buffer provided");
 		return -EINVAL;
 	}
 	remain_len = len - cmd_desc->offset;
@@ -123,17 +123,17 @@
 	if ((dual_config->num_ports *
 		sizeof(struct cam_isp_dual_stripe_config)) >
 		(remain_len - offsetof(struct cam_isp_dual_config, stripes))) {
-		CAM_ERR(CAM_UTIL, "not enough buffer for all the dual configs");
+		CAM_ERR(CAM_ISP, "not enough buffer for all the dual configs");
 		return -EINVAL;
 	}
 	for (i = 0; i < dual_config->num_ports; i++) {
 
 		if (i >= CAM_ISP_IFE_OUT_RES_MAX) {
-			CAM_ERR(CAM_UTIL,
+			CAM_ERR(CAM_ISP,
 				"failed update for i:%d > size_isp_out:%d",
 				i, size_isp_out);
 			rc = -EINVAL;
-			goto put_buf;
+			goto end;
 		}
 
 		hw_mgr_res = &res_list_isp_out[i];
@@ -168,15 +168,11 @@
 				&dual_isp_update_args,
 				sizeof(struct cam_isp_hw_dual_isp_update_args));
 			if (rc)
-				goto put_buf;
+				goto end;
 		}
 	}
 
-put_buf:
-	if (cam_mem_put_cpu_buf(cmd_desc->mem_handle))
-		CAM_WARN(CAM_UTIL, "Failed to put buf: 0x%x",
-			cmd_desc->mem_handle);
-
+end:
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
index e91092a..b9dafba 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
@@ -294,8 +294,41 @@
 	return rc;
 }
 
+static int cam_ife_match_vc_dt_pair(int32_t *vc, uint32_t *dt,
+	uint32_t num_valid_vc_dt, struct cam_ife_csid_cid_data *cid_data)
+{
+	uint32_t camera_hw_version;
+	int rc = 0;
+
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc:%d", rc);
+		return -EINVAL;
+	}
+
+	if (camera_hw_version != CAM_CPAS_TITAN_480_V100)
+		num_valid_vc_dt = 1;
+
+	switch (num_valid_vc_dt) {
+	case 2:
+		if (vc[1] != cid_data->vc1 ||
+			dt[1] != cid_data->dt1)
+			return -EINVAL;
+	case 1:
+		if (vc[0] != cid_data->vc ||
+			dt[0] != cid_data->dt)
+			return -EINVAL;
+		break;
+	default:
+		return -EINVAL;
+	}
+
+	return 0;
+}
+
 static int cam_ife_csid_cid_get(struct cam_ife_csid_hw *csid_hw,
-	struct cam_isp_resource_node **res, int32_t vc, uint32_t dt)
+	struct cam_isp_resource_node **res, int32_t *vc, uint32_t *dt,
+	uint32_t num_valid_vc_dt)
 {
 	struct cam_ife_csid_cid_data    *cid_data;
 	uint32_t  i = 0;
@@ -308,10 +341,11 @@
 			CAM_ISP_RESOURCE_STATE_RESERVED) {
 			cid_data = (struct cam_ife_csid_cid_data *)
 				csid_hw->cid_res[i].res_priv;
-			if (cid_data->vc == vc && cid_data->dt == dt) {
+			if (!cam_ife_match_vc_dt_pair(vc, dt,
+				num_valid_vc_dt, cid_data)) {
 				cid_data->cnt++;
 				*res = &csid_hw->cid_res[i];
-				CAM_DBG(CAM_ISP, "CSID:%d CID %d allocated",
+				CAM_DBG(CAM_ISP, "CSID:%d CID %d",
 					csid_hw->hw_intf->hw_idx,
 					csid_hw->cid_res[i].res_id);
 				return 0;
@@ -324,8 +358,13 @@
 			CAM_ISP_RESOURCE_STATE_AVAILABLE) {
 			cid_data = (struct cam_ife_csid_cid_data *)
 				csid_hw->cid_res[i].res_priv;
-			cid_data->vc  = vc;
-			cid_data->dt  = dt;
+			cid_data->vc  = vc[0];
+			cid_data->dt  = dt[0];
+			if (num_valid_vc_dt > 1) {
+				cid_data->vc1  = vc[1];
+				cid_data->dt1  = dt[1];
+				cid_data->is_valid_vc1_dt1 = 1;
+			}
 			cid_data->cnt = 1;
 			csid_hw->cid_res[i].res_state =
 				CAM_ISP_RESOURCE_STATE_RESERVED;
@@ -585,9 +624,10 @@
 static int cam_ife_csid_cid_reserve(struct cam_ife_csid_hw *csid_hw,
 	struct cam_csid_hw_reserve_resource_args  *cid_reserv)
 {
-	int rc = 0;
+	int rc = 0, i;
 	struct cam_ife_csid_cid_data       *cid_data;
 	uint32_t camera_hw_version;
+	uint32_t valid_vc_dt;
 
 	CAM_DBG(CAM_ISP,
 		"CSID:%d res_sel:0x%x Lane type:%d lane_num:%d dt:%d vc:%d",
@@ -595,8 +635,8 @@
 		cid_reserv->in_port->res_type,
 		cid_reserv->in_port->lane_type,
 		cid_reserv->in_port->lane_num,
-		cid_reserv->in_port->dt,
-		cid_reserv->in_port->vc);
+		cid_reserv->in_port->dt[0],
+		cid_reserv->in_port->vc[0]);
 
 	if (cid_reserv->in_port->res_type >= CAM_ISP_IFE_IN_RES_MAX) {
 		CAM_ERR(CAM_ISP, "CSID:%d  Invalid phy sel %d",
@@ -635,14 +675,19 @@
 		goto end;
 	}
 
+	valid_vc_dt = cid_reserv->in_port->num_valid_vc_dt;
+
 	/* CSID  CSI2 v2.0 supports 31 vc  */
-	if (cid_reserv->in_port->dt > 0x3f ||
-		cid_reserv->in_port->vc > 0x1f) {
-		CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d dt %d",
-			csid_hw->hw_intf->hw_idx,
-			cid_reserv->in_port->vc, cid_reserv->in_port->dt);
-		rc = -EINVAL;
-		goto end;
+	for (i = 0; i < valid_vc_dt; i++) {
+		if (cid_reserv->in_port->vc[i] > 0x1f ||
+			cid_reserv->in_port->dt[i] > 0x3f) {
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d or dt: %d",
+				csid_hw->hw_intf->hw_idx,
+				cid_reserv->in_port->vc[i],
+				cid_reserv->in_port->dt[i]);
+			rc = -EINVAL;
+			goto end;
+		}
 	}
 
 	if (cid_reserv->in_port->res_type == CAM_ISP_IFE_IN_RES_TPG && (
@@ -684,6 +729,21 @@
 			goto end;
 		}
 		break;
+	case CAM_CPAS_TITAN_480_V100:
+		if (cid_reserv->in_port->cust_node == 1) {
+			if (cid_reserv->in_port->usage_type == 1) {
+				CAM_ERR(CAM_ISP, "Dual IFE is not supported");
+				rc = -EINVAL;
+				goto end;
+			}
+			if (csid_hw->hw_intf->hw_idx != 0) {
+				CAM_DBG(CAM_ISP, "CSID%d not eligible",
+					csid_hw->hw_intf->hw_idx);
+				rc = -EINVAL;
+				goto end;
+			}
+		}
+		break;
 	default:
 		break;
 	}
@@ -767,7 +827,8 @@
 	rc = cam_ife_csid_cid_get(csid_hw,
 		&cid_reserv->node_res,
 		cid_reserv->in_port->vc,
-		cid_reserv->in_port->dt);
+		cid_reserv->in_port->dt,
+		cid_reserv->in_port->num_valid_vc_dt);
 	if (rc) {
 		CAM_ERR(CAM_ISP, "CSID:%d CID Reserve failed res_type %d",
 			csid_hw->hw_intf->hw_idx,
@@ -835,19 +896,26 @@
 static int cam_ife_csid_path_reserve(struct cam_ife_csid_hw *csid_hw,
 	struct cam_csid_hw_reserve_resource_args  *reserve)
 {
-	int rc = 0;
+	int rc = 0, i;
 	struct cam_ife_csid_path_cfg    *path_data;
 	struct cam_isp_resource_node    *res;
 
 	/* CSID  CSI2 v2.0 supports 31 vc */
-	if (reserve->in_port->dt > 0x3f || reserve->in_port->vc > 0x1f ||
-		(reserve->sync_mode >= CAM_ISP_HW_SYNC_MAX)) {
-		CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d dt %d mode:%d",
-			 csid_hw->hw_intf->hw_idx,
-			reserve->in_port->vc, reserve->in_port->dt,
+	if (reserve->sync_mode >= CAM_ISP_HW_SYNC_MAX) {
+		CAM_ERR(CAM_ISP, "CSID: %d Sync Mode: %d",
 			reserve->sync_mode);
-		rc = -EINVAL;
-		goto end;
+		return -EINVAL;
+	}
+
+	for (i = 0; i < reserve->in_port->num_valid_vc_dt; i++) {
+		if (reserve->in_port->dt[i] > 0x3f ||
+			reserve->in_port->vc[i] > 0x1f) {
+			CAM_ERR(CAM_ISP, "CSID:%d Invalid vc:%d dt %d",
+				csid_hw->hw_intf->hw_idx,
+				reserve->in_port->vc, reserve->in_port->dt);
+			rc = -EINVAL;
+			goto end;
+		}
 	}
 
 	switch (reserve->res_id) {
@@ -980,8 +1048,13 @@
 		path_data->dt = CAM_IFE_CSID_TPG_DT_VAL;
 		path_data->vc = CAM_IFE_CSID_TPG_VC_VAL;
 	} else {
-		path_data->dt = reserve->in_port->dt;
-		path_data->vc = reserve->in_port->vc;
+		path_data->dt = reserve->in_port->dt[0];
+		path_data->vc = reserve->in_port->vc[0];
+		if (reserve->in_port->num_valid_vc_dt) {
+			path_data->dt1 = reserve->in_port->dt[1];
+			path_data->vc1 = reserve->in_port->vc[1];
+			path_data->is_valid_vc1_dt1 = 1;
+		}
 	}
 
 	if (reserve->sync_mode == CAM_ISP_HW_SYNC_MASTER) {
@@ -1364,7 +1437,8 @@
 	/* rx cfg1*/
 	val = (1 << csid_reg->csi2_reg->csi2_misr_enable_shift_val);
 	/* if VC value is more than 3 than set full width of VC */
-	if (cid_data->vc > 3)
+	if (cid_data->vc > 3 || (cid_data->is_valid_vc1_dt1 &&
+		cid_data->vc1 > 3))
 		val |= (1 << csid_reg->csi2_reg->csi2_vc_mode_shift_val);
 
 	/* enable packet ecc correction */
@@ -1496,6 +1570,7 @@
 	const struct cam_ife_csid_pxl_reg_offset *pxl_reg = NULL;
 	bool                                      is_ipp;
 	uint32_t decode_format = 0, plain_format = 0, val = 0;
+	uint32_t camera_hw_version;
 
 	path_data = (struct cam_ife_csid_path_cfg  *) res->res_priv;
 	csid_reg = csid_hw->csid_info->csid_reg;
@@ -1540,6 +1615,21 @@
 	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
 		pxl_reg->csid_pxl_cfg0_addr);
 
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc:%d", rc);
+		camera_hw_version = 0;
+	}
+	CAM_DBG(CAM_ISP, "HW version: %x", camera_hw_version);
+
+	if (path_data->is_valid_vc1_dt1 &&
+		camera_hw_version == CAM_CPAS_TITAN_480_V100) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			pxl_reg->csid_pxl_multi_vcdt_cfg0_addr);
+		val |= ((path_data->vc1 << 2) |
+			(path_data->dt1 << 7) | 1);
+	}
+
 	val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
 		pxl_reg->csid_pxl_cfg1_addr);
 
@@ -1907,6 +1997,7 @@
 	struct cam_hw_soc_info                 *soc_info;
 	uint32_t path_format = 0, plain_fmt = 0, val = 0, id;
 	uint32_t format_measure_addr;
+	uint32_t camera_hw_version;
 
 	path_data = (struct cam_ife_csid_path_cfg   *) res->res_priv;
 	csid_reg = csid_hw->csid_info->csid_reg;
@@ -1946,6 +2037,21 @@
 	cam_io_w_mb(val, soc_info->reg_map[0].mem_base +
 			csid_reg->rdi_reg[id]->csid_rdi_cfg0_addr);
 
+	rc = cam_cpas_get_cpas_hw_version(&camera_hw_version);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed to get HW version rc:%d", rc);
+		camera_hw_version = 0;
+	}
+	CAM_DBG(CAM_ISP, "HW version: %x", camera_hw_version);
+
+	if (path_data->is_valid_vc1_dt1 &&
+		camera_hw_version == CAM_CPAS_TITAN_480_V100) {
+		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
+			csid_reg->rdi_reg[id]->csid_rdi_multi_vcdt_cfg0_addr);
+		val |= ((path_data->vc1 << 2) |
+			(path_data->dt1 << 7) | 1);
+	}
+
 	/* select the post irq sub sample strobe for time stamp capture */
 	cam_io_w_mb(CSID_TIMESTAMP_STB_POST_IRQ, soc_info->reg_map[0].mem_base +
 			csid_reg->rdi_reg[id]->csid_rdi_cfg1_addr);
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h
index 12c7480..a3c54fe 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h
@@ -382,17 +382,21 @@
 /**
  * struct cam_ife_csid_cid_data- cid configuration private data
  *
- * @vc:          Virtual channel
- * @dt:          Data type
- * @cnt:         Cid resource reference count.
- * @tpg_set:     Tpg used for this cid resource
+ * @vc:               Virtual channel
+ * @dt:               Data type
+ * @cnt:              Cid resource reference count.
+ * @tpg_set:          Tpg used for this cid resource
+ * @is_valid_vc1_dt1: Valid vc1 and dt1
  *
  */
 struct cam_ife_csid_cid_data {
 	uint32_t                     vc;
 	uint32_t                     dt;
+	uint32_t                     vc1;
+	uint32_t                     dt1;
 	uint32_t                     cnt;
 	uint32_t                     tpg_set;
+	uint32_t                     is_valid_vc1_dt1;
 };
 
 
@@ -424,6 +428,9 @@
 struct cam_ife_csid_path_cfg {
 	uint32_t                        vc;
 	uint32_t                        dt;
+	uint32_t                        vc1;
+	uint32_t                        dt1;
+	uint32_t                        is_valid_vc1_dt1;
 	uint32_t                        cid;
 	uint32_t                        in_format;
 	uint32_t                        out_format;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_ife_csid_hw_intf.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_ife_csid_hw_intf.h
index fbb1155..adf5981 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_ife_csid_hw_intf.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_ife_csid_hw_intf.h
@@ -56,6 +56,48 @@
 	uint32_t      version_incr;
 };
 
+struct cam_isp_out_port_generic_info {
+	uint32_t                res_type;
+	uint32_t                format;
+	uint32_t                width;
+	uint32_t                height;
+	uint32_t                comp_grp_id;
+	uint32_t                split_point;
+	uint32_t                secure_mode;
+	uint32_t                reserved;
+};
+
+struct cam_isp_in_port_generic_info {
+	uint32_t                        major_ver;
+	uint32_t                        minor_ver;
+	uint32_t                        res_type;
+	uint32_t                        lane_type;
+	uint32_t                        lane_num;
+	uint32_t                        lane_cfg;
+	uint32_t                        vc[CAM_ISP_VC_DT_CFG];
+	uint32_t                        dt[CAM_ISP_VC_DT_CFG];
+	uint32_t                        num_valid_vc_dt;
+	uint32_t                        format;
+	uint32_t                        test_pattern;
+	uint32_t                        usage_type;
+	uint32_t                        left_start;
+	uint32_t                        left_stop;
+	uint32_t                        left_width;
+	uint32_t                        right_start;
+	uint32_t                        right_stop;
+	uint32_t                        right_width;
+	uint32_t                        line_start;
+	uint32_t                        line_stop;
+	uint32_t                        height;
+	uint32_t                        pixel_clk;
+	uint32_t                        batch_size;
+	uint32_t                        dsp_mode;
+	uint32_t                        hbi_cnt;
+	uint32_t                        cust_node;
+	uint32_t                        num_out_res;
+	struct cam_isp_out_port_generic_info    *data;
+};
+
 /**
  * struct cam_csid_hw_reserve_resource- hw reserve
  * @res_type :    Reource type CID or PATH
@@ -77,8 +119,8 @@
 struct cam_csid_hw_reserve_resource_args {
 	enum cam_isp_resource_type                res_type;
 	uint32_t                                  res_id;
-	struct cam_isp_in_port_info              *in_port;
-	struct cam_isp_out_port_info             *out_port;
+	struct cam_isp_in_port_generic_info      *in_port;
+	struct cam_isp_out_port_generic_info     *out_port;
 	enum cam_isp_hw_sync_mode                 sync_mode;
 	uint32_t                                  master_idx;
 	uint32_t                                  cid;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
index 1c1f867..df0cee7 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
@@ -7,6 +7,7 @@
 #define _CAM_VFE_HW_INTF_H_
 
 #include "cam_isp_hw.h"
+#include "cam_ife_csid_hw_intf.h"
 
 #define CAM_VFE_HW_NUM_MAX            7
 
@@ -116,14 +117,14 @@
  * @cdm_ops:                 CDM operations
  */
 struct cam_vfe_hw_vfe_out_acquire_args {
-	struct cam_isp_resource_node      *rsrc_node;
-	struct cam_isp_out_port_info      *out_port_info;
-	uint32_t                           unique_id;
-	uint32_t                           is_dual;
-	enum cam_isp_hw_split_id           split_id;
-	uint32_t                           is_master;
-	uint32_t                           dual_slave_core;
-	struct cam_cdm_utils_ops          *cdm_ops;
+	struct cam_isp_resource_node         *rsrc_node;
+	struct cam_isp_out_port_generic_info *out_port_info;
+	uint32_t                              unique_id;
+	uint32_t                              is_dual;
+	enum cam_isp_hw_split_id              split_id;
+	uint32_t                              is_master;
+	uint32_t                              dual_slave_core;
+	struct cam_cdm_utils_ops             *cdm_ops;
 };
 
 /*
@@ -143,7 +144,7 @@
 	uint32_t                              res_id;
 	void                                 *cdm_ops;
 	enum cam_isp_hw_sync_mode             sync_mode;
-	struct cam_isp_in_port_info          *in_port;
+	struct cam_isp_in_port_generic_info  *in_port;
 };
 
 /*
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.c
index d508113..ebf8115 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_rd_ver1.c
@@ -218,7 +218,7 @@
 
 static int cam_vfe_bus_acquire_rm(
 	struct cam_vfe_bus_rd_ver1_priv          *ver1_bus_rd_priv,
-	struct cam_isp_out_port_info             *out_port_info,
+	struct cam_isp_out_port_generic_info     *out_port_info,
 	void                                     *tasklet,
 	void                                     *ctx,
 	enum cam_vfe_bus_rd_ver1_vfe_bus_rd_type  vfe_bus_rd_res_id,
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
index 02d3ad3..2fba34f 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
@@ -919,7 +919,7 @@
 
 static int cam_vfe_bus_acquire_wm(
 	struct cam_vfe_bus_ver2_priv          *ver2_bus_priv,
-	struct cam_isp_out_port_info          *out_port_info,
+	struct cam_isp_out_port_generic_info  *out_port_info,
 	void                                  *tasklet,
 	enum cam_vfe_bus_ver2_vfe_out_type     vfe_out_res_id,
 	enum cam_vfe_bus_plane_type            plane,
@@ -1532,7 +1532,7 @@
 
 static int cam_vfe_bus_acquire_comp_grp(
 	struct cam_vfe_bus_ver2_priv        *ver2_bus_priv,
-	struct cam_isp_out_port_info        *out_port_info,
+	struct cam_isp_out_port_generic_info        *out_port_info,
 	void                                *tasklet,
 	uint32_t                             unique_id,
 	uint32_t                             is_dual,
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.c
index 6d5a514..933c15b 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver3.c
@@ -1055,7 +1055,7 @@
 
 static int cam_vfe_bus_ver3_acquire_wm(
 	struct cam_vfe_bus_ver3_priv          *ver3_bus_priv,
-	struct cam_isp_out_port_info          *out_port_info,
+	struct cam_isp_out_port_generic_info  *out_port_info,
 	void                                  *tasklet,
 	enum cam_vfe_bus_ver3_vfe_out_type     vfe_out_res_id,
 	enum cam_vfe_bus_plane_type            plane,
@@ -1518,8 +1518,8 @@
 }
 
 static int cam_vfe_bus_ver3_acquire_comp_grp(
-	struct cam_vfe_bus_ver3_priv        *ver3_bus_priv,
-	struct cam_isp_out_port_info        *out_port_info,
+	struct cam_vfe_bus_ver3_priv         *ver3_bus_priv,
+	struct cam_isp_out_port_generic_info *out_port_info,
 	void                                *tasklet,
 	uint32_t                             is_dual,
 	uint32_t                             is_master,
diff --git a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
index 113ba1b..9bad8cb 100644
--- a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/cam_jpeg_hw_mgr.c
@@ -171,10 +171,6 @@
 	ctx_data->ctxt_event_cb(ctx_data->context_priv, 0, &buf_data);
 
 	list_add_tail(&p_cfg_req->list, &hw_mgr->free_req_list);
-
-	if (cam_mem_put_cpu_buf(mem_hdl))
-		CAM_WARN(CAM_JPEG, "unable to put info for cmd buf: 0x%x",
-			mem_hdl);
 	return rc;
 }
 
@@ -463,13 +459,13 @@
 		hw_mgr->cdm_info[dev_type][0].cdm_handle, cdm_cmd);
 	if (rc) {
 		CAM_ERR(CAM_JPEG, "Failed to apply the configs %d", rc);
-		goto rel_cpu_buf;
+		goto end_callcb;
 	}
 
 	if (!hw_mgr->devices[dev_type][0]->hw_ops.start) {
 		CAM_ERR(CAM_JPEG, "op start null ");
 		rc = -EINVAL;
-		goto rel_cpu_buf;
+		goto end_callcb;
 	}
 	rc = hw_mgr->devices[dev_type][0]->hw_ops.start(
 		hw_mgr->devices[dev_type][0]->hw_priv,
@@ -477,22 +473,12 @@
 	if (rc) {
 		CAM_ERR(CAM_JPEG, "Failed to start hw %d",
 			rc);
-		goto rel_cpu_buf;
+		goto end_callcb;
 	}
 
-	if (cam_mem_put_cpu_buf(
-		config_args->hw_update_entries[CAM_JPEG_CHBASE].handle))
-		CAM_WARN(CAM_JPEG, "unable to put info for cmd buf: 0x%x",
-			config_args->hw_update_entries[CAM_JPEG_CHBASE].handle);
-
 	mutex_unlock(&hw_mgr->hw_mgr_mutex);
 	return rc;
 
-rel_cpu_buf:
-	if (cam_mem_put_cpu_buf(
-		config_args->hw_update_entries[CAM_JPEG_CHBASE].handle))
-		CAM_WARN(CAM_JPEG, "unable to put info for cmd buf: 0x%x",
-			config_args->hw_update_entries[CAM_JPEG_CHBASE].handle);
 end_callcb:
 	mutex_unlock(&hw_mgr->hw_mgr_mutex);
 	if (p_cfg_req) {
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
index 6c1c75e..383574c 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
@@ -228,9 +228,7 @@
 
 int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr, size_t *len)
 {
-	int rc = 0;
 	int idx;
-	struct dma_buf *dmabuf = NULL;
 
 	if (!atomic_read(&cam_mem_mgr_state)) {
 		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
@@ -254,73 +252,18 @@
 		return -EINVAL;
 
 	if (tbl.bufq[idx].kmdvaddr) {
-		dmabuf = tbl.bufq[idx].dma_buf;
-		if (!dmabuf) {
-			CAM_ERR(CAM_MEM, "Invalid DMA buffer pointer");
-			return -EINVAL;
-		}
-		rc = dma_buf_begin_cpu_access(dmabuf, DMA_BIDIRECTIONAL);
-		if (rc) {
-			CAM_ERR(CAM_MEM, "dma begin access failed rc=%d", rc);
-			return rc;
-		}
+		*vaddr_ptr = tbl.bufq[idx].kmdvaddr;
+		*len = tbl.bufq[idx].len;
 	} else {
+		CAM_ERR(CAM_MEM, "No KMD access was requested for 0x%x handle",
+			buf_handle);
 		return -EINVAL;
 	}
 
-	*vaddr_ptr = tbl.bufq[idx].kmdvaddr;
-	*len = tbl.bufq[idx].len;
-
-	return rc;
+	return 0;
 }
 EXPORT_SYMBOL(cam_mem_get_cpu_buf);
 
-int cam_mem_put_cpu_buf(int32_t buf_handle)
-{
-	int rc = 0;
-	int idx;
-	struct dma_buf *dmabuf = NULL;
-
-	if (!atomic_read(&cam_mem_mgr_state)) {
-		CAM_ERR(CAM_MEM, "failed. mem_mgr not initialized");
-		return -EINVAL;
-	}
-
-	if (!buf_handle)
-		return -EINVAL;
-
-	idx = CAM_MEM_MGR_GET_HDL_IDX(buf_handle);
-	if (idx >= CAM_MEM_BUFQ_MAX || idx <= 0)
-		return -EINVAL;
-
-	if (!tbl.bufq[idx].active)
-		return -EPERM;
-
-	if (buf_handle != tbl.bufq[idx].buf_handle)
-		return -EINVAL;
-
-	dmabuf = tbl.bufq[idx].dma_buf;
-	if (!dmabuf) {
-		CAM_ERR(CAM_CRM, "Invalid DMA buffer pointer");
-		return -EINVAL;
-	}
-
-	if ((tbl.bufq[idx].flags & CAM_MEM_FLAG_KMD_ACCESS) &&
-		(tbl.bufq[idx].kmdvaddr)) {
-		rc = dma_buf_end_cpu_access(dmabuf, DMA_BIDIRECTIONAL);
-		if (rc) {
-			CAM_ERR(CAM_MEM, "dma begin access failed rc=%d", rc);
-			return rc;
-		}
-	} else {
-		CAM_ERR(CAM_MEM, "Invalid buf flag");
-		rc = -EINVAL;
-	}
-
-	return rc;
-}
-EXPORT_SYMBOL(cam_mem_put_cpu_buf);
-
 int cam_mem_mgr_cache_ops(struct cam_mem_cache_ops_cmd *cmd)
 {
 	int rc = 0, idx;
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h
index 47fd9cd..0bbf094 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-only */
 /*
- * Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
  */
 
 #ifndef _CAM_MEM_MGR_API_H_
@@ -90,15 +90,6 @@
 int cam_mem_get_cpu_buf(int32_t buf_handle, uintptr_t *vaddr_ptr,
 	size_t *len);
 
-/**
- * @brief: This indicates end of CPU access
- *
- * @buf_handle: Handle for the buffer
- *
- * @return Status of operation. Negative in case of error. Zero otherwise.
- */
-int cam_mem_put_cpu_buf(int32_t buf_handle);
-
 static inline bool cam_mem_is_secure_buf(int32_t buf_handle)
 {
 	return CAM_MEM_MGR_IS_SECURE_HDL(buf_handle);
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c
index 8e1acae..4723d58 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c
@@ -451,7 +451,7 @@
 			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
 			 sizeof(struct cam_packet), len_of_buff);
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	remain_len -= (size_t)config.offset;
@@ -462,7 +462,7 @@
 		remain_len)) {
 		CAM_ERR(CAM_ACTUATOR, "Invalid packet params");
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	CAM_DBG(CAM_ACTUATOR, "Pkt opcode: %d",	csl_packet->header.op_code);
@@ -475,7 +475,7 @@
 			"reject request %lld, last request to flush %lld",
 			csl_packet->header.request_id, a_ctrl->last_flush_req);
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	if (csl_packet->header.request_id > a_ctrl->last_flush_req)
@@ -496,12 +496,13 @@
 					&generic_ptr, &len_of_buff);
 			if (rc < 0) {
 				CAM_ERR(CAM_ACTUATOR, "Failed to get cpu buf");
-				goto rel_pkt_buf;
+				goto end;
 			}
 			cmd_buf = (uint32_t *)generic_ptr;
 			if (!cmd_buf) {
 				CAM_ERR(CAM_ACTUATOR, "invalid cmd buf");
-				goto rel_cmd_buf;
+				rc = -EINVAL;
+				goto end;
 			}
 			if ((len_of_buff < sizeof(struct common_header)) ||
 				(cmd_desc[i].offset > (len_of_buff -
@@ -509,7 +510,7 @@
 				CAM_ERR(CAM_ACTUATOR,
 					"Invalid length for sensor cmd");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				goto end;
 			}
 			remain_len = len_of_buff - cmd_desc[i].offset;
 			cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
@@ -524,7 +525,7 @@
 				if (rc < 0) {
 					CAM_ERR(CAM_ACTUATOR,
 					"Failed to parse slave info: %d", rc);
-					goto rel_cmd_buf;
+					goto end;
 				}
 				break;
 			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
@@ -539,7 +540,7 @@
 					CAM_ERR(CAM_ACTUATOR,
 					"Failed:parse power settings: %d",
 					rc);
-					goto rel_cmd_buf;
+					goto end;
 				}
 				break;
 			default:
@@ -559,14 +560,10 @@
 					CAM_ERR(CAM_ACTUATOR,
 					"Failed:parse init settings: %d",
 					rc);
-					goto rel_cmd_buf;
+					goto end;
 				}
 				break;
 			}
-			if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-				CAM_WARN(CAM_ACTUATOR,
-					"Failed to put cpu buf: 0x%x",
-					cmd_desc[i].mem_handle);
 		}
 
 		if (a_ctrl->cam_act_state == CAM_ACTUATOR_ACQUIRE) {
@@ -574,7 +571,7 @@
 			if (rc < 0) {
 				CAM_ERR(CAM_ACTUATOR,
 					" Actuator Power up failed");
-				goto rel_pkt_buf;
+				goto end;
 			}
 			a_ctrl->cam_act_state = CAM_ACTUATOR_CONFIG;
 		}
@@ -583,7 +580,7 @@
 			&a_ctrl->i2c_data.init_settings);
 		if (rc < 0) {
 			CAM_ERR(CAM_ACTUATOR, "Cannot apply Init settings");
-			goto rel_pkt_buf;
+			goto end;
 		}
 
 		/* Delete the request even if the apply is failed */
@@ -600,7 +597,7 @@
 			CAM_WARN(CAM_ACTUATOR,
 				"Not in right state to move lens: %d",
 				a_ctrl->cam_act_state);
-			goto rel_pkt_buf;
+			goto end;
 		}
 		a_ctrl->setting_apply_state = ACT_APPLY_SETTINGS_NOW;
 
@@ -620,7 +617,7 @@
 		if (rc < 0) {
 			CAM_ERR(CAM_ACTUATOR,
 				"Auto move lens parsing failed: %d", rc);
-			goto rel_pkt_buf;
+			goto end;
 		}
 		cam_actuator_update_req_mgr(a_ctrl, csl_packet);
 		break;
@@ -630,7 +627,7 @@
 			CAM_WARN(CAM_ACTUATOR,
 				"Not in right state to move lens: %d",
 				a_ctrl->cam_act_state);
-			goto rel_pkt_buf;
+			goto end;
 		}
 
 		a_ctrl->setting_apply_state = ACT_APPLY_SETTINGS_LATER;
@@ -651,7 +648,7 @@
 		if (rc < 0) {
 			CAM_ERR(CAM_ACTUATOR,
 				"Manual move lens parsing failed: %d", rc);
-			goto rel_pkt_buf;
+			goto end;
 		}
 
 		cam_actuator_update_req_mgr(a_ctrl, csl_packet);
@@ -661,7 +658,8 @@
 			CAM_WARN(CAM_ACTUATOR,
 				"Received NOP packets in invalid state: %d",
 				a_ctrl->cam_act_state);
-			goto rel_pkt_buf;
+			rc = -EINVAL;
+			goto end;
 		}
 		cam_actuator_update_req_mgr(a_ctrl, csl_packet);
 		break;
@@ -669,24 +667,10 @@
 		CAM_ERR(CAM_ACTUATOR, "Wrong Opcode: %d",
 			csl_packet->header.op_code & 0xFFFFFF);
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
-	if (cam_mem_put_cpu_buf(config.packet_handle))
-		CAM_WARN(CAM_ACTUATOR, "Fail to put cmd buffer: 0x%llx",
-			config.packet_handle);
-
-	return rc;
-
-rel_cmd_buf:
-	if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-		CAM_WARN(CAM_ACTUATOR, "Fail to put cmd buffer: 0x%x",
-			cmd_desc[i].mem_handle);
-rel_pkt_buf:
-	if (cam_mem_put_cpu_buf(config.packet_handle))
-		CAM_WARN(CAM_ACTUATOR, "Fail to put cmd buffer: 0x%llx",
-			config.packet_handle);
-
+end:
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
index bd41660..f7a06a4 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
@@ -180,7 +180,7 @@
 			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
 			 sizeof(struct cam_packet), len);
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		return rc;
 	}
 
 	remain_len -= (size_t)cfg_dev->offset;
@@ -191,7 +191,7 @@
 		remain_len)) {
 		CAM_ERR(CAM_CSIPHY, "Invalid packet params");
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		return rc;
 	}
 
 	cmd_desc = (struct cam_cmd_buf_desc *)
@@ -203,7 +203,7 @@
 	if (rc < 0) {
 		CAM_ERR(CAM_CSIPHY,
 			"Failed to get cmd buf Mem address : %d", rc);
-		goto rel_pkt_buf;
+		return rc;
 	}
 
 	if ((len < sizeof(struct cam_csiphy_info)) ||
@@ -211,7 +211,7 @@
 		CAM_ERR(CAM_CSIPHY,
 			"Not enough buffer provided for cam_cisphy_info");
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		return rc;
 	}
 
 	cmd_buf = (uint32_t *)generic_ptr;
@@ -236,15 +236,6 @@
 		cam_csiphy_update_secure_info(csiphy_dev,
 			cam_cmd_csiphy_info, cfg_dev);
 
-	if (cam_mem_put_cpu_buf(cmd_desc->mem_handle))
-		CAM_WARN(CAM_CSIPHY, "Failed to put cmd buffer: 0x%x",
-			cmd_desc->mem_handle);
-
-rel_pkt_buf:
-	if (cam_mem_put_cpu_buf((int32_t) cfg_dev->packet_handle))
-		CAM_WARN(CAM_CSIPHY, "Failed to put packet Mem address: 0x%llx",
-			 cfg_dev->packet_handle);
-
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
index 3cef9c6..a813feb 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
@@ -721,7 +721,7 @@
 		if (!cmd_buf) {
 			CAM_ERR(CAM_EEPROM, "invalid cmd buf");
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			goto end;
 		}
 
 		if ((pkt_len < sizeof(struct common_header) ||
@@ -729,7 +729,7 @@
 			sizeof(struct common_header)))) {
 			CAM_ERR(CAM_EEPROM, "Not enough buffer");
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			goto end;
 		}
 
 		remain_len = pkt_len - cmd_desc[i].offset;
@@ -738,7 +738,7 @@
 		if (total_cmd_buf_in_bytes > remain_len) {
 			CAM_ERR(CAM_EEPROM, "Not enough buffer for command");
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			goto end;
 		}
 
 		master = e_ctrl->io_master_info.master_type;
@@ -748,7 +748,7 @@
 				sizeof(struct common_header)) {
 				CAM_ERR(CAM_EEPROM, "Not Enough buffer");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				goto end;
 			}
 			cmm_hdr = (struct common_header *)cmd_buf;
 			generic_op_code = cmm_hdr->fifth_byte;
@@ -760,7 +760,7 @@
 					sizeof(struct cam_cmd_i2c_info)) {
 					CAM_ERR(CAM_EEPROM, "Not enough buf");
 					rc = -EINVAL;
-					goto rel_cmd_buf;
+					goto end;
 				}
 				if (master == CCI_MASTER) {
 					cci->cci_i2c_master =
@@ -787,7 +787,7 @@
 						"Invalid Master type: %d",
 						master);
 					rc = -EINVAL;
-					goto rel_cmd_buf;
+					goto end;
 				}
 				cmd_length_in_bytes =
 					sizeof(struct cam_cmd_i2c_info);
@@ -804,7 +804,7 @@
 				sizeof(struct cam_cmd_i2c_continuous_wr)) {
 					CAM_ERR(CAM_EEPROM, "Not enough buf");
 					rc = -EINVAL;
-					goto rel_cmd_buf;
+					goto end;
 				}
 
 				CAM_DBG(CAM_EEPROM,
@@ -817,7 +817,7 @@
 				if (rc < 0) {
 					CAM_ERR(CAM_SENSOR,
 					"Failed in continuous write %d", rc);
-					goto rel_cmd_buf;
+					goto end;
 				}
 
 				processed_cmd_buf_in_bytes +=
@@ -844,7 +844,7 @@
 						CAM_ERR(CAM_EEPROM,
 							"delay hdl failed: %d",
 							rc);
-						goto rel_cmd_buf;
+						goto end;
 					}
 					processed_cmd_buf_in_bytes +=
 						cmd_length_in_bytes;
@@ -855,28 +855,21 @@
 						"Wrong Wait Command: %d",
 						generic_op_code);
 					rc = -EINVAL;
-					goto rel_cmd_buf;
+					goto end;
 				}
 				break;
 			}
 			default:
-				CAM_DBG(CAM_EEPROM,
+				CAM_ERR(CAM_EEPROM,
 					"Invalid Cmd_type rxed: %d\n",
 					cmm_hdr->cmd_type);
+				rc = -EINVAL;
 				break;
 			}
 		}
-		if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-			CAM_WARN(CAM_EEPROM, "Failed to put cpu buf: 0x%x",
-				cmd_desc[i].mem_handle);
 	}
 
-	return rc;
-rel_cmd_buf:
-	if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-		CAM_WARN(CAM_EEPROM, "Failed to put cpu buf: 0x%x",
-			cmd_desc[i].mem_handle);
-
+end:
 	return rc;
 }
 
@@ -939,7 +932,7 @@
 		if (!cmd_buf) {
 			CAM_ERR(CAM_EEPROM, "invalid cmd buf");
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			goto end;
 		}
 
 		if ((pkt_len < sizeof(struct common_header)) ||
@@ -947,7 +940,7 @@
 			sizeof(struct common_header)))) {
 			CAM_ERR(CAM_EEPROM, "Not enough buffer");
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			goto end;
 		}
 		remain_len = pkt_len - cmd_desc[i].offset;
 		cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
@@ -955,7 +948,7 @@
 		if (total_cmd_buf_in_bytes > remain_len) {
 			CAM_ERR(CAM_EEPROM, "Not enough buffer for command");
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			goto end;
 		}
 		/* Loop through multiple cmd formats in one cmd buffer */
 		while (processed_cmd_buf_in_bytes < total_cmd_buf_in_bytes) {
@@ -963,7 +956,7 @@
 				sizeof(struct common_header)) {
 				CAM_ERR(CAM_EEPROM, "Not enough buf");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				goto end;
 			}
 			cmm_hdr = (struct common_header *)cmd_buf;
 			switch (cmm_hdr->cmd_type) {
@@ -973,7 +966,7 @@
 					sizeof(struct cam_cmd_i2c_info)) {
 					CAM_ERR(CAM_EEPROM, "Not enough buf");
 					rc = -EINVAL;
-					goto rel_cmd_buf;
+					goto end;
 				}
 				/* Configure the following map slave address */
 				map[num_map + 1].saddr = i2c_info->slave_addr;
@@ -999,7 +992,7 @@
 					sizeof(uint32_t);
 				if (rc) {
 					CAM_ERR(CAM_EEPROM, "Failed");
-					goto rel_cmd_buf;
+					goto end;
 				}
 				break;
 			case CAMERA_SENSOR_CMD_TYPE_I2C_RNDM_WR:
@@ -1017,22 +1010,16 @@
 				cmd_buf += cmd_length_in_bytes/sizeof(uint32_t);
 				break;
 			default:
-				break;
+				CAM_ERR(CAM_EEPROM, "Invalid cmd_type 0x%x",
+					cmm_hdr->cmd_type);
+				rc = -EINVAL;
+				goto end;
 			}
 		}
 		e_ctrl->cal_data.num_map = num_map + 1;
-		if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-			CAM_WARN(CAM_EEPROM, "Failed to put cpu buf: 0x%x",
-				cmd_desc[i].mem_handle);
 	}
 
-	return rc;
-
-rel_cmd_buf:
-	if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-		CAM_WARN(CAM_EEPROM, "Failed to put cpu buf: 0x%x",
-			cmd_desc[i].mem_handle);
-
+end:
 	return rc;
 }
 
@@ -1075,7 +1062,7 @@
 			if (buf_size <= io_cfg->offsets[0]) {
 				CAM_ERR(CAM_EEPROM, "Not enough buffer");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 
 			remain_len = buf_size - io_cfg->offsets[0];
@@ -1087,7 +1074,7 @@
 				CAM_ERR(CAM_EEPROM,
 					"invalid buffer to copy data");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			read_buffer += io_cfg->offsets[0];
 
@@ -1095,16 +1082,13 @@
 				CAM_ERR(CAM_EEPROM,
 					"failed to copy, Invalid size");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 
 			CAM_DBG(CAM_EEPROM, "copy the data, len:%d",
 				e_ctrl->cal_data.num_data);
 			memcpy(read_buffer, e_ctrl->cal_data.mapdata,
 					e_ctrl->cal_data.num_data);
-			if (cam_mem_put_cpu_buf(io_cfg->mem_handle[0]))
-				CAM_WARN(CAM_EEPROM, "Fail in put buffer: 0x%x",
-					io_cfg->mem_handle[0]);
 		} else {
 			CAM_ERR(CAM_EEPROM, "Invalid direction");
 			rc = -EINVAL;
@@ -1112,13 +1096,6 @@
 	}
 
 	return rc;
-
-rel_cmd_buf:
-	if (cam_mem_put_cpu_buf(io_cfg->mem_handle[0]))
-		CAM_WARN(CAM_EEPROM, "Fail in put buffer : 0x%x",
-			io_cfg->mem_handle[0]);
-
-	return rc;
 }
 
 static int32_t delete_eeprom_request(struct i2c_settings_array *i2c_array)
@@ -1218,7 +1195,7 @@
 			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
 			 sizeof(struct cam_packet), pkt_len);
 		rc = -EINVAL;
-		goto release_buf;
+		return rc;
 	}
 
 	remain_len -= (size_t)dev_config.offset;
@@ -1229,7 +1206,7 @@
 		remain_len)) {
 		CAM_ERR(CAM_EEPROM, "Invalid packet params");
 		rc = -EINVAL;
-		goto release_buf;
+		return rc;
 	}
 
 	switch (csl_packet->header.op_code & 0xFFFFFF) {
@@ -1239,7 +1216,7 @@
 					e_ctrl->soc_info.dev->of_node, e_ctrl);
 			if (rc < 0) {
 				CAM_ERR(CAM_EEPROM, "Failed: rc : %d", rc);
-				goto release_buf;
+				return rc;
 			}
 			rc = cam_eeprom_get_cal_data(e_ctrl, csl_packet);
 			vfree(e_ctrl->cal_data.mapdata);
@@ -1254,7 +1231,7 @@
 		if (rc) {
 			CAM_ERR(CAM_EEPROM,
 				"Failed in parsing the pkt");
-			goto release_buf;
+			return rc;
 		}
 
 		e_ctrl->cal_data.mapdata =
@@ -1270,7 +1247,7 @@
 			if (rc) {
 				CAM_DBG(CAM_EEPROM,
 					"eeprom not matching %d", rc);
-				goto power_down;
+				goto memdata_free;
 			}
 		}
 
@@ -1354,15 +1331,13 @@
 		break;
 	}
 	default:
+		CAM_ERR(CAM_EEPROM, "Invalid op-code 0x%x",
+			csl_packet->header.op_code & 0xFFFFFF);
+		rc = -EINVAL;
 		break;
 	}
 
-	if (cam_mem_put_cpu_buf(dev_config.packet_handle))
-		CAM_WARN(CAM_EEPROM, "Put cpu buffer failed : 0x%llx",
-			dev_config.packet_handle);
-
 	return rc;
-
 power_down:
 	cam_eeprom_power_down(e_ctrl);
 memdata_free:
@@ -1376,11 +1351,6 @@
 	e_ctrl->cal_data.num_data = 0;
 	e_ctrl->cal_data.num_map = 0;
 	e_ctrl->cam_eeprom_state = CAM_EEPROM_ACQUIRE;
-release_buf:
-	if (cam_mem_put_cpu_buf(dev_config.packet_handle))
-		CAM_WARN(CAM_EEPROM, "Put cpu buffer failed : 0x%llx",
-			dev_config.packet_handle);
-
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
index e273d2c..293d142 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
@@ -1293,7 +1293,7 @@
 			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
 			 sizeof(struct cam_packet), len_of_buffer);
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		return rc;
 	}
 
 	remain_len -= (size_t)config.offset;
@@ -1304,7 +1304,7 @@
 		remain_len)) {
 		CAM_ERR(CAM_FLASH, "Invalid packet params");
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		return rc;
 	}
 
 	if ((csl_packet->header.op_code & 0xFFFFFF) !=
@@ -1315,7 +1315,7 @@
 			"reject request %lld, last request to flush %d",
 			csl_packet->header.request_id, fctrl->last_flush_req);
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		return rc;
 	}
 
 	if (csl_packet->header.request_id > fctrl->last_flush_req)
@@ -1331,14 +1331,14 @@
 			&cmd_buf_ptr, &len_of_buffer);
 		if (rc) {
 			CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
-			goto rel_pkt_buf;
+			return rc;
 		}
 		if ((len_of_buffer < sizeof(struct cam_flash_init)) ||
 			(cmd_desc->offset >
 			(len_of_buffer - sizeof(struct cam_flash_init)))) {
 			CAM_ERR(CAM_FLASH, "Not enough buffer");
 			rc = -EINVAL;
-			goto rel_pkt_buf;
+			return rc;
 		}
 		remain_len = len_of_buffer - cmd_desc->offset;
 		cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
@@ -1360,7 +1360,7 @@
 			if (rc) {
 				CAM_ERR(CAM_FLASH,
 					"Enable Regulator Failed rc = %d", rc);
-				goto rel_cmd_buf;
+				return rc;
 			}
 
 			fctrl->flash_state =
@@ -1373,7 +1373,7 @@
 			if (remain_len < sizeof(struct cam_flash_set_on_off)) {
 				CAM_ERR(CAM_FLASH, "Not enough buffer");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 
 			flash_operation_info =
@@ -1382,13 +1382,13 @@
 				CAM_ERR(CAM_FLASH,
 					"flash_operation_info Null");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			if (flash_operation_info->count >
 				CAM_FLASH_MAX_LED_TRIGGERS) {
 				CAM_ERR(CAM_FLASH, "led count out of limit");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			fctrl->nrt_info.cmn_attr.count =
 				flash_operation_info->count;
@@ -1415,12 +1415,8 @@
 			CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
 				cam_flash_info->cmd_type);
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			return rc;
 		}
-
-		if (cam_mem_put_cpu_buf(cmd_desc->mem_handle))
-			CAM_WARN(CAM_FLASH, "Fail in put buffer: %pK",
-				(void *) (unsigned long) cmd_desc->mem_handle);
 		break;
 	}
 	case CAM_FLASH_PACKET_OPCODE_SET_OPS: {
@@ -1445,7 +1441,7 @@
 		if (rc) {
 			CAM_ERR(CAM_FLASH, "Fail in get buffer: 0x%x",
 				cmd_desc->mem_handle);
-			goto rel_pkt_buf;
+			return rc;
 		}
 
 		if ((len_of_buffer < sizeof(struct common_header)) ||
@@ -1453,7 +1449,7 @@
 			(len_of_buffer - sizeof(struct common_header)))) {
 			CAM_ERR(CAM_FLASH, "not enough buffer");
 			rc = -EINVAL;
-			goto rel_pkt_buf;
+			return rc;
 		}
 		remain_len = len_of_buffer - cmd_desc->offset;
 
@@ -1461,7 +1457,7 @@
 			cmd_desc->offset);
 		if (!cmd_buf) {
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			return rc;
 		}
 		cmn_hdr = (struct common_header *)cmd_buf;
 
@@ -1475,12 +1471,12 @@
 				CAM_WARN(CAM_FLASH,
 					"Rxed Flash fire ops without linking");
 				flash_data->cmn_attr.is_settings_valid = false;
-				goto rel_cmd_buf;
+				return -EINVAL;
 			}
 			if (remain_len < sizeof(struct cam_flash_set_on_off)) {
 				CAM_ERR(CAM_FLASH, "Not enough buffer");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 
 			flash_operation_info =
@@ -1489,13 +1485,13 @@
 				CAM_ERR(CAM_FLASH,
 					"flash_operation_info Null");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			if (flash_operation_info->count >
 				CAM_FLASH_MAX_LED_TRIGGERS) {
 				CAM_ERR(CAM_FLASH, "led count out of limit");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 
 			flash_data->opcode = flash_operation_info->opcode;
@@ -1513,11 +1509,8 @@
 			CAM_ERR(CAM_FLASH, "Wrong cmd_type = %d",
 				cmn_hdr->cmd_type);
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			return rc;
 		}
-		if (cam_mem_put_cpu_buf(cmd_desc->mem_handle))
-			CAM_WARN(CAM_FLASH, "Fail in put buffer: 0x%x",
-				cmd_desc->mem_handle);
 		break;
 	}
 	case CAM_FLASH_PACKET_OPCODE_NON_REALTIME_SET_OPS: {
@@ -1529,7 +1522,7 @@
 			&cmd_buf_ptr, &len_of_buffer);
 		if (rc) {
 			CAM_ERR(CAM_FLASH, "Fail in get buffer: %d", rc);
-			goto rel_pkt_buf;
+			return rc;
 		}
 
 		if ((len_of_buffer < sizeof(struct common_header)) ||
@@ -1537,7 +1530,7 @@
 			(len_of_buffer - sizeof(struct common_header)))) {
 			CAM_ERR(CAM_FLASH, "Not enough buffer");
 			rc = -EINVAL;
-			goto rel_pkt_buf;
+			return rc;
 		}
 		remain_len = len_of_buffer - cmd_desc->offset;
 		cmd_buf = (uint32_t *)((uint8_t *)cmd_buf_ptr +
@@ -1550,7 +1543,7 @@
 			if (remain_len < sizeof(struct cam_flash_set_on_off)) {
 				CAM_ERR(CAM_FLASH, "Not enough buffer");
 				rc = -EINVAL;
-				goto rel_pkt_buf;
+				return rc;
 			}
 			flash_operation_info =
 				(struct cam_flash_set_on_off *) cmd_buf;
@@ -1558,13 +1551,13 @@
 				CAM_ERR(CAM_FLASH,
 					"flash_operation_info Null");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			if (flash_operation_info->count >
 				CAM_FLASH_MAX_LED_TRIGGERS) {
 				CAM_ERR(CAM_FLASH, "led count out of limit");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 
 			fctrl->nrt_info.cmn_attr.count =
@@ -1583,7 +1576,7 @@
 			if (rc)
 				CAM_ERR(CAM_FLASH, "Apply setting failed: %d",
 					rc);
-			goto rel_cmd_buf;
+			return rc;
 		}
 		case CAMERA_SENSOR_FLASH_CMD_TYPE_QUERYCURR: {
 			int query_curr_ma = 0;
@@ -1591,7 +1584,7 @@
 			if (remain_len < sizeof(struct cam_flash_query_curr)) {
 				CAM_ERR(CAM_FLASH, "Not enough buffer");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			flash_query_info =
 				(struct cam_flash_query_curr *)cmd_buf;
@@ -1612,7 +1605,7 @@
 			if (rc) {
 				CAM_ERR(CAM_FLASH,
 				"Query current failed with rc=%d", rc);
-				goto rel_cmd_buf;
+				return rc;
 			}
 			flash_query_info->query_current_ma = query_curr_ma;
 			break;
@@ -1622,20 +1615,20 @@
 			if (remain_len < sizeof(struct cam_flash_set_rer)) {
 				CAM_ERR(CAM_FLASH, "Not enough buffer");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			flash_rer_info = (struct cam_flash_set_rer *)cmd_buf;
 			if (!flash_rer_info) {
 				CAM_ERR(CAM_FLASH,
 					"flash_rer_info Null");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 			if (flash_rer_info->count >
 				CAM_FLASH_MAX_LED_TRIGGERS) {
 				CAM_ERR(CAM_FLASH, "led count out of limit");
 				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return rc;
 			}
 
 			fctrl->nrt_info.cmn_attr.cmd_type =
@@ -1658,17 +1651,15 @@
 			if (rc)
 				CAM_ERR(CAM_FLASH, "apply_setting failed: %d",
 					rc);
-			goto rel_cmd_buf;
+			return rc;
 		}
 		default:
 			CAM_ERR(CAM_FLASH, "Wrong cmd_type : %d",
 				cmn_hdr->cmd_type);
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			return rc;
 		}
-		if (cam_mem_put_cpu_buf(cmd_desc->mem_handle))
-			CAM_WARN(CAM_FLASH, "Fail in put buffer: 0x%x",
-				cmd_desc->mem_handle);
+
 		break;
 	}
 	case CAM_PKT_NOP_OPCODE: {
@@ -1680,7 +1671,7 @@
 				"Rxed NOP packets without linking");
 			fctrl->per_frame[frm_offset].cmn_attr.is_settings_valid
 				= false;
-			goto rel_pkt_buf;
+			return -EINVAL;
 		}
 
 		fctrl->per_frame[frm_offset].cmn_attr.is_settings_valid = false;
@@ -1694,7 +1685,7 @@
 		CAM_ERR(CAM_FLASH, "Wrong Opcode : %d",
 			(csl_packet->header.op_code & 0xFFFFFF));
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		return rc;
 	}
 
 	if (((csl_packet->header.op_code  & 0xFFFFF) ==
@@ -1717,21 +1708,6 @@
 		CAM_DBG(CAM_FLASH, "add req to req_mgr= %lld", add_req.req_id);
 	}
 
-	if (cam_mem_put_cpu_buf(config.packet_handle))
-		CAM_WARN(CAM_FLASH, "Failed in put the buffer: 0x%llx ",
-			config.packet_handle);
-
-	return 0;
-
-rel_cmd_buf:
-	if (cam_mem_put_cpu_buf(cmd_desc->mem_handle))
-		CAM_WARN(CAM_FLASH, "Fail in put buffer: 0x%x",
-			cmd_desc->mem_handle);
-rel_pkt_buf:
-	if (cam_mem_put_cpu_buf(config.packet_handle))
-		CAM_WARN(CAM_FLASH, "Failed in put the buffer: 0x%llx ",
-			config.packet_handle);
-
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c
index 1e45967..ee00a41 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c
@@ -454,8 +454,7 @@
 		CAM_ERR(CAM_OIS,
 			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
 			 sizeof(struct cam_packet), pkt_len);
-		rc = -EINVAL;
-		goto rel_pkt;
+		return -EINVAL;
 	}
 
 	remain_len -= (size_t)dev_config.offset;
@@ -465,8 +464,7 @@
 	if (cam_packet_util_validate_packet(csl_packet,
 		remain_len)) {
 		CAM_ERR(CAM_OIS, "Invalid packet params");
-		rc = -EINVAL;
-		goto rel_pkt;
+		return -EINVAL;
 	}
 
 
@@ -487,13 +485,12 @@
 			if (rc < 0) {
 				CAM_ERR(CAM_OIS, "Failed to get cpu buf : 0x%x",
 					cmd_desc[i].mem_handle);
-				goto rel_pkt;
+				return rc;
 			}
 			cmd_buf = (uint32_t *)generic_ptr;
 			if (!cmd_buf) {
 				CAM_ERR(CAM_OIS, "invalid cmd buf");
-				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return -EINVAL;
 			}
 
 			if ((len_of_buff < sizeof(struct common_header)) ||
@@ -501,8 +498,7 @@
 				sizeof(struct common_header)))) {
 				CAM_ERR(CAM_OIS,
 					"Invalid length for sensor cmd");
-				rc = -EINVAL;
-				goto rel_cmd_buf;
+				return -EINVAL;
 			}
 			remain_len = len_of_buff - cmd_desc[i].offset;
 			cmd_buf += cmd_desc[i].offset / sizeof(uint32_t);
@@ -515,7 +511,7 @@
 				if (rc < 0) {
 					CAM_ERR(CAM_OIS,
 					"Failed in parsing slave info");
-					goto rel_cmd_buf;
+					return rc;
 				}
 				break;
 			case CAMERA_SENSOR_CMD_TYPE_PWR_UP:
@@ -529,7 +525,7 @@
 				if (rc) {
 					CAM_ERR(CAM_OIS,
 					"Failed: parse power settings");
-					goto rel_cmd_buf;
+					return rc;
 				}
 				break;
 			default:
@@ -547,7 +543,7 @@
 				if (rc < 0) {
 					CAM_ERR(CAM_OIS,
 					"init parsing failed: %d", rc);
-					goto rel_cmd_buf;
+					return rc;
 				}
 			} else if ((o_ctrl->is_ois_calib != 0) &&
 				(o_ctrl->i2c_calib_data.is_settings_valid ==
@@ -564,21 +560,18 @@
 				if (rc < 0) {
 					CAM_ERR(CAM_OIS,
 						"Calib parsing failed: %d", rc);
-					goto rel_cmd_buf;
+					return rc;
 				}
 			}
 			break;
 			}
-			if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-				CAM_WARN(CAM_OIS, "Failed to put cpu buf: 0x%x",
-					cmd_desc[i].mem_handle);
 		}
 
 		if (o_ctrl->cam_ois_state != CAM_OIS_CONFIG) {
 			rc = cam_ois_power_up(o_ctrl);
 			if (rc) {
 				CAM_ERR(CAM_OIS, " OIS Power up failed");
-				goto rel_pkt;
+				return rc;
 			}
 			o_ctrl->cam_ois_state = CAM_OIS_CONFIG;
 		}
@@ -625,7 +618,7 @@
 			CAM_WARN(CAM_OIS,
 				"Not in right state to control OIS: %d",
 				o_ctrl->cam_ois_state);
-			goto rel_pkt;
+			return rc;
 		}
 		offset = (uint32_t *)&csl_packet->payload;
 		offset += (csl_packet->cmd_buf_offset / sizeof(uint32_t));
@@ -638,43 +631,32 @@
 			cmd_desc, 1);
 		if (rc < 0) {
 			CAM_ERR(CAM_OIS, "OIS pkt parsing failed: %d", rc);
-			goto rel_pkt;
+			return rc;
 		}
 
 		rc = cam_ois_apply_settings(o_ctrl, i2c_reg_settings);
 		if (rc < 0) {
 			CAM_ERR(CAM_OIS, "Cannot apply mode settings");
-			goto rel_pkt;
+			return rc;
 		}
 
 		rc = delete_request(i2c_reg_settings);
 		if (rc < 0) {
 			CAM_ERR(CAM_OIS,
 				"Fail deleting Mode data: rc: %d", rc);
-			goto rel_pkt;
+			return rc;
 		}
 		break;
 	default:
 		CAM_ERR(CAM_OIS, "Invalid Opcode: %d",
 			(csl_packet->header.op_code & 0xFFFFFF));
-		rc = -EINVAL;
-		goto rel_pkt;
+		return -EINVAL;
 	}
 
 	if (!rc)
-		goto rel_pkt;
-
-rel_cmd_buf:
-	if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-		CAM_WARN(CAM_OIS, "Failed to put cpu buf: 0x%x",
-			cmd_desc[i].mem_handle);
+		return rc;
 pwr_dwn:
 	cam_ois_power_down(o_ctrl);
-rel_pkt:
-	if (cam_mem_put_cpu_buf(dev_config.packet_handle))
-		CAM_WARN(CAM_OIS, "Fail in put buffer: 0x%llx",
-			dev_config.packet_handle);
-
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c
index 123b7b3f..c7d95da 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c
@@ -123,7 +123,7 @@
 			"Inval cam_packet strut size: %zu, len_of_buff: %zu",
 			 sizeof(struct cam_packet), len_of_buff);
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	remain_len -= (size_t)config.offset;
@@ -134,7 +134,7 @@
 		remain_len)) {
 		CAM_ERR(CAM_SENSOR, "Invalid packet params");
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 
 	}
 
@@ -146,7 +146,7 @@
 			"reject request %lld, last request to flush %u",
 			csl_packet->header.request_id, s_ctrl->last_flush_req);
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	if (csl_packet->header.request_id > s_ctrl->last_flush_req)
@@ -169,7 +169,7 @@
 	}
 	case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMON: {
 		if (s_ctrl->streamon_count > 0)
-			goto rel_pkt_buf;
+			goto end;
 
 		s_ctrl->streamon_count = s_ctrl->streamon_count + 1;
 		i2c_reg_settings = &i2c_data->streamon_settings;
@@ -179,7 +179,7 @@
 	}
 	case CAM_SENSOR_PACKET_OPCODE_SENSOR_STREAMOFF: {
 		if (s_ctrl->streamoff_count > 0)
-			goto rel_pkt_buf;
+			goto end;
 
 		s_ctrl->streamoff_count = s_ctrl->streamoff_count + 1;
 		i2c_reg_settings = &i2c_data->streamoff_settings;
@@ -193,7 +193,7 @@
 			(s_ctrl->sensor_state == CAM_SENSOR_ACQUIRE)) {
 			CAM_WARN(CAM_SENSOR,
 				"Rxed Update packets without linking");
-			goto rel_pkt_buf;
+			goto end;
 		}
 
 		i2c_reg_settings =
@@ -213,7 +213,7 @@
 			 * fix it.
 			 */
 			cam_sensor_update_req_mgr(s_ctrl, csl_packet);
-			goto rel_pkt_buf;
+			goto end;
 		}
 		break;
 	}
@@ -222,16 +222,16 @@
 			(s_ctrl->sensor_state == CAM_SENSOR_ACQUIRE)) {
 			CAM_WARN(CAM_SENSOR,
 				"Rxed NOP packets without linking");
-			goto rel_pkt_buf;
+			goto end;
 		}
 
 		cam_sensor_update_req_mgr(s_ctrl, csl_packet);
-		goto rel_pkt_buf;
+		goto end;
 	}
 	default:
 		CAM_ERR(CAM_SENSOR, "Invalid Packet Header");
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	offset = (uint32_t *)&csl_packet->payload;
@@ -242,7 +242,7 @@
 			i2c_reg_settings, cmd_desc, 1);
 	if (rc < 0) {
 		CAM_ERR(CAM_SENSOR, "Fail parsing I2C Pkt: %d", rc);
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	if ((csl_packet->header.op_code & 0xFFFFFF) ==
@@ -252,11 +252,7 @@
 		cam_sensor_update_req_mgr(s_ctrl, csl_packet);
 	}
 
-rel_pkt_buf:
-	if (cam_mem_put_cpu_buf(config.packet_handle))
-		CAM_WARN(CAM_SENSOR, "Failed in put the buffer: 0x%llx",
-			config.packet_handle);
-
+end:
 	return rc;
 }
 
@@ -449,14 +445,14 @@
 	if (pkt == NULL) {
 		CAM_ERR(CAM_SENSOR, "packet pos is invalid");
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	if ((len < sizeof(struct cam_packet)) ||
 		(pkt->cmd_buf_offset >= (len - sizeof(struct cam_packet)))) {
 		CAM_ERR(CAM_SENSOR, "Not enough buf provided");
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	cmd_desc = (struct cam_cmd_buf_desc *)
@@ -464,13 +460,13 @@
 	if (cmd_desc == NULL) {
 		CAM_ERR(CAM_SENSOR, "command descriptor pos is invalid");
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 	if (pkt->num_cmd_buf != 2) {
 		CAM_ERR(CAM_SENSOR, "Expected More Command Buffers : %d",
 			 pkt->num_cmd_buf);
 		rc = -EINVAL;
-		goto rel_pkt_buf;
+		goto end;
 	}
 
 	for (i = 0; i < pkt->num_cmd_buf; i++) {
@@ -481,20 +477,20 @@
 		if (rc < 0) {
 			CAM_ERR(CAM_SENSOR,
 				"Failed to parse the command Buffer Header");
-			goto rel_pkt_buf;
+			goto end;
 		}
 		if (cmd_desc[i].offset >= len) {
 			CAM_ERR(CAM_SENSOR,
 				"offset past length of buffer");
 			rc = -EINVAL;
-			goto rel_pkt_buf;
+			goto end;
 		}
 		remain_len = len - cmd_desc[i].offset;
 		if (cmd_desc[i].length > remain_len) {
 			CAM_ERR(CAM_SENSOR,
 				"Not enough buffer provided for cmd");
 			rc = -EINVAL;
-			goto rel_pkt_buf;
+			goto end;
 		}
 		cmd_buf = (uint32_t *)cmd_buf1;
 		cmd_buf += cmd_desc[i].offset/4;
@@ -505,30 +501,11 @@
 		if (rc < 0) {
 			CAM_ERR(CAM_SENSOR,
 				"Failed to parse the command Buffer Header");
-			goto rel_cmd_buf;
+			goto end;
 		}
-
-		if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-			CAM_WARN(CAM_SENSOR,
-				"Failed to put command Buffer : 0x%x",
-				cmd_desc[i].mem_handle);
 	}
 
-	if (cam_mem_put_cpu_buf(handle))
-		CAM_WARN(CAM_SENSOR, "Failed to put the command Buffer: 0x%llx",
-			handle);
-
-	return rc;
-
-rel_cmd_buf:
-	if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-		CAM_WARN(CAM_SENSOR, "Failed to put command Buffer : 0x%x",
-			cmd_desc[i].mem_handle);
-rel_pkt_buf:
-	if (cam_mem_put_cpu_buf(handle))
-		CAM_WARN(CAM_SENSOR, "Failed to put the command Buffer: 0x%llx",
-			handle);
-
+end:
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
index 8d2370d..9e4e388 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
@@ -340,7 +340,7 @@
 				sizeof(struct common_header)) {
 				CAM_ERR(CAM_SENSOR, "Not enough buffer");
 				rc = -EINVAL;
-				goto rel_buf;
+				goto end;
 			}
 			cmm_hdr = (struct common_header *)cmd_buf;
 			generic_op_code = cmm_hdr->fifth_byte;
@@ -356,7 +356,7 @@
 					CAM_ERR(CAM_SENSOR,
 						"Not enough buffer provided");
 					rc = -EINVAL;
-					goto rel_buf;
+					goto end;
 				}
 				tot_size = sizeof(struct i2c_rdwr_header) +
 					(sizeof(struct i2c_random_wr_payload) *
@@ -366,7 +366,7 @@
 					CAM_ERR(CAM_SENSOR,
 						"Not enough buffer provided");
 					rc = -EINVAL;
-					goto rel_buf;
+					goto end;
 				}
 
 				rc = cam_sensor_handle_random_write(
@@ -377,7 +377,7 @@
 					CAM_ERR(CAM_SENSOR,
 					"Failed in random write %d", rc);
 					rc = -EINVAL;
-					goto rel_buf;
+					goto end;
 				}
 
 				cmd_buf += cmd_length_in_bytes /
@@ -397,7 +397,7 @@
 					CAM_ERR(CAM_SENSOR,
 						"Not enough buffer provided");
 					rc = -EINVAL;
-					goto rel_buf;
+					goto end;
 				}
 
 				tot_size = sizeof(struct i2c_rdwr_header) +
@@ -409,7 +409,7 @@
 					CAM_ERR(CAM_SENSOR,
 						"Not enough buffer provided");
 					rc = -EINVAL;
-					goto rel_buf;
+					goto end;
 				}
 
 				rc = cam_sensor_handle_continuous_write(
@@ -419,7 +419,7 @@
 				if (rc < 0) {
 					CAM_ERR(CAM_SENSOR,
 					"Failed in continuous write %d", rc);
-					goto rel_buf;
+					goto end;
 				}
 
 				cmd_buf += cmd_length_in_bytes /
@@ -433,7 +433,7 @@
 					CAM_ERR(CAM_SENSOR,
 						"Not enough buffer space");
 					rc = -EINVAL;
-					goto rel_buf;
+					goto end;
 				}
 				if (generic_op_code ==
 					CAMERA_SENSOR_WAIT_OP_HW_UCND ||
@@ -447,7 +447,7 @@
 						CAM_ERR(CAM_SENSOR,
 							"delay hdl failed: %d",
 							rc);
-						goto rel_buf;
+						goto end;
 					}
 
 				} else if (generic_op_code ==
@@ -459,14 +459,14 @@
 						CAM_ERR(CAM_SENSOR,
 							"Random read fail: %d",
 							rc);
-						goto rel_buf;
+						goto end;
 					}
 				} else {
 					CAM_ERR(CAM_SENSOR,
 						"Wrong Wait Command: %d",
 						generic_op_code);
 					rc = -EINVAL;
-					goto rel_buf;
+					goto end;
 				}
 				break;
 			}
@@ -476,7 +476,7 @@
 					CAM_ERR(CAM_SENSOR,
 						"Not enough buffer space");
 					rc = -EINVAL;
-					goto rel_buf;
+					goto end;
 				}
 				rc = cam_sensor_handle_slave_info(
 					io_master, cmd_buf);
@@ -484,7 +484,7 @@
 					CAM_ERR(CAM_SENSOR,
 					"Handle slave info failed with rc: %d",
 					rc);
-					goto rel_buf;
+					goto end;
 				}
 				cmd_length_in_bytes =
 					sizeof(struct cam_cmd_i2c_info);
@@ -497,21 +497,13 @@
 				CAM_ERR(CAM_SENSOR, "Invalid Command Type:%d",
 					 cmm_hdr->cmd_type);
 				rc = -EINVAL;
-				goto rel_buf;
+				goto end;
 			}
 		}
 		i2c_reg_settings->is_settings_valid = 1;
-		if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-			CAM_WARN(CAM_SENSOR, "put failed for buffer :0x%x",
-				cmd_desc[i].mem_handle);
 	}
 
-	return rc;
-
-rel_buf:
-	if (cam_mem_put_cpu_buf(cmd_desc[i].mem_handle))
-		CAM_WARN(CAM_SENSOR, "put failed for buffer :0x%x",
-			cmd_desc[i].mem_handle);
+end:
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
index 02a7a1f..4eadee6 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
@@ -127,16 +127,14 @@
 		((size_t)cmd_desc->size > (len - (size_t)cmd_desc->offset))) {
 		CAM_ERR(CAM_UTIL, "invalid memory len:%zd and cmd desc size:%d",
 			len, cmd_desc->size);
-		rc = -EINVAL;
-		goto rel_kmd_buf;
+		return -EINVAL;
 	}
 
 	remain_len -= (size_t)cmd_desc->offset;
 	if ((size_t)packet->kmd_cmd_buf_offset >= remain_len) {
 		CAM_ERR(CAM_UTIL, "Invalid kmd cmd buf offset: %zu",
 			(size_t)packet->kmd_cmd_buf_offset);
-		rc = -EINVAL;
-		goto rel_kmd_buf;
+		return -EINVAL;
 	}
 
 	cpu_addr += (cmd_desc->offset / 4) + (packet->kmd_cmd_buf_offset / 4);
@@ -153,11 +151,6 @@
 	kmd_buf->size       = cmd_desc->size - cmd_desc->length;
 	kmd_buf->used_bytes = 0;
 
-rel_kmd_buf:
-	if (cam_mem_put_cpu_buf(cmd_desc->mem_handle))
-		CAM_WARN(CAM_UTIL, "Put KMD Buf failed for: 0x%x",
-			cmd_desc->mem_handle);
-
 	return rc;
 }
 
@@ -232,9 +225,6 @@
 			"patch is done for dst %pK with src %pK value %llx",
 			dst_cpu_addr, src_buf_iova_addr,
 			*((uint64_t *)dst_cpu_addr));
-		if (cam_mem_put_cpu_buf(patch_desc[i].dst_buf_hdl))
-			CAM_WARN(CAM_UTIL, "unable to put dst buf address:0x%x",
-				patch_desc[i].dst_buf_hdl);
 	}
 
 	return rc;
@@ -244,7 +234,7 @@
 	struct cam_cmd_buf_desc *cmd_buf,
 	cam_packet_generic_blob_handler blob_handler_cb, void *user_data)
 {
-	int       rc;
+	int       rc = 0;
 	uintptr_t  cpu_addr = 0;
 	size_t    buf_size;
 	size_t    remain_len = 0;
@@ -275,14 +265,14 @@
 		((size_t)cmd_buf->offset > (buf_size - sizeof(uint32_t)))) {
 		CAM_ERR(CAM_UTIL, "Invalid offset for cmd buf: %zu",
 			(size_t)cmd_buf->offset);
-		goto rel_cmd_buf;
+		return -EINVAL;
 	}
 	remain_len -= (size_t)cmd_buf->offset;
 
 	if (remain_len < (size_t)cmd_buf->length) {
 		CAM_ERR(CAM_UTIL, "Invalid length for cmd buf: %zu",
 			(size_t)cmd_buf->length);
-		goto rel_cmd_buf;
+		return -EINVAL;
 	}
 
 	blob_ptr = (uint32_t *)(((uint8_t *)cpu_addr) +
@@ -315,7 +305,7 @@
 				blob_type, blob_size, len_read,
 				cmd_buf->length);
 			rc = -EINVAL;
-			goto rel_cmd_buf;
+			goto end;
 		}
 
 		len_read += blob_block_size;
@@ -325,16 +315,12 @@
 		if (rc) {
 			CAM_ERR(CAM_UTIL, "Error in handling blob type %d %d",
 				blob_type, blob_size);
-			goto rel_cmd_buf;
+			goto end;
 		}
 
 		blob_ptr += (blob_block_size / sizeof(uint32_t));
 	}
 
-rel_cmd_buf:
-	if (cam_mem_put_cpu_buf(cmd_buf->mem_handle))
-		CAM_WARN(CAM_UTIL, "unable to put dst buf address: 0x%x",
-			cmd_buf->mem_handle);
-
+end:
 	return rc;
 }
diff --git a/drivers/media/platform/msm/npu/npu_common.h b/drivers/media/platform/msm/npu/npu_common.h
index 672b207..3438f4b 100644
--- a/drivers/media/platform/msm/npu/npu_common.h
+++ b/drivers/media/platform/msm/npu/npu_common.h
@@ -56,13 +56,13 @@
 };
 
 #define NPU_ERR(fmt, args...)                            \
-	pr_err("NPU_ERR: %s: %d " fmt "\n", __func__,  __LINE__, ##args)
+	pr_err("NPU_ERR: %s: %d " fmt, __func__,  __LINE__, ##args)
 #define NPU_WARN(fmt, args...)                           \
-	pr_warn("NPU_WARN: %s: %d " fmt "\n", __func__,  __LINE__, ##args)
+	pr_warn("NPU_WARN: %s: %d " fmt, __func__,  __LINE__, ##args)
 #define NPU_INFO(fmt, args...)                           \
-	pr_info("NPU_INFO: %s: %d " fmt "\n", __func__,  __LINE__, ##args)
+	pr_info("NPU_INFO: %s: %d " fmt, __func__,  __LINE__, ##args)
 #define NPU_DBG(fmt, args...)                           \
-	pr_debug("NPU_DBG: %s: %d " fmt "\n", __func__,  __LINE__, ##args)
+	pr_debug("NPU_DBG: %s: %d " fmt, __func__,  __LINE__, ##args)
 
 /* -------------------------------------------------------------------------
  * Data Structures
diff --git a/drivers/media/platform/msm/npu/npu_dev.c b/drivers/media/platform/msm/npu/npu_dev.c
index 196b51a..2edfa97 100644
--- a/drivers/media/platform/msm/npu/npu_dev.c
+++ b/drivers/media/platform/msm/npu/npu_dev.c
@@ -314,7 +314,6 @@
 void npu_disable_core_power(struct npu_device *npu_dev)
 {
 	struct npu_pwrctrl *pwr = &npu_dev->pwrctrl;
-	struct npu_thermalctrl *thermalctrl = &npu_dev->thermalctrl;
 
 	if (!pwr->pwr_vote_num)
 		return;
@@ -322,7 +321,7 @@
 	if (!pwr->pwr_vote_num) {
 		npu_disable_core_clocks(npu_dev);
 		npu_disable_regulators(npu_dev);
-		pwr->active_pwrlevel = thermalctrl->pwr_level;
+		pwr->active_pwrlevel = pwr->default_pwrlevel;
 		pwr->uc_pwrlevel = pwr->max_pwrlevel;
 		pwr->cdsprm_pwrlevel = pwr->max_pwrlevel;
 		NPU_DBG("setting back to power level=%d\n",
@@ -434,6 +433,24 @@
 	pwr_level_idx = npu_power_level_to_index(npu_dev, pwr_level_to_set);
 	pwrlevel = &npu_dev->pwrctrl.pwrlevels[pwr_level_idx];
 
+	ret = npu_host_notify_fw_pwr_state(npu_dev, pwr_level_to_set, false);
+	/*
+	 * if new power level is lower than current power level,
+	 * ignore fw notification failure, and apply the new power level.
+	 * otherwise remain the current power level.
+	 */
+
+	if (ret) {
+		NPU_WARN("notify fw new power level [%d] failed\n",
+			pwr_level_to_set);
+		if (pwr->active_pwrlevel < pwr_level_to_set) {
+			NPU_WARN("remain current power level [%d]\n",
+				pwr->active_pwrlevel);
+			return 0;
+		}
+
+		ret = 0;
+	}
 	for (i = 0; i < npu_dev->core_clk_num; i++) {
 		if (npu_is_exclude_rate_clock(
 			npu_dev->core_clks[i].clk_name))
diff --git a/drivers/media/platform/msm/npu/npu_firmware.h b/drivers/media/platform/msm/npu/npu_firmware.h
index 4a74791..8c0385d 100644
--- a/drivers/media/platform/msm/npu/npu_firmware.h
+++ b/drivers/media/platform/msm/npu/npu_firmware.h
@@ -44,6 +44,8 @@
 #define FW_CTRL_STATUS_EXECUTING_ACO_BIT        5
 #define FW_CTRL_STATUS_SHUTDOWN_DONE_BIT        12
 #define FW_CTRL_STATUS_STACK_CORRUPT_BIT        13
+#define FW_CTRL_STATUS_PWR_NOTIFY_DONE_BIT      16
+#define FW_CTRL_STATUS_PWR_NOTIFY_ERR_BIT       17
 
 /* 32 bit values of the bit fields above */
 #define FW_CTRL_STATUS_IPC_READY_VAL    (1 << FW_CTRL_STATUS_IPC_READY_BIT)
@@ -60,6 +62,10 @@
 			(1 << FW_CTRL_STATUS_SHUTDOWN_DONE_BIT)
 #define FW_CTRL_STATUS_STACK_CORRUPT_VAL \
 			(1 << FW_CTRL_STATUS_STACK_CORRUPT_BIT)
+#define FW_CTRL_STATUS_PWR_NOTIFY_DONE_VAL \
+				(1 << FW_CTRL_STATUS_PWR_NOTIFY_DONE_BIT)
+#define FW_CTRL_STATUS_PWR_NOTIFY_ERR_VAL \
+				(1 << FW_CTRL_STATUS_PWR_NOTIFY_ERR_BIT)
 
 /* NPU HOST Control/Status Register */
 /* bit fields definitions in CTRL STATUS REG */
diff --git a/drivers/media/platform/msm/npu/npu_host_ipc.h b/drivers/media/platform/msm/npu/npu_host_ipc.h
index d99d371..991d769 100644
--- a/drivers/media/platform/msm/npu/npu_host_ipc.h
+++ b/drivers/media/platform/msm/npu/npu_host_ipc.h
@@ -31,6 +31,8 @@
 #define NPU_IPC_CMD_LOAD_V2             0x00000009
 /* ipc_cmd_execute_packet_v2 */
 #define NPU_IPC_CMD_EXECUTE_V2          0x0000000A
+/* npu_ipc_cmd_notify_pwr_packet_t */
+#define NPU_IPC_CMD_NOTIFY_PWR          0x0000000B
 
 /* Messages sent **from** NPU */
 /* IPC Message Response -- uint32_t */
@@ -48,6 +50,8 @@
 #define NPU_IPC_MSG_LOOPBACK_DONE       0x00010005
 /* ipc_msg_execute_pkt_v2 */
 #define NPU_IPC_MSG_EXECUTE_V2_DONE     0x00010006
+/* struct ipc_msg_notify_pwr_pkt */
+#define NPU_IPC_MSG_NOTIFY_PWR_DONE     0x00010007
 
 /* Logging message size */
 /* Number 32-bit elements for the maximum log message size */
@@ -410,4 +414,27 @@
 	uint32_t shutdown_flags;
 };
 
+/*
+ * Power state notification packet definition
+ */
+enum npu_pwr_notification_type {
+	NPU_POWER_PRE_NOTIFY   = 0x00000001,
+	NPU_POWER_POST_NOTIFY  = 0x00000002,
+};
+
+struct ipc_cmd_notify_pwr_pkt {
+	struct ipc_cmd_header_pkt header;
+	/* enum npu_power_level */
+	uint32_t pwr_level;
+	/* enum npu_pwr_notification_type */
+	uint32_t notify_type;
+};
+
+/*
+ * NOTIFY_PWR cmd response packet definition
+ */
+struct ipc_msg_notify_pwr_pkt {
+	struct ipc_msg_header_pkt header;
+};
+
 #endif /* NPU_HOST_IPC_H */
diff --git a/drivers/media/platform/msm/npu/npu_mgr.c b/drivers/media/platform/msm/npu/npu_mgr.c
index 3c716da..726a25b 100644
--- a/drivers/media/platform/msm/npu/npu_mgr.c
+++ b/drivers/media/platform/msm/npu/npu_mgr.c
@@ -54,8 +54,9 @@
 static int npu_send_misc_cmd(struct npu_device *npu_dev, uint32_t q_idx,
 	void *cmd_ptr);
 static int npu_queue_event(struct npu_client *client, struct npu_kevent *evt);
-static int npu_notify_dsp(struct npu_device *npu_dev, bool pwr_up);
 static int npu_notify_aop(struct npu_device *npu_dev, bool on);
+static int npu_notify_fw_pwr_state(struct npu_device *npu_dev,
+	uint32_t pwr_level, bool post);
 
 /* -------------------------------------------------------------------------
  * Function Definitions - Init / Deinit
@@ -112,8 +113,9 @@
 
 	/* Boot the NPU subsystem */
 	host_ctx->subsystem_handle = subsystem_get_local("npu");
-	if (IS_ERR(host_ctx->subsystem_handle)) {
+	if (IS_ERR_OR_NULL(host_ctx->subsystem_handle)) {
 		NPU_ERR("pil load npu fw failed\n");
+		host_ctx->subsystem_handle = NULL;
 		ret = -ENODEV;
 		goto subsystem_get_fail;
 	}
@@ -140,8 +142,15 @@
 		goto wait_fw_ready_fail;
 	}
 
-	npu_notify_dsp(npu_dev, true);
 	host_ctx->fw_state = FW_ENABLED;
+
+	ret = npu_notify_fw_pwr_state(npu_dev, npu_dev->pwrctrl.active_pwrlevel,
+		true);
+	if (ret) {
+		NPU_ERR("notify fw pwr on failed\n");
+		goto notify_fw_pwr_state_fail;
+	}
+
 	host_ctx->fw_error = false;
 	host_ctx->fw_ref_cnt++;
 	reinit_completion(&host_ctx->fw_deinit_done);
@@ -157,14 +166,16 @@
 
 	return ret;
 
+notify_fw_pwr_state_fail:
+	npu_disable_irq(npu_dev);
 wait_fw_ready_fail:
 	npu_disable_post_pil_clocks(npu_dev);
 enable_post_clk_fail:
 subsystem_get_fail:
-enable_sys_cache_fail:
 	npu_disable_sys_cache(npu_dev);
+enable_sys_cache_fail:
 	npu_disable_core_power(npu_dev);
-	if (!IS_ERR(host_ctx->subsystem_handle))
+	if (!IS_ERR_OR_NULL(host_ctx->subsystem_handle))
 		subsystem_put_local(host_ctx->subsystem_handle);
 enable_pw_fail:
 	host_ctx->fw_state = FW_DISABLED;
@@ -175,7 +186,6 @@
 void fw_deinit(struct npu_device *npu_dev, bool ssr, bool fw_alive)
 {
 	struct npu_host_ctx *host_ctx = &npu_dev->host_ctx;
-	struct ipc_cmd_shutdown_pkt cmd_shutdown_pkt;
 	struct npu_network *network = NULL;
 	int ret = 0, i;
 
@@ -196,50 +206,26 @@
 		return;
 	}
 
-	npu_disable_irq(npu_dev);
-
-	if (fw_alive) {
-		/* Command header */
-		cmd_shutdown_pkt.header.cmd_type = NPU_IPC_CMD_SHUTDOWN;
-		cmd_shutdown_pkt.header.size =
-			sizeof(struct ipc_cmd_shutdown_pkt);
-		cmd_shutdown_pkt.header.trans_id =
-			atomic_add_return(1, &host_ctx->ipc_trans_id);
-		cmd_shutdown_pkt.header.flags = 0xF;
-		ret = npu_host_ipc_send_cmd(npu_dev,
-			IPC_QUEUE_CMD_HIGH_PRIORITY, &cmd_shutdown_pkt);
-
-		NPU_DBG("NPU_IPC_CMD_SHUTDOWN sent status: %d\n", ret);
-
-		if (ret) {
-			NPU_ERR("npu_host_ipc_send_cmd failed\n");
-		} else {
-			/* Keep reading ctrl status until NPU shuts down */
-			NPU_DBG("waiting for shutdown status from fw\n");
-			if (wait_for_status_ready(npu_dev,
-				REG_NPU_FW_CTRL_STATUS,
-				FW_CTRL_STATUS_SHUTDOWN_DONE_VAL)) {
-				NPU_ERR("wait for fw shutdown timedout\n");
-				ret = -ETIMEDOUT;
-			}
-		}
-	}
-
-	npu_disable_post_pil_clocks(npu_dev);
-	npu_disable_sys_cache(npu_dev);
-
 	/*
-	 * if fw is still alive, notify dsp before power off
-	 * otherwise delay 500 ms to make sure dsp has finished
+	 * if fw is still alive, notify fw before power off
+	 * otherwise if ssr happens or notify fw returns failure
+	 * delay 500 ms to make sure dsp has finished
 	 * its own ssr handling.
 	 */
-	if (fw_alive)
-		npu_notify_dsp(npu_dev, false);
-	else
+	if (fw_alive) {
+		ret = npu_notify_fw_pwr_state(npu_dev, NPU_PWRLEVEL_OFF, false);
+		if (ret) {
+			NPU_WARN("notify fw pwr off failed\n");
+			msleep(500);
+		}
+	} else {
 		msleep(500);
+	}
 
+	npu_disable_irq(npu_dev);
+	npu_disable_post_pil_clocks(npu_dev);
+	npu_disable_sys_cache(npu_dev);
 	npu_disable_core_power(npu_dev);
-
 	subsystem_put_local(host_ctx->subsystem_handle);
 	host_ctx->fw_state = FW_DISABLED;
 
@@ -258,13 +244,86 @@
 	npu_notify_aop(npu_dev, false);
 }
 
+/* notify fw current power level */
+static int npu_notify_fw_pwr_state(struct npu_device *npu_dev,
+	uint32_t pwr_level, bool post)
+{
+	struct npu_host_ctx *host_ctx = &npu_dev->host_ctx;
+	struct ipc_cmd_notify_pwr_pkt pwr_notify_pkt;
+	int ret = 0;
+	bool shutdown = false, bringup = false;
+	uint32_t reg_val;
+
+	if (post && (pwr_level != NPU_PWRLEVEL_OFF)) {
+		NPU_DBG("Notify fw BRINGUP\n");
+		bringup = true;
+	}
+
+	if (!post && (pwr_level == NPU_PWRLEVEL_OFF)) {
+		NPU_DBG("Notify fw SHUTDOWN\n");
+		shutdown = true;
+	}
+
+	/* Clear PWR_NOTIFY bits before sending cmd */
+	reg_val = REGR(npu_dev, REG_NPU_FW_CTRL_STATUS);
+	reg_val &=  ~(FW_CTRL_STATUS_PWR_NOTIFY_ERR_VAL|
+		FW_CTRL_STATUS_PWR_NOTIFY_DONE_VAL);
+	REGW(npu_dev, REG_NPU_FW_CTRL_STATUS, reg_val);
+	REGR(npu_dev, REG_NPU_FW_CTRL_STATUS);
+
+	/* send IPC command to FW */
+	pwr_notify_pkt.header.cmd_type = NPU_IPC_CMD_NOTIFY_PWR;
+	pwr_notify_pkt.header.size = sizeof(struct ipc_cmd_notify_pwr_pkt);
+	pwr_notify_pkt.header.trans_id =
+		atomic_add_return(1, &host_ctx->ipc_trans_id);
+	pwr_notify_pkt.header.flags = 0;
+	pwr_notify_pkt.pwr_level = pwr_level;
+	pwr_notify_pkt.notify_type = post ?
+		NPU_POWER_POST_NOTIFY : NPU_POWER_PRE_NOTIFY;
+
+	ret = npu_send_misc_cmd(npu_dev, IPC_QUEUE_CMD_HIGH_PRIORITY,
+		&pwr_notify_pkt);
+
+	if (ret) {
+		NPU_ERR("NPU_IPC_CMD_NOTIFY_PWR sent failed: %d\n", ret);
+	} else {
+		ret = wait_for_status_ready(npu_dev, REG_NPU_FW_CTRL_STATUS,
+			FW_CTRL_STATUS_PWR_NOTIFY_DONE_VAL);
+		if (!ret) {
+			reg_val = REGR(npu_dev, REG_NPU_FW_CTRL_STATUS);
+			if (reg_val & FW_CTRL_STATUS_PWR_NOTIFY_ERR_VAL) {
+				NPU_ERR("NOTIfY_PWR failed\n");
+				ret = -EPERM;
+			}
+		}
+
+		/* allow to send another misc cmd if timedout */
+		host_ctx->misc_cmd_pending = false;
+	}
+
+	return ret;
+}
+
+int npu_host_notify_fw_pwr_state(struct npu_device *npu_dev,
+	uint32_t pwr_level, bool post)
+{
+	struct npu_host_ctx *host_ctx = &npu_dev->host_ctx;
+	int ret;
+
+	mutex_lock(&host_ctx->lock);
+	ret = npu_notify_fw_pwr_state(npu_dev, pwr_level, post);
+	mutex_unlock(&host_ctx->lock);
+
+	return ret;
+}
+
 int npu_host_init(struct npu_device *npu_dev)
 {
 	int sts = 0;
 	struct npu_host_ctx *host_ctx = &npu_dev->host_ctx;
 
 	memset(host_ctx, 0, sizeof(*host_ctx));
-	init_completion(&host_ctx->loopback_done);
+	init_completion(&host_ctx->misc_cmd_done);
 	init_completion(&host_ctx->fw_deinit_done);
 	mutex_init(&host_ctx->lock);
 	atomic_set(&host_ctx->ipc_trans_id, 1);
@@ -348,7 +407,7 @@
 			}
 		}
 	}
-	complete_all(&host_ctx->loopback_done);
+	complete_all(&host_ctx->misc_cmd_done);
 	mutex_unlock(&host_ctx->lock);
 
 	return 1;
@@ -375,6 +434,7 @@
 	struct npu_host_ctx *host_ctx = &npu_dev->host_ctx;
 	int ret = 0;
 
+	mutex_lock(&host_ctx->lock);
 	log_packet.header.cmd_type = NPU_IPC_CMD_CONFIG_LOG;
 	log_packet.header.size = sizeof(struct ipc_cmd_log_state_pkt);
 	log_packet.header.trans_id =
@@ -389,6 +449,10 @@
 
 	if (ret)
 		NPU_ERR("npu_host_ipc_send_cmd failed\n");
+	else
+		host_ctx->misc_cmd_pending = false;
+
+	mutex_unlock(&host_ctx->lock);
 }
 
 static int wait_for_status_ready(struct npu_device *npu_dev,
@@ -416,11 +480,6 @@
 	return 0;
 }
 
-static int npu_notify_dsp(struct npu_device *npu_dev, bool pwr_up)
-{
-	return 0;
-}
-
 #define MAX_LEN 128
 
 static int npu_notify_aop(struct npu_device *npu_dev, bool on)
@@ -799,7 +858,9 @@
 
 		NPU_DBG("NPU_IPC_MSG_LOOPBACK_DONE loopbackParams: 0x%x\n",
 			lb_rsp_pkt->loopbackParams);
-		complete_all(&host_ctx->loopback_done);
+		host_ctx->misc_cmd_result = lb_rsp_pkt->header.status;
+		host_ctx->misc_cmd_pending = false;
+		complete_all(&host_ctx->misc_cmd_done);
 		break;
 	}
 	default:
@@ -926,6 +987,8 @@
 	struct npu_host_ctx *host_ctx = &npu_dev->host_ctx;
 	int ret = 0;
 
+	WARN_ON(!mutex_is_locked(&host_ctx->lock));
+
 	if (network->fw_error || host_ctx->fw_error ||
 		(host_ctx->fw_state == FW_DISABLED)) {
 		NPU_ERR("fw is in error state or disabled\n");
@@ -956,16 +1019,23 @@
 	struct npu_host_ctx *host_ctx = &npu_dev->host_ctx;
 	int ret = 0;
 
-	mutex_lock(&host_ctx->lock);
+	WARN_ON(!mutex_is_locked(&host_ctx->lock));
+
 	if (host_ctx->fw_error || (host_ctx->fw_state == FW_DISABLED)) {
 		NPU_ERR("fw is in error state or disabled\n");
 		ret = -EIO;
+	} else if (host_ctx->misc_cmd_pending) {
+		NPU_ERR("Another misc cmd is pending\n");
+		ret = -EBUSY;
 	} else {
 		NPU_DBG("Send cmd %d\n",
 			((struct ipc_cmd_header_pkt *)cmd_ptr)->cmd_type);
+		host_ctx->misc_cmd_pending = true;
+		reinit_completion(&host_ctx->misc_cmd_done);
 		ret = npu_host_ipc_send_cmd(npu_dev, q_idx, cmd_ptr);
+		if (ret)
+			host_ctx->misc_cmd_pending = false;
 	}
-	mutex_unlock(&host_ctx->lock);
 
 	return ret;
 }
@@ -1660,6 +1730,8 @@
 	if (ret)
 		return ret;
 
+	mutex_lock(&host_ctx->lock);
+
 	loopback_packet.header.cmd_type = NPU_IPC_CMD_LOOPBACK;
 	loopback_packet.header.size = sizeof(struct ipc_cmd_loopback_pkt);
 	loopback_packet.header.trans_id =
@@ -1667,7 +1739,6 @@
 	loopback_packet.header.flags = 0;
 	loopback_packet.loopbackParams = 15;
 
-	reinit_completion(&host_ctx->loopback_done);
 	ret = npu_send_misc_cmd(npu_dev, IPC_QUEUE_APPS_EXEC, &loopback_packet);
 
 	if (ret) {
@@ -1675,19 +1746,26 @@
 		goto loopback_exit;
 	}
 
+	mutex_unlock(&host_ctx->lock);
+
 	ret = wait_for_completion_interruptible_timeout(
-		&host_ctx->loopback_done,
+		&host_ctx->misc_cmd_done,
 		(host_ctx->fw_dbg_mode & FW_DBG_MODE_INC_TIMEOUT) ?
 		NW_DEBUG_TIMEOUT : NW_CMD_TIMEOUT);
 
+	mutex_lock(&host_ctx->lock);
+
 	if (!ret) {
 		NPU_ERR("npu: NPU_IPC_CMD_LOOPBACK time out\n");
 		ret = -ETIMEDOUT;
 	} else if (ret < 0) {
 		NPU_ERR("Wait for loopback done interrupted by signal\n");
+	} else {
+		ret = host_ctx->misc_cmd_result;
 	}
 
 loopback_exit:
+	mutex_unlock(&host_ctx->lock);
 	fw_deinit(npu_dev, false, true);
 
 	return ret;
diff --git a/drivers/media/platform/msm/npu/npu_mgr.h b/drivers/media/platform/msm/npu/npu_mgr.h
index 9e16d8b..226344a 100644
--- a/drivers/media/platform/msm/npu/npu_mgr.h
+++ b/drivers/media/platform/msm/npu/npu_mgr.h
@@ -72,7 +72,7 @@
 	int32_t power_vote_num;
 	struct work_struct irq_work;
 	struct workqueue_struct *wq;
-	struct completion loopback_done;
+	struct completion misc_cmd_done;
 	struct completion fw_deinit_done;
 	int32_t network_num;
 	struct npu_network networks[MAX_LOADED_NETWORK];
@@ -86,6 +86,8 @@
 	uint32_t wdg_irq_sts;
 	bool fw_error;
 	bool cancel_work;
+	bool misc_cmd_pending;
+	uint32_t misc_cmd_result;
 };
 
 struct npu_device;
@@ -126,6 +128,8 @@
 	struct msm_npu_patch_buf_info *patch_buf_info);
 int32_t npu_host_loopback_test(struct npu_device *npu_dev);
 void npu_host_cleanup_networks(struct npu_client *client);
+int npu_host_notify_fw_pwr_state(struct npu_device *npu_dev,
+	uint32_t pwr_level, bool post);
 
 void npu_dump_debug_timeout_stats(struct npu_device *npu_dev);
 
diff --git a/drivers/media/platform/msm/vidc/msm_vdec.c b/drivers/media/platform/msm/vidc/msm_vdec.c
index 9a7fd28..6c466ce 100644
--- a/drivers/media/platform/msm/vidc/msm_vdec.c
+++ b/drivers/media/platform/msm/vidc/msm_vdec.c
@@ -480,7 +480,15 @@
 		.fourcc = V4L2_PIX_FMT_NV12,
 		.num_planes = 2,
 		.y_max_stride = 8192,
-		.y_buffer_alignment = 256,
+		.y_buffer_alignment = 512,
+		.uv_max_stride = 8192,
+		.uv_buffer_alignment = 256,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_NV21,
+		.num_planes = 2,
+		.y_max_stride = 8192,
+		.y_buffer_alignment = 512,
 		.uv_max_stride = 8192,
 		.uv_buffer_alignment = 256,
 	},
diff --git a/drivers/media/platform/msm/vidc/msm_venc.c b/drivers/media/platform/msm/vidc/msm_venc.c
index 04750b5..caaade4 100644
--- a/drivers/media/platform/msm/vidc/msm_venc.c
+++ b/drivers/media/platform/msm/vidc/msm_venc.c
@@ -1015,7 +1015,15 @@
 		.fourcc = V4L2_PIX_FMT_NV12,
 		.num_planes = 2,
 		.y_max_stride = 8192,
-		.y_buffer_alignment = 256,
+		.y_buffer_alignment = 512,
+		.uv_max_stride = 8192,
+		.uv_buffer_alignment = 256,
+	},
+	{
+		.fourcc = V4L2_PIX_FMT_NV21,
+		.num_planes = 2,
+		.y_max_stride = 8192,
+		.y_buffer_alignment = 512,
 		.uv_max_stride = 8192,
 		.uv_buffer_alignment = 256,
 	},
@@ -1515,9 +1523,11 @@
 		inst->clk_data.low_latency_mode = !!ctrl->val;
 		break;
 	case V4L2_CID_MPEG_VIDC_VENC_HDR_INFO: {
-		u32 info_type = (ctrl->val >> 28);
+		u32 info_type = ((u32)ctrl->val >> 28) & 0xF;
 		u32 val = (ctrl->val & 0xFFFFFFF);
 
+		dprintk(VIDC_DBG, "Ctrl:%d, HDR Info with value %u (%#X)",
+				info_type, val, ctrl->val);
 		switch (info_type) {
 		case MSM_VIDC_RGB_PRIMARY_00:
 			mdisp_sei->nDisplayPrimariesX[0] = val;
@@ -1557,8 +1567,8 @@
 			break;
 		default:
 			dprintk(VIDC_ERR,
-				"Unknown Ctrl:%d, not part of HDR Info",
-					info_type);
+				"Unknown Ctrl:%d, not part of HDR Info with value %u",
+					info_type, val);
 			}
 		}
 		break;
diff --git a/drivers/media/platform/msm/vidc/msm_vidc_buffer_calculations.c b/drivers/media/platform/msm/vidc/msm_vidc_buffer_calculations.c
index 0d14c9fa..116df60 100644
--- a/drivers/media/platform/msm/vidc/msm_vidc_buffer_calculations.c
+++ b/drivers/media/platform/msm/vidc/msm_vidc_buffer_calculations.c
@@ -1224,15 +1224,13 @@
 static inline u32 calculate_enc_scratch_size(struct msm_vidc_inst *inst,
 	u32 width, u32 height, u32 work_mode, u32 lcu_size)
 {
-	u32 ALIGNedWidth, ALIGNedHeight, bitstream_size;
+	u32 aligned_width, aligned_height, bitstream_size;
 	u32 total_bitbin_buffers = 0, size_singlePipe, bitbin_size = 0;
 	u32 sao_bin_buffer_size, padded_bin_size, size = 0;
 
-	ALIGNedWidth = ALIGN(width, lcu_size);
-	ALIGNedHeight = ALIGN(height, lcu_size);
-	bitstream_size = ALIGNedWidth * ALIGNedHeight * 3;
-	if (bitstream_size > (352 * 288 * 4))
-		bitstream_size = (bitstream_size >> 2);
+	aligned_width = ALIGN(width, lcu_size);
+	aligned_height = ALIGN(height, lcu_size);
+	bitstream_size = msm_vidc_calculate_enc_output_frame_size(inst);
 
 	bitstream_size = ALIGN(bitstream_size, VENUS_DMA_ALIGNMENT);
 	if (work_mode == HFI_WORKMODE_2) {
@@ -1241,7 +1239,7 @@
 		bitbin_size = ALIGN(bitbin_size, VENUS_DMA_ALIGNMENT);
 	} else {
 		total_bitbin_buffers = 1;
-		bitstream_size = ALIGNedWidth * ALIGNedHeight * 3;
+		bitstream_size = aligned_width * aligned_height * 3;
 		bitbin_size = ALIGN(bitstream_size, VENUS_DMA_ALIGNMENT);
 	}
 	size_singlePipe = bitbin_size / 2;
@@ -1460,7 +1458,8 @@
 	leftline_buf_ctrl_size_FE = ((VENUS_DMA_ALIGNMENT + 64 *
 		(height_coded >> 4)) +
 		(VENUS_DMA_ALIGNMENT << (num_vpp_pipes - 1)) - 1) &
-		(~((VENUS_DMA_ALIGNMENT << (num_vpp_pipes - 1)) - 1)) * 1;
+		(~((VENUS_DMA_ALIGNMENT << (num_vpp_pipes - 1)) - 1)) *
+		num_vpp_pipes;
 	leftline_buf_meta_recony = ((VENUS_DMA_ALIGNMENT + 64 *
 		((height_coded) / (8 * (ten_bit ? 4 : 8)))) * num_vpp_pipes);
 	leftline_buf_meta_recony = ALIGN(leftline_buf_meta_recony,
@@ -1482,6 +1481,9 @@
 		* (num_ref + 1);
 	h265e_colrcbuf_size = (((width_lcu_num + 7) >> 3) *
 		16 * 2 * height_lcu_num);
+	if (num_vpp_pipes > 1)
+		h265e_colrcbuf_size = ALIGN(h265e_colrcbuf_size,
+			VENUS_DMA_ALIGNMENT) * num_vpp_pipes;
 	h265e_colrcbuf_size = ALIGN(h265e_colrcbuf_size,
 		VENUS_DMA_ALIGNMENT) * HFI_MAX_COL_FRAME;
 	h265e_framerc_bufsize = (is_h265) ? (256 + 16 *
@@ -1533,10 +1535,10 @@
 		h265e_lcubitmap_bufsize + line_buf_sde_size +
 		topline_bufsize_fe_1stg_sao + override_buffer_size +
 		bse_reg_buffer_size + vpp_reg_buffer_size +
-		sps_pps_slice_hdr + bse_slice_cmd_buffer_size +
-		ir_buffer_size + slice_info_bufsize + lambda_lut_size +
-		se_stats_bufsize + temp_scratch_mv_bufsize + output_mv_bufsize
-		+ 1024;
+		sps_pps_slice_hdr + slice_cmd_buffer_size +
+		bse_slice_cmd_buffer_size + ir_buffer_size + slice_info_bufsize
+		+ lambda_lut_size + se_stats_bufsize + temp_scratch_mv_bufsize
+		+ output_mv_bufsize + 1024;
 	return size;
 }
 
@@ -1623,7 +1625,7 @@
 			metadata_stride, meta_buf_height);
 		size = (aligned_height + chroma_height) * aligned_width +
 			meta_size_y + meta_size_c;
-		size = (size * ((num_ref)+2)) + 4096;
+		size = (size * (num_ref+3)) + 4096;
 	} else {
 		ref_buf_height = (height + (HFI_VENUS_HEIGHT_ALIGNMENT - 1))
 			& (~(HFI_VENUS_HEIGHT_ALIGNMENT - 1));
@@ -1656,7 +1658,7 @@
 		meta_size_c = hfi_ubwc_metadata_plane_buffer_size(
 			metadata_stride, meta_buf_height);
 		size = ref_buf_size + meta_size_y + meta_size_c;
-		size = (size * ((num_ref)+2)) + 4096;
+		size = (size * (num_ref+3)) + 4096;
 	}
 	return size;
 }
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index bc7682e..7d70340 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -730,7 +730,7 @@
 		.num_different_channels = 1,
 	};
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		if (wil->vifs[i]) {
 			wdev = vif_to_wdev(wil->vifs[i]);
 			params.iftype_num[wdev->iftype]++;
@@ -751,7 +751,7 @@
 	};
 	bool check_combos = false;
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		struct wil6210_vif *vif_pos = wil->vifs[i];
 
 		if (vif_pos && vif != vif_pos) {
@@ -2106,7 +2106,7 @@
 	int rc, i;
 	struct wiphy *wiphy = wil_to_wiphy(wil);
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		struct wil6210_vif *vif = wil->vifs[i];
 		struct net_device *ndev;
 		struct cfg80211_beacon_data bcon = {};
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index db2db0d..06e51a3 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -1512,7 +1512,7 @@
 		if (p->status != wil_sta_connected)
 			continue;
 
-		vif = (mid < wil->max_vifs) ? wil->vifs[mid] : NULL;
+		vif = (mid < GET_MAX_VIFS(wil)) ? wil->vifs[mid] : NULL;
 		if (vif) {
 			rc = wil_cid_fill_sinfo(vif, i, sinfo);
 			if (rc)
@@ -1732,7 +1732,7 @@
 			break;
 		}
 		mid = (p->status != wil_sta_unused) ? p->mid : U8_MAX;
-		if (mid < wil->max_vifs) {
+		if (mid < GET_MAX_VIFS(wil)) {
 			struct wil6210_vif *vif = wil->vifs[mid];
 
 			if (vif->wdev.iftype == NL80211_IFTYPE_STATION &&
@@ -1809,7 +1809,7 @@
 	int i;
 
 	mutex_lock(&wil->vif_mutex);
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		vif = wil->vifs[i];
 
 		if (vif) {
@@ -2041,7 +2041,7 @@
 	/* iterate over all MIDs and show per-cid statistics. Then show the
 	 * global statistics
 	 */
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		vif = wil->vifs[i];
 
 		seq_printf(s, "MID %d ", i);
@@ -2097,7 +2097,7 @@
 	if (rc)
 		return rc;
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		vif = wil->vifs[i];
 		if (!vif)
 			continue;
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index c706103..d3502c1 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -687,7 +687,7 @@
 	int i;
 	struct wil6210_vif *vif;
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		vif = wil->vifs[i];
 		if (vif)
 			wil_bcast_fini(vif);
@@ -1520,7 +1520,7 @@
 
 	lockdep_assert_held(&wil->vif_mutex);
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		struct wil6210_vif *vif = wil->vifs[i];
 
 		if (vif)
@@ -1583,7 +1583,7 @@
 	struct wireless_dev *wdev;
 	int i, rc;
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		vif = wil->vifs[i];
 		if (!vif)
 			continue;
@@ -1659,7 +1659,7 @@
 	wil_abort_scan_all_vifs(wil, false);
 	mutex_unlock(&wil->vif_mutex);
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		vif = wil->vifs[i];
 		if (vif) {
 			cancel_work_sync(&vif->disconnect_worker);
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index 00d48f5..9dba15e1 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -21,7 +21,7 @@
 	struct wil6210_vif *vif;
 	struct net_device *ndev_i;
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		vif = wil->vifs[i];
 		if (vif) {
 			ndev_i = vif_to_ndev(vif);
@@ -157,7 +157,7 @@
 		struct wil6210_vif *vif;
 
 		if (!ring->va || !txdata->enabled ||
-		    txdata->mid >= wil->max_vifs)
+		    txdata->mid >= GET_MAX_VIFS(wil))
 			continue;
 
 		vif = wil->vifs[txdata->mid];
@@ -307,7 +307,7 @@
 {
 	u8 i;
 
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		if (!wil->vifs[i])
 			return i;
 	}
@@ -514,7 +514,7 @@
 	bool any_active = wil_has_active_ifaces(wil, true, false);
 
 	ASSERT_RTNL();
-	if (mid >= wil->max_vifs) {
+	if (mid >= GET_MAX_VIFS(wil)) {
 		wil_err(wil, "invalid MID: %d\n", mid);
 		return;
 	}
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index 4180449..4df0099 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -165,7 +165,7 @@
 	struct wil6210_vif *vif;
 	int i;
 
-	for (i = 1; i < wil->max_vifs; i++) {
+	for (i = 1; i < GET_MAX_VIFS(wil); i++) {
 		vif = wil->vifs[i];
 		if (vif) {
 			wil_vif_prepare_stop(vif);
diff --git a/drivers/net/wireless/ath/wil6210/pm.c b/drivers/net/wireless/ath/wil6210/pm.c
index 6a49aa8..a9a4af2 100644
--- a/drivers/net/wireless/ath/wil6210/pm.c
+++ b/drivers/net/wireless/ath/wil6210/pm.c
@@ -15,7 +15,7 @@
 	int i;
 
 	mutex_lock(&wil->vif_mutex);
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		struct wil6210_vif *vif = wil->vifs[i];
 
 		if (vif && test_bit(wil_vif_fwconnected, vif->status))
@@ -29,7 +29,7 @@
 	int i;
 
 	mutex_lock(&wil->vif_mutex);
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		struct wil6210_vif *vif = wil->vifs[i];
 
 		if (vif)
@@ -118,7 +118,7 @@
 
 	/* interface is running */
 	mutex_lock(&wil->vif_mutex);
-	for (i = 0; i < wil->max_vifs; i++) {
+	for (i = 0; i < GET_MAX_VIFS(wil); i++) {
 		struct wil6210_vif *vif = wil->vifs[i];
 
 		if (!vif)
diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.c b/drivers/net/wireless/ath/wil6210/txrx_edma.c
index c23d507..542597b 100644
--- a/drivers/net/wireless/ath/wil6210/txrx_edma.c
+++ b/drivers/net/wireless/ath/wil6210/txrx_edma.c
@@ -443,6 +443,9 @@
 			     &ring->pa, ring->ctx);
 
 		wil_move_all_rx_buff_to_free_list(wil, ring);
+		dma_free_coherent(dev, sizeof(*ring->edma_rx_swtail.va),
+				  ring->edma_rx_swtail.va,
+				  ring->edma_rx_swtail.pa);
 		goto out;
 	}
 
@@ -823,18 +826,9 @@
 				   struct sk_buff *skb,
 				   struct wil_net_stats *stats)
 {
-	int error;
 	int l2_rx_status;
-	int l3_rx_status;
-	int l4_rx_status;
 	void *msg = wil_skb_rxstatus(skb);
 
-	error = wil_rx_status_get_error(msg);
-	if (!error) {
-		skb->ip_summed = CHECKSUM_UNNECESSARY;
-		return 0;
-	}
-
 	l2_rx_status = wil_rx_status_get_l2_rx_status(msg);
 	if (l2_rx_status != 0) {
 		wil_dbg_txrx(wil, "L2 RX error, l2_rx_status=0x%x\n",
@@ -863,17 +857,7 @@
 		return -EFAULT;
 	}
 
-	l3_rx_status = wil_rx_status_get_l3_rx_status(msg);
-	l4_rx_status = wil_rx_status_get_l4_rx_status(msg);
-	if (!l3_rx_status && !l4_rx_status)
-		skb->ip_summed = CHECKSUM_UNNECESSARY;
-	/* If HW reports bad checksum, let IP stack re-check it
-	 * For example, HW don't understand Microsoft IP stack that
-	 * mis-calculates TCP checksum - if it should be 0x0,
-	 * it writes 0xffff in violation of RFC 1624
-	 */
-	else
-		stats->rx_csum_err++;
+	skb->ip_summed = wil_rx_status_get_checksum(msg, stats);
 
 	return 0;
 }
diff --git a/drivers/net/wireless/ath/wil6210/txrx_edma.h b/drivers/net/wireless/ath/wil6210/txrx_edma.h
index 6d7268e..0decf54 100644
--- a/drivers/net/wireless/ath/wil6210/txrx_edma.h
+++ b/drivers/net/wireless/ath/wil6210/txrx_edma.h
@@ -505,6 +505,45 @@
 			    5, 6);
 }
 
+/* L4	L3	Expected result
+ * 0	0	Ok. No L3 and no L4 known protocols found.
+ *		Treated as L2 packet. (no offloads on this packet)
+ * 0	1	Ok. It means that L3 was found, and checksum check passed.
+ *		No known L4 protocol was found.
+ * 0	2	It means that L3 protocol was found, and checksum check failed.
+ *		No L4 known protocol was found.
+ * 1	any	Ok. It means that L4 was found, and checksum check passed.
+ * 3	0	Not a possible scenario.
+ * 3	1	Recalculate. It means that L3 protocol was found, and checksum
+ *		passed. But L4 checksum failed. Need to see if really failed,
+ *		or due to fragmentation.
+ * 3	2	Both L3 and L4 checksum check failed.
+ */
+static inline int wil_rx_status_get_checksum(void *msg,
+					     struct wil_net_stats *stats)
+{
+	int l3_rx_status = wil_rx_status_get_l3_rx_status(msg);
+	int l4_rx_status = wil_rx_status_get_l4_rx_status(msg);
+
+	if (l4_rx_status == 1)
+		return CHECKSUM_UNNECESSARY;
+
+	if (l4_rx_status == 0 && l3_rx_status == 1)
+		return CHECKSUM_UNNECESSARY;
+
+	if (l3_rx_status == 0 && l4_rx_status == 0)
+		/* L2 packet */
+		return CHECKSUM_NONE;
+
+	/* If HW reports bad checksum, let IP stack re-check it
+	 * For example, HW doesn't understand Microsoft IP stack that
+	 * mis-calculates TCP checksum - if it should be 0x0,
+	 * it writes 0xffff in violation of RFC 1624
+	 */
+	stats->rx_csum_err++;
+	return CHECKSUM_NONE;
+}
+
 static inline int wil_rx_status_get_security(void *msg)
 {
 	return WIL_GET_BITS(((struct wil_rx_status_compressed *)msg)->d0,
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index 835798c..b79e823 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -568,7 +568,7 @@
 };
 
 #define WIL_STA_TID_NUM (16)
-#define WIL_MCS_MAX (12) /* Maximum MCS supported */
+#define WIL_MCS_MAX (15) /* Maximum MCS supported */
 
 struct wil_net_stats {
 	unsigned long	rx_packets;
@@ -1082,6 +1082,7 @@
 #define vif_to_wil(v) (v->wil)
 #define vif_to_ndev(v) (v->ndev)
 #define vif_to_wdev(v) (&v->wdev)
+#define GET_MAX_VIFS(wil) min_t(int, (wil)->max_vifs, WIL_MAX_VIFS)
 
 static inline struct wil6210_vif *wdev_to_vif(struct wil6210_priv *wil,
 					      struct wireless_dev *wdev)
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 0ae5031..82e7a98 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -3398,7 +3398,7 @@
 
 		if (mid == MID_BROADCAST)
 			mid = 0;
-		if (mid >= ARRAY_SIZE(wil->vifs) || mid >= wil->max_vifs) {
+		if (mid >= GET_MAX_VIFS(wil)) {
 			wil_dbg_wmi(wil, "invalid mid %d, event skipped\n",
 				    mid);
 			return;
diff --git a/drivers/pci/controller/pci-msm.c b/drivers/pci/controller/pci-msm.c
index c1d3850..c870570 100644
--- a/drivers/pci/controller/pci-msm.c
+++ b/drivers/pci/controller/pci-msm.c
@@ -148,6 +148,8 @@
 #define MSM_PCIE_IOMMU_ATOMIC BIT(3)
 #define MSM_PCIE_IOMMU_FORCE_COHERENT BIT(4)
 
+#define MSM_PCIE_LTSSM_MASK (0x3f)
+
 #define PHY_READY_TIMEOUT_COUNT (10)
 #define XMLH_LINK_UP (0x400)
 #define MAX_PROP_SIZE (32)
@@ -326,6 +328,87 @@
 	MSM_PCIE_NO_WAKE_ENUMERATION = BIT(1)
 };
 
+enum msm_pcie_ltssm {
+	MSM_PCIE_LTSSM_DETECT_QUIET = 0x00,
+	MSM_PCIE_LTSSM_DETECT_ACT = 0x01,
+	MSM_PCIE_LTSSM_POLL_ACTIVE = 0x02,
+	MSM_PCIE_LTSSM_POLL_COMPLIANCE = 0x03,
+	MSM_PCIE_LTSSM_POLL_CONFIG = 0x04,
+	MSM_PCIE_LTSSM_PRE_DETECT_QUIET = 0x05,
+	MSM_PCIE_LTSSM_DETECT_WAIT = 0x06,
+	MSM_PCIE_LTSSM_CFG_LINKWD_START = 0x07,
+	MSM_PCIE_LTSSM_CFG_LINKWD_ACEPT = 0x08,
+	MSM_PCIE_LTSSM_CFG_LANENUM_WAIT = 0x09,
+	MSM_PCIE_LTSSM_CFG_LANENUM_ACEPT = 0x0a,
+	MSM_PCIE_LTSSM_CFG_COMPLETE = 0x0b,
+	MSM_PCIE_LTSSM_CFG_IDLE = 0x0c,
+	MSM_PCIE_LTSSM_RCVRY_LOCK = 0x0d,
+	MSM_PCIE_LTSSM_RCVRY_SPEED = 0x0e,
+	MSM_PCIE_LTSSM_RCVRY_RCVRCFG = 0x0f,
+	MSM_PCIE_LTSSM_RCVRY_IDLE = 0x10,
+	MSM_PCIE_LTSSM_RCVRY_EQ0 = 0x20,
+	MSM_PCIE_LTSSM_RCVRY_EQ1 = 0x21,
+	MSM_PCIE_LTSSM_RCVRY_EQ2 = 0x22,
+	MSM_PCIE_LTSSM_RCVRY_EQ3 = 0x23,
+	MSM_PCIE_LTSSM_L0 = 0x11,
+	MSM_PCIE_LTSSM_L0S = 0x12,
+	MSM_PCIE_LTSSM_L123_SEND_EIDLE = 0x13,
+	MSM_PCIE_LTSSM_L1_IDLE = 0x14,
+	MSM_PCIE_LTSSM_L2_IDLE = 0x15,
+	MSM_PCIE_LTSSM_L2_WAKE = 0x16,
+	MSM_PCIE_LTSSM_DISABLED_ENTRY = 0x17,
+	MSM_PCIE_LTSSM_DISABLED_IDLE = 0x18,
+	MSM_PCIE_LTSSM_DISABLED = 0x19,
+	MSM_PCIE_LTSSM_LPBK_ENTRY = 0x1a,
+	MSM_PCIE_LTSSM_LPBK_ACTIVE = 0x1b,
+	MSM_PCIE_LTSSM_LPBK_EXIT = 0x1c,
+	MSM_PCIE_LTSSM_LPBK_EXIT_TIMEOUT = 0x1d,
+	MSM_PCIE_LTSSM_HOT_RESET_ENTRY = 0x1e,
+	MSM_PCIE_LTSSM_HOT_RESET = 0x1f,
+};
+
+static const char * const msm_pcie_ltssm_str[] = {
+	[MSM_PCIE_LTSSM_DETECT_QUIET] = "LTSSM_DETECT_QUIET",
+	[MSM_PCIE_LTSSM_DETECT_ACT] = "LTSSM_DETECT_ACT",
+	[MSM_PCIE_LTSSM_POLL_ACTIVE] = "LTSSM_POLL_ACTIVE",
+	[MSM_PCIE_LTSSM_POLL_COMPLIANCE] = "LTSSM_POLL_COMPLIANCE",
+	[MSM_PCIE_LTSSM_POLL_CONFIG] = "LTSSM_POLL_CONFIG",
+	[MSM_PCIE_LTSSM_PRE_DETECT_QUIET] = "LTSSM_PRE_DETECT_QUIET",
+	[MSM_PCIE_LTSSM_DETECT_WAIT] = "LTSSM_DETECT_WAIT",
+	[MSM_PCIE_LTSSM_CFG_LINKWD_START] = "LTSSM_CFG_LINKWD_START",
+	[MSM_PCIE_LTSSM_CFG_LINKWD_ACEPT] = "LTSSM_CFG_LINKWD_ACEPT",
+	[MSM_PCIE_LTSSM_CFG_LANENUM_WAIT] = "LTSSM_CFG_LANENUM_WAIT",
+	[MSM_PCIE_LTSSM_CFG_LANENUM_ACEPT] = "LTSSM_CFG_LANENUM_ACEPT",
+	[MSM_PCIE_LTSSM_CFG_COMPLETE] = "LTSSM_CFG_COMPLETE",
+	[MSM_PCIE_LTSSM_CFG_IDLE] = "LTSSM_CFG_IDLE",
+	[MSM_PCIE_LTSSM_RCVRY_LOCK] = "LTSSM_RCVRY_LOCK",
+	[MSM_PCIE_LTSSM_RCVRY_SPEED] = "LTSSM_RCVRY_SPEED",
+	[MSM_PCIE_LTSSM_RCVRY_RCVRCFG] = "LTSSM_RCVRY_RCVRCFG",
+	[MSM_PCIE_LTSSM_RCVRY_IDLE] = "LTSSM_RCVRY_IDLE",
+	[MSM_PCIE_LTSSM_RCVRY_EQ0] = "LTSSM_RCVRY_EQ0",
+	[MSM_PCIE_LTSSM_RCVRY_EQ1] = "LTSSM_RCVRY_EQ1",
+	[MSM_PCIE_LTSSM_RCVRY_EQ2] = "LTSSM_RCVRY_EQ2",
+	[MSM_PCIE_LTSSM_RCVRY_EQ3] = "LTSSM_RCVRY_EQ3",
+	[MSM_PCIE_LTSSM_L0] = "LTSSM_L0",
+	[MSM_PCIE_LTSSM_L0S] = "LTSSM_L0S",
+	[MSM_PCIE_LTSSM_L123_SEND_EIDLE] = "LTSSM_L123_SEND_EIDLE",
+	[MSM_PCIE_LTSSM_L1_IDLE] = "LTSSM_L1_IDLE",
+	[MSM_PCIE_LTSSM_L2_IDLE] = "LTSSM_L2_IDLE",
+	[MSM_PCIE_LTSSM_L2_WAKE] = "LTSSM_L2_WAKE",
+	[MSM_PCIE_LTSSM_DISABLED_ENTRY] = "LTSSM_DISABLED_ENTRY",
+	[MSM_PCIE_LTSSM_DISABLED_IDLE] = "LTSSM_DISABLED_IDLE",
+	[MSM_PCIE_LTSSM_DISABLED] = "LTSSM_DISABLED",
+	[MSM_PCIE_LTSSM_LPBK_ENTRY] = "LTSSM_LPBK_ENTRY",
+	[MSM_PCIE_LTSSM_LPBK_ACTIVE] = "LTSSM_LPBK_ACTIVE",
+	[MSM_PCIE_LTSSM_LPBK_EXIT] = "LTSSM_LPBK_EXIT",
+	[MSM_PCIE_LTSSM_LPBK_EXIT_TIMEOUT] = "LTSSM_LPBK_EXIT_TIMEOUT",
+	[MSM_PCIE_LTSSM_HOT_RESET_ENTRY] = "LTSSM_HOT_RESET_ENTRY",
+	[MSM_PCIE_LTSSM_HOT_RESET] = "LTSSM_HOT_RESET",
+};
+
+#define TO_LTSSM_STR(state) ((state) >= ARRAY_SIZE(msm_pcie_ltssm_str) ? \
+				"LTSSM_INVALID" : msm_pcie_ltssm_str[state])
+
 enum msm_pcie_debugfs_option {
 	MSM_PCIE_OUTPUT_PCIE_INFO,
 	MSM_PCIE_DISABLE_LINK,
@@ -3852,8 +3935,8 @@
 	do {
 		usleep_range(LINK_UP_TIMEOUT_US_MIN, LINK_UP_TIMEOUT_US_MAX);
 		val =  readl_relaxed(dev->elbi + PCIE20_ELBI_SYS_STTS);
-		PCIE_DBG(dev, "PCIe RC%d: LTSSM_STATE:0x%x\n",
-			dev->rc_idx, (val >> 12) & 0x3f);
+		PCIE_DBG(dev, "PCIe RC%d: LTSSM_STATE: %s\n",
+			dev->rc_idx, TO_LTSSM_STR((val >> 12) & 0x3f));
 	} while ((!(val & XMLH_LINK_UP) ||
 		!msm_pcie_confirm_linkup(dev, false, false, NULL))
 		&& (link_check_count++ < dev->link_check_max_count));
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa.c b/drivers/platform/msm/ipa/ipa_v3/ipa.c
index 6e923f6..8901d41 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa.c
@@ -130,8 +130,6 @@
 static struct {
 	bool present[IPA_SMMU_CB_MAX];
 	bool arm_smmu;
-	bool fast_map;
-	bool s1_bypass_arr[IPA_SMMU_CB_MAX];
 	bool use_64_bit_dma_mask;
 	u32 ipa_base;
 	u32 ipa_size;
@@ -351,59 +349,34 @@
 
 static struct ipa_smmu_cb_ctx smmu_cb[IPA_SMMU_CB_MAX];
 
-struct iommu_domain *ipa3_get_smmu_domain(void)
+struct iommu_domain *ipa3_get_smmu_domain_by_type(enum ipa_smmu_cb_type cb_type)
 {
-	if (smmu_cb[IPA_SMMU_CB_AP].valid)
-		return smmu_cb[IPA_SMMU_CB_AP].mapping->domain;
+	if (VALID_IPA_SMMU_CB_TYPE(cb_type) && smmu_cb[cb_type].valid)
+		return smmu_cb[cb_type].iommu_domain;
 
-	IPAERR("CB not valid\n");
+	IPAERR("cb_type(%d) not valid\n", cb_type);
 
 	return NULL;
 }
 
+struct iommu_domain *ipa3_get_smmu_domain(void)
+{
+	return ipa3_get_smmu_domain_by_type(IPA_SMMU_CB_AP);
+}
+
 struct iommu_domain *ipa3_get_uc_smmu_domain(void)
 {
-	if (smmu_cb[IPA_SMMU_CB_UC].valid)
-		return smmu_cb[IPA_SMMU_CB_UC].mapping->domain;
-
-	IPAERR("CB not valid\n");
-
-	return NULL;
+	return ipa3_get_smmu_domain_by_type(IPA_SMMU_CB_UC);
 }
 
 struct iommu_domain *ipa3_get_wlan_smmu_domain(void)
 {
-	if (smmu_cb[IPA_SMMU_CB_WLAN].valid)
-		return smmu_cb[IPA_SMMU_CB_WLAN].iommu;
-
-	IPAERR("CB not valid\n");
-
-	return NULL;
+	return ipa3_get_smmu_domain_by_type(IPA_SMMU_CB_WLAN);
 }
 
 struct iommu_domain *ipa3_get_11ad_smmu_domain(void)
 {
-	if (smmu_cb[IPA_SMMU_CB_11AD].valid)
-		return smmu_cb[IPA_SMMU_CB_11AD].iommu;
-
-	IPAERR("CB not valid\n");
-
-	return NULL;
-}
-
-struct iommu_domain *ipa3_get_smmu_domain_by_type(enum ipa_smmu_cb_type cb_type)
-{
-
-	if ((cb_type == IPA_SMMU_CB_WLAN || cb_type == IPA_SMMU_CB_11AD)
-		&& smmu_cb[cb_type].valid)
-		return smmu_cb[cb_type].iommu;
-
-	if (smmu_cb[cb_type].valid)
-		return smmu_cb[cb_type].mapping->domain;
-
-	IPAERR("CB#%d not valid\n", cb_type);
-
-	return NULL;
+	return ipa3_get_smmu_domain_by_type(IPA_SMMU_CB_11AD);
 }
 
 struct device *ipa3_get_dma_dev(void)
@@ -6296,77 +6269,66 @@
 static int ipa_smmu_wlan_cb_probe(struct device *dev)
 {
 	struct ipa_smmu_cb_ctx *cb = ipa3_get_smmu_ctx(IPA_SMMU_CB_WLAN);
-	int atomic_ctx = 1;
-	int fast = 1;
-	int bypass = 1;
-	int ret;
+	int fast = 0;
+	int bypass = 0;
 	u32 add_map_size;
 	const u32 *add_map;
 	int i;
+	u32 iova_ap_mapping[2];
 
-	IPADBG("sub pdev=%pK\n", dev);
+	IPADBG("WLAN CB PROBE dev=%pK\n", dev);
 
 	if (!smmu_info.present[IPA_SMMU_CB_WLAN]) {
 		IPAERR("WLAN SMMU is disabled\n");
 		return 0;
 	}
 
-	cb->dev = dev;
-	cb->iommu = iommu_domain_alloc(dev->bus);
-	if (!cb->iommu) {
-		IPAERR("could not alloc iommu domain\n");
-		/* assume this failure is because iommu driver is not ready */
-		return -EPROBE_DEFER;
+	IPADBG("WLAN CB PROBE dev=%pK retrieving IOMMU mapping\n", dev);
+
+	cb->iommu_domain = iommu_get_domain_for_dev(dev);
+	if (IS_ERR_OR_NULL(cb->iommu_domain)) {
+		IPAERR("could not get iommu domain\n");
+		return -EINVAL;
 	}
+
+	IPADBG("WLAN CB PROBE mapping retrieved\n");
+
+	cb->dev   = dev;
 	cb->valid = true;
 
-	if (of_property_read_bool(dev->of_node, "qcom,smmu-s1-bypass") ||
-		ipa3_ctx->ipa_config_is_mhi) {
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_WLAN] = true;
-		ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_WLAN] = true;
-
-		if (iommu_domain_set_attr(cb->iommu,
-					DOMAIN_ATTR_S1_BYPASS,
-					&bypass)) {
-			IPAERR("couldn't set bypass\n");
-			cb->valid = false;
-			return -EIO;
-		}
-		IPADBG("WLAN SMMU S1 BYPASS\n");
-	} else {
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_WLAN] = false;
-		ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_WLAN] = false;
-
-		if (iommu_domain_set_attr(cb->iommu,
-					DOMAIN_ATTR_ATOMIC,
-					&atomic_ctx)) {
-			IPAERR("couldn't disable coherent HTW\n");
-			cb->valid = false;
-			return -EIO;
-		}
-		IPADBG(" WLAN SMMU ATTR ATOMIC\n");
-
-		if (smmu_info.fast_map) {
-			if (iommu_domain_set_attr(cb->iommu,
-						DOMAIN_ATTR_FAST,
-						&fast)) {
-				IPAERR("couldn't set fast map\n");
-				cb->valid = false;
-				return -EIO;
-			}
-			IPADBG("SMMU fast map set\n");
-		}
+	cb->va_start = cb->va_end  = cb->va_size = 0;
+	if (of_property_read_u32_array(
+			dev->of_node, "qcom,iommu-dma-addr-pool",
+			iova_ap_mapping, 2) == 0) {
+		cb->va_start = iova_ap_mapping[0];
+		cb->va_size  = iova_ap_mapping[1];
+		cb->va_end   = cb->va_start + cb->va_size;
 	}
 
-	pr_info("IPA smmu_info.s1_bypass_arr[WLAN]=%d smmu_info.fast_map=%d\n",
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_WLAN], smmu_info.fast_map);
+	IPADBG("WLAN CB PROBE dev=%pK va_start=0x%x va_size=0x%x\n",
+		   dev, cb->va_start, cb->va_size);
 
-	ret = iommu_attach_device(cb->iommu, dev);
-	if (ret) {
-		IPAERR("could not attach device ret=%d\n", ret);
-		cb->valid = false;
-		return ret;
-	}
+	/*
+	 * Prior to these calls to iommu_domain_get_attr(), these
+	 * attributes were set in this function relative to dtsi values
+	 * defined for this driver.  In other words, if corresponding ipa
+	 * driver owned values were found in the dtsi, they were read and
+	 * set here.
+	 *
+	 * In this new world, the developer will use iommu owned dtsi
+	 * settings to set them there.  This new logic below, simply
+	 * checks to see if they've been set in dtsi.  If so, the logic
+	 * further below acts accordingly...
+	 */
+	iommu_domain_get_attr(cb->iommu_domain, DOMAIN_ATTR_S1_BYPASS, &bypass);
+	iommu_domain_get_attr(cb->iommu_domain, DOMAIN_ATTR_FAST, &fast);
+
+	IPADBG(
+	  "WLAN CB PROBE dev=%pK DOMAIN ATTRS bypass=%d fast=%d\n",
+	  dev, bypass, fast);
+
+	ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_WLAN] = (bypass != 0);
+
 	/* MAP ipa-uc ram */
 	add_map = of_get_property(dev->of_node,
 		"qcom,additional-mapping", &add_map_size);
@@ -6391,123 +6353,88 @@
 				iova_p, pa_p, size_p);
 			IPADBG("mapping 0x%lx to 0x%pa size %d\n",
 				iova_p, &pa_p, size_p);
-			ipa3_iommu_map(cb->iommu,
+			ipa3_iommu_map(cb->iommu_domain,
 				iova_p, pa_p, size_p,
 				IOMMU_READ | IOMMU_WRITE | IOMMU_MMIO);
 		}
 	}
+
 	return 0;
 }
 
 static int ipa_smmu_uc_cb_probe(struct device *dev)
 {
 	struct ipa_smmu_cb_ctx *cb = ipa3_get_smmu_ctx(IPA_SMMU_CB_UC);
-	int atomic_ctx = 1;
-	int bypass = 1;
-	int fast = 1;
-	int ret;
+	int bypass = 0;
+	int fast = 0;
 	u32 iova_ap_mapping[2];
 
-	IPADBG("UC CB PROBE sub pdev=%pK\n", dev);
+	IPADBG("UC CB PROBE dev=%pK\n", dev);
 
 	if (!smmu_info.present[IPA_SMMU_CB_UC]) {
 		IPAERR("UC SMMU is disabled\n");
 		return 0;
 	}
 
-	ret = of_property_read_u32_array(dev->of_node, "qcom,iova-mapping",
-			iova_ap_mapping, 2);
-	if (ret) {
-		IPAERR("Fail to read UC start/size iova addresses\n");
-		return ret;
-	}
-	cb->va_start = iova_ap_mapping[0];
-	cb->va_size = iova_ap_mapping[1];
-	cb->va_end = cb->va_start + cb->va_size;
-	IPADBG("UC va_start=0x%x va_sise=0x%x\n", cb->va_start, cb->va_size);
-
 	if (smmu_info.use_64_bit_dma_mask) {
 		if (dma_set_mask(dev, DMA_BIT_MASK(64)) ||
-				dma_set_coherent_mask(dev, DMA_BIT_MASK(64))) {
+			dma_set_coherent_mask(dev, DMA_BIT_MASK(64))) {
 			IPAERR("DMA set 64bit mask failed\n");
 			return -EOPNOTSUPP;
 		}
 	} else {
 		if (dma_set_mask(dev, DMA_BIT_MASK(32)) ||
-				dma_set_coherent_mask(dev, DMA_BIT_MASK(32))) {
+			dma_set_coherent_mask(dev, DMA_BIT_MASK(32))) {
 			IPAERR("DMA set 32bit mask failed\n");
 			return -EOPNOTSUPP;
 		}
 	}
-	IPADBG("UC CB PROBE=%pK create IOMMU mapping\n", dev);
 
-	cb->dev = dev;
-	cb->mapping = __depr_arm_iommu_create_mapping(dev->bus,
-			cb->va_start, cb->va_size);
-	if (IS_ERR_OR_NULL(cb->mapping)) {
-		IPADBG("Fail to create mapping\n");
-		/* assume this failure is because iommu driver is not ready */
-		return -EPROBE_DEFER;
+	IPADBG("UC CB PROBE dev=%pK retrieving IOMMU mapping\n", dev);
+
+	cb->iommu_domain = iommu_get_domain_for_dev(dev);
+	if (IS_ERR_OR_NULL(cb->iommu_domain)) {
+		IPAERR("could not get iommu domain\n");
+		return -EINVAL;
 	}
-	IPADBG("SMMU mapping created\n");
+
+	IPADBG("UC CB PROBE mapping retrieved\n");
+
+	cb->dev   = dev;
 	cb->valid = true;
 
-	IPADBG("UC CB PROBE sub pdev=%pK set attribute\n", dev);
-
-	if (of_property_read_bool(dev->of_node, "qcom,smmu-s1-bypass") ||
-		ipa3_ctx->ipa_config_is_mhi) {
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_UC] = true;
-		ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_UC] = true;
-
-		if (iommu_domain_set_attr(cb->mapping->domain,
-			DOMAIN_ATTR_S1_BYPASS,
-			&bypass)) {
-			IPAERR("couldn't set bypass\n");
-			__depr_arm_iommu_release_mapping(cb->mapping);
-			cb->valid = false;
-			return -EIO;
-		}
-		IPADBG("UC SMMU S1 BYPASS\n");
-	} else {
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_UC] = false;
-		ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_UC] = false;
-
-		if (iommu_domain_set_attr(cb->mapping->domain,
-			DOMAIN_ATTR_ATOMIC,
-			&atomic_ctx)) {
-			IPAERR("couldn't set domain as atomic\n");
-			__depr_arm_iommu_release_mapping(cb->mapping);
-			cb->valid = false;
-			return -EIO;
-		}
-		IPADBG("SMMU atomic set\n");
-
-		if (smmu_info.fast_map) {
-			if (iommu_domain_set_attr(cb->mapping->domain,
-				DOMAIN_ATTR_FAST,
-				&fast)) {
-				IPAERR("couldn't set fast map\n");
-				__depr_arm_iommu_release_mapping(cb->mapping);
-				cb->valid = false;
-				return -EIO;
-			}
-			IPADBG("SMMU fast map set\n");
-		}
+	cb->va_start = cb->va_end  = cb->va_size = 0;
+	if (of_property_read_u32_array(
+			dev->of_node, "qcom,iommu-dma-addr-pool",
+			iova_ap_mapping, 2) == 0) {
+		cb->va_start = iova_ap_mapping[0];
+		cb->va_size  = iova_ap_mapping[1];
+		cb->va_end   = cb->va_start + cb->va_size;
 	}
 
-	pr_info("IPA smmu_info.s1_bypass_arr[UC]=%d smmu_info.fast_map=%d\n",
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_UC], smmu_info.fast_map);
+	IPADBG("UC CB PROBE dev=%pK va_start=0x%x va_size=0x%x\n",
+		   dev, cb->va_start, cb->va_size);
 
-	IPADBG("UC CB PROBE sub pdev=%pK attaching IOMMU device\n", dev);
-	ret = __depr_arm_iommu_attach_device(cb->dev, cb->mapping);
-	if (ret) {
-		IPAERR("could not attach device ret=%d\n", ret);
-		__depr_arm_iommu_release_mapping(cb->mapping);
-		cb->valid = false;
-		return ret;
-	}
+	/*
+	 * Prior to these calls to iommu_domain_get_attr(), these
+	 * attributes were set in this function relative to dtsi values
+	 * defined for this driver.  In other words, if corresponding ipa
+	 * driver owned values were found in the dtsi, they were read and
+	 * set here.
+	 *
+	 * In this new world, the developer will use iommu owned dtsi
+	 * settings to set them there.  This new logic below, simply
+	 * checks to see if they've been set in dtsi.  If so, the logic
+	 * further below acts accordingly...
+	 */
+	iommu_domain_get_attr(cb->iommu_domain, DOMAIN_ATTR_S1_BYPASS, &bypass);
+	iommu_domain_get_attr(cb->iommu_domain, DOMAIN_ATTR_FAST, &fast);
 
-	cb->next_addr = cb->va_end;
+	IPADBG("UC CB PROBE dev=%pK DOMAIN ATTRS bypass=%d fast=%d\n",
+		   dev, bypass, fast);
+
+	ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_UC] = (bypass != 0);
+
 	ipa3_ctx->uc_pdev = dev;
 
 	return 0;
@@ -6516,11 +6443,8 @@
 static int ipa_smmu_ap_cb_probe(struct device *dev)
 {
 	struct ipa_smmu_cb_ctx *cb = ipa3_get_smmu_ctx(IPA_SMMU_CB_AP);
-	int result;
-	int atomic_ctx = 1;
-	int fast = 1;
-	int bypass = 1;
-	u32 iova_ap_mapping[2];
+	int fast = 0;
+	int bypass = 0;
 	u32 add_map_size;
 	const u32 *add_map;
 	void *smem_addr;
@@ -6533,98 +6457,73 @@
 	u32 size_p;
 	phys_addr_t iova;
 	phys_addr_t pa;
+	u32 iova_ap_mapping[2];
 
-	IPADBG("AP CB probe: sub pdev=%pK\n", dev);
+	IPADBG("AP CB PROBE dev=%pK\n", dev);
 
 	if (!smmu_info.present[IPA_SMMU_CB_AP]) {
 		IPAERR("AP SMMU is disabled");
 		return 0;
 	}
 
-	result = of_property_read_u32_array(dev->of_node, "qcom,iova-mapping",
-		iova_ap_mapping, 2);
-	if (result) {
-		IPAERR("Fail to read AP start/size iova addresses\n");
-		return result;
-	}
-	cb->va_start = iova_ap_mapping[0];
-	cb->va_size = iova_ap_mapping[1];
-	cb->va_end = cb->va_start + cb->va_size;
-	IPADBG("AP va_start=0x%x va_sise=0x%x\n", cb->va_start, cb->va_size);
-
 	if (smmu_info.use_64_bit_dma_mask) {
 		if (dma_set_mask(dev, DMA_BIT_MASK(64)) ||
-				dma_set_coherent_mask(dev, DMA_BIT_MASK(64))) {
+			dma_set_coherent_mask(dev, DMA_BIT_MASK(64))) {
 			IPAERR("DMA set 64bit mask failed\n");
 			return -EOPNOTSUPP;
 		}
 	} else {
 		if (dma_set_mask(dev, DMA_BIT_MASK(32)) ||
-				dma_set_coherent_mask(dev, DMA_BIT_MASK(32))) {
+			dma_set_coherent_mask(dev, DMA_BIT_MASK(32))) {
 			IPAERR("DMA set 32bit mask failed\n");
 			return -EOPNOTSUPP;
 		}
 	}
 
-	cb->dev = dev;
-	cb->mapping = __depr_arm_iommu_create_mapping(dev->bus,
-					cb->va_start, cb->va_size);
-	if (IS_ERR_OR_NULL(cb->mapping)) {
-		IPADBG("Fail to create mapping\n");
-		/* assume this failure is because iommu driver is not ready */
-		return -EPROBE_DEFER;
+	IPADBG("AP CB PROBE dev=%pK retrieving IOMMU mapping\n", dev);
+
+	cb->iommu_domain = iommu_get_domain_for_dev(dev);
+	if (IS_ERR_OR_NULL(cb->iommu_domain)) {
+		IPAERR("could not get iommu domain\n");
+		return -EINVAL;
 	}
-	IPADBG("SMMU mapping created\n");
+
+	IPADBG("AP CB PROBE mapping retrieved\n");
+
+	cb->dev   = dev;
 	cb->valid = true;
 
-	if (of_property_read_bool(dev->of_node,
-		"qcom,smmu-s1-bypass") || ipa3_ctx->ipa_config_is_mhi) {
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_AP] = true;
-		ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_AP] = true;
-		if (iommu_domain_set_attr(cb->mapping->domain,
-				DOMAIN_ATTR_S1_BYPASS,
-				&bypass)) {
-			IPAERR("couldn't set bypass\n");
-			__depr_arm_iommu_release_mapping(cb->mapping);
-			cb->valid = false;
-			return -EIO;
-		}
-		IPADBG("AP/USB SMMU S1 BYPASS\n");
-	} else {
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_AP] = false;
-		ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_AP] = false;
-		if (iommu_domain_set_attr(cb->mapping->domain,
-				DOMAIN_ATTR_ATOMIC,
-				&atomic_ctx)) {
-			IPAERR("couldn't set domain as atomic\n");
-			__depr_arm_iommu_release_mapping(cb->mapping);
-			cb->valid = false;
-			return -EIO;
-		}
-		IPADBG("AP/USB SMMU atomic set\n");
-
-		if (smmu_info.fast_map) {
-			if (iommu_domain_set_attr(cb->mapping->domain,
-				DOMAIN_ATTR_FAST,
-				&fast)) {
-				IPAERR("couldn't set fast map\n");
-				__depr_arm_iommu_release_mapping(cb->mapping);
-				cb->valid = false;
-				return -EIO;
-			}
-			IPADBG("SMMU fast map set\n");
-		}
+	cb->va_start = cb->va_end  = cb->va_size = 0;
+	if (of_property_read_u32_array(
+			dev->of_node, "qcom,iommu-dma-addr-pool",
+			iova_ap_mapping, 2) == 0) {
+		cb->va_start = iova_ap_mapping[0];
+		cb->va_size  = iova_ap_mapping[1];
+		cb->va_end   = cb->va_start + cb->va_size;
 	}
 
-	pr_info("IPA smmu_info.s1_bypass_arr[AP]=%d smmu_info.fast_map=%d\n",
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_AP], smmu_info.fast_map);
+	IPADBG("AP CB PROBE dev=%pK va_start=0x%x va_size=0x%x\n",
+		   dev, cb->va_start, cb->va_size);
 
-	result = __depr_arm_iommu_attach_device(cb->dev, cb->mapping);
-	if (result) {
-		IPAERR("couldn't attach to IOMMU ret=%d\n", result);
-		cb->valid = false;
-		return result;
-	}
+	/*
+	 * Prior to these calls to iommu_domain_get_attr(), these
+	 * attributes were set in this function relative to dtsi values
+	 * defined for this driver.  In other words, if corresponding ipa
+	 * driver owned values were found in the dtsi, they were read and
+	 * set here.
+	 *
+	 * In this new world, the developer will use iommu owned dtsi
+	 * settings to set them there.  This new logic below, simply
+	 * checks to see if they've been set in dtsi.  If so, the logic
+	 * further below acts accordingly...
+	 */
+	iommu_domain_get_attr(cb->iommu_domain, DOMAIN_ATTR_S1_BYPASS, &bypass);
+	iommu_domain_get_attr(cb->iommu_domain, DOMAIN_ATTR_FAST, &fast);
+
+	IPADBG("AP CB PROBE dev=%pK DOMAIN ATTRS bypass=%d fast=%d\n",
+		   dev, bypass, fast);
+
+	ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_AP] = (bypass != 0);
 
 	add_map = of_get_property(dev->of_node,
 		"qcom,additional-mapping", &add_map_size);
@@ -6649,7 +6548,7 @@
 				iova_p, pa_p, size_p);
 			IPADBG("mapping 0x%lx to 0x%pa size %d\n",
 				iova_p, &pa_p, size_p);
-			ipa3_iommu_map(cb->mapping->domain,
+			ipa3_iommu_map(cb->iommu_domain,
 				iova_p, pa_p, size_p,
 				IOMMU_READ | IOMMU_WRITE | IOMMU_MMIO);
 		}
@@ -6693,11 +6592,12 @@
 				iova_p, pa_p, size_p);
 			IPADBG("mapping 0x%lx to 0x%pa size %d\n",
 				iova_p, &pa_p, size_p);
-			ipa3_iommu_map(cb->mapping->domain,
+			ipa3_iommu_map(cb->iommu_domain,
 				iova_p, pa_p, size_p,
 				IOMMU_READ | IOMMU_WRITE);
 
 	smmu_info.present[IPA_SMMU_CB_AP] = true;
+
 	ipa3_ctx->pdev = dev;
 	cb->next_addr = cb->va_end;
 
@@ -6706,50 +6606,51 @@
 
 static int ipa_smmu_11ad_cb_probe(struct device *dev)
 {
-	int ret;
-	int s1_bypass = 0;
+	int bypass = 0;
 	struct ipa_smmu_cb_ctx *cb = ipa3_get_smmu_ctx(IPA_SMMU_CB_11AD);
+	u32 iova_ap_mapping[2];
 
-	IPADBG("11ad CB probe: sub dev=%pK\n", dev);
+	IPADBG("11AD CB probe: dev=%pK\n", dev);
 
 	if (!smmu_info.present[IPA_SMMU_CB_11AD]) {
-		IPAERR("11ad SMMU is disabled");
+		IPAERR("11AD SMMU is disabled");
 		return 0;
 	}
 
-	cb->dev = dev;
-	cb->iommu = iommu_get_domain_for_dev(dev);
-	if (!cb->iommu) {
+	cb->iommu_domain = iommu_get_domain_for_dev(dev);
+	if (IS_ERR_OR_NULL(cb->iommu_domain)) {
 		IPAERR("could not get iommu domain\n");
-		/* assume this failure is because iommu driver is not ready */
-		return -EPROBE_DEFER;
+		return -EINVAL;
 	}
+
+	cb->dev   = dev;
 	cb->valid = true;
 
-	ret = iommu_domain_get_attr(
-		cb->iommu, DOMAIN_ATTR_S1_BYPASS, &s1_bypass);
-	if (ret) {
-		IPAERR("can't get DOMAIN_ATTR_S1_BYPASS\n");
-		return ret;
+	cb->va_start = cb->va_end  = cb->va_size = 0;
+	if (of_property_read_u32_array(
+			dev->of_node, "qcom,iommu-dma-addr-pool",
+			iova_ap_mapping, 2) == 0) {
+		cb->va_start = iova_ap_mapping[0];
+		cb->va_size  = iova_ap_mapping[1];
+		cb->va_end   = cb->va_start + cb->va_size;
 	}
 
-	if (s1_bypass) {
-		IPADBG("11AD SMMU S1 BYPASS\n");
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_11AD] = true;
-		ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_11AD] = true;
-	} else {
-		IPADBG("11AD SMMU S1 enabled\n");
-		smmu_info.s1_bypass_arr[IPA_SMMU_CB_11AD] = false;
-		ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_11AD] = false;
-	}
+	IPADBG("11AD CB PROBE dev=%pK va_start=0x%x va_size=0x%x\n",
+		   dev, cb->va_start, cb->va_size);
+
+	iommu_domain_get_attr(cb->iommu_domain, DOMAIN_ATTR_S1_BYPASS, &bypass);
+
+	IPADBG("11AD CB PROBE dev=%pK DOMAIN ATTRS bypass=%d\n",
+		   dev, bypass);
+
+	ipa3_ctx->s1_bypass_arr[IPA_SMMU_CB_11AD] = (bypass != 0);
 
 	if (of_property_read_bool(dev->of_node, "qcom,shared-cb")) {
-		IPADBG("using shared CB\n");
+		IPADBG("11AD using shared CB\n");
 		cb->shared = true;
 	}
 
 	return 0;
-	IPADBG("exit\n");
 }
 
 static int ipa_smmu_cb_probe(struct device *dev, enum ipa_smmu_cb_type cb_type)
@@ -6911,16 +6812,9 @@
 
 	if (of_property_read_bool(pdev_p->dev.of_node, "qcom,arm-smmu")) {
 		if (of_property_read_bool(pdev_p->dev.of_node,
-			"qcom,smmu-fast-map"))
-			smmu_info.fast_map = true;
-		if (of_property_read_bool(pdev_p->dev.of_node,
 			"qcom,use-64-bit-dma-mask"))
 			smmu_info.use_64_bit_dma_mask = true;
 		smmu_info.arm_smmu = true;
-	} else if (of_property_read_bool(pdev_p->dev.of_node,
-				"qcom,msm-smmu")) {
-		IPAERR("Legacy IOMMU not supported\n");
-		result = -EOPNOTSUPP;
 	} else {
 		if (of_property_read_bool(pdev_p->dev.of_node,
 			"qcom,use-64-bit-dma-mask")) {
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_client.c b/drivers/platform/msm/ipa/ipa_v3/ipa_client.c
index e4daeb6..f8b373a 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_client.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_client.c
@@ -525,7 +525,7 @@
 	struct iommu_domain *smmu_domain;
 	int res;
 
-	if (cb_type >= IPA_SMMU_CB_MAX) {
+	if (!VALID_IPA_SMMU_CB_TYPE(cb_type)) {
 		IPAERR("invalid cb_type\n");
 		return -EINVAL;
 	}
@@ -572,7 +572,7 @@
 	int i;
 	struct page *page;
 
-	if (cb_type >= IPA_SMMU_CB_MAX) {
+	if (!VALID_IPA_SMMU_CB_TYPE(cb_type)) {
 		IPAERR("invalid cb_type\n");
 		return -EINVAL;
 	}
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
index e3e7329..0649a46 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_i.h
@@ -445,8 +445,7 @@
 struct ipa_smmu_cb_ctx {
 	bool valid;
 	struct device *dev;
-	struct dma_iommu_mapping *mapping;
-	struct iommu_domain *iommu;
+	struct iommu_domain *iommu_domain;
 	unsigned long next_addr;
 	u32 va_start;
 	u32 va_size;
@@ -1433,6 +1432,9 @@
 	IPA_SMMU_CB_MAX
 };
 
+#define VALID_IPA_SMMU_CB_TYPE(t) \
+	((t) >= IPA_SMMU_CB_AP && (t) < IPA_SMMU_CB_MAX)
+
 /**
  * struct ipa3_char_device_context - IPA character device
  * @class: pointer to the struct class
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_mhi_proxy.c b/drivers/platform/msm/ipa/ipa_v3/ipa_mhi_proxy.c
index bc0f891..b8b3bbf 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_mhi_proxy.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_mhi_proxy.c
@@ -725,7 +725,7 @@
 				imp_ctx->dev_info.chdb_base, PAGE_SIZE,
 				&iova_p, &pa_p, &size_p);
 
-			iommu_unmap(cb->mapping->domain, iova_p, size_p);
+			iommu_unmap(cb->iommu_domain, iova_p, size_p);
 		}
 	}
 	if (!imp_ctx->in_lpm &&
@@ -836,7 +836,7 @@
 			imp_ctx->dev_info.chdb_base, PAGE_SIZE,
 			&iova_p, &pa_p, &size_p);
 
-		ret = ipa3_iommu_map(cb->mapping->domain, iova_p, pa_p, size_p,
+		ret = ipa3_iommu_map(cb->iommu_domain, iova_p, pa_p, size_p,
 			IOMMU_READ | IOMMU_WRITE | IOMMU_MMIO);
 		if (ret)
 			goto fail;
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_uc_wdi.c b/drivers/platform/msm/ipa/ipa_v3/ipa_uc_wdi.c
index d85ed91..5ee7a61 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_uc_wdi.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_uc_wdi.c
@@ -515,7 +515,7 @@
 	if (len > PAGE_SIZE)
 		va = roundup(cb->next_addr, len);
 
-	ret = ipa3_iommu_map(cb->mapping->domain, va, rounddown(pa, PAGE_SIZE),
+	ret = ipa3_iommu_map(cb->iommu_domain, va, rounddown(pa, PAGE_SIZE),
 			true_len,
 			device ? (prot | IOMMU_MMIO) : prot);
 	if (ret) {
@@ -544,7 +544,7 @@
 		return -EINVAL;
 	}
 
-	ret = ipa3_iommu_map(cb->mapping->domain, va, rounddown(pa, PAGE_SIZE),
+	ret = ipa3_iommu_map(cb->iommu_domain, va, rounddown(pa, PAGE_SIZE),
 			true_len,
 			device ? (prot | IOMMU_MMIO) : prot);
 	if (ret) {
@@ -596,7 +596,7 @@
 		phys = sg->dma_address;
 		len = PAGE_ALIGN(sg->offset + sg->length);
 
-		ret = ipa3_iommu_map(cb->mapping->domain, va, phys, len, prot);
+		ret = ipa3_iommu_map(cb->iommu_domain, va, phys, len, prot);
 		if (ret) {
 			IPAERR("iommu map failed for pa=%pa len=%zu\n",
 					&phys, len);
@@ -613,7 +613,7 @@
 
 bad_mapping:
 	for_each_sg(sgt->sgl, sg, count, i)
-		iommu_unmap(cb->mapping->domain, sg_dma_address(sg),
+		iommu_unmap(cb->iommu_domain, sg_dma_address(sg),
 				sg_dma_len(sg));
 	return -EINVAL;
 }
@@ -647,7 +647,7 @@
 		phys = sg->dma_address;
 		len = PAGE_ALIGN(sg->offset + sg->length);
 
-		ret = ipa3_iommu_map(cb->mapping->domain, va, phys, len, prot);
+		ret = ipa3_iommu_map(cb->iommu_domain, va, phys, len, prot);
 		if (ret) {
 			IPAERR("iommu map failed for pa=%pa len=%zu\n",
 					&phys, len);
@@ -664,7 +664,7 @@
 
 bad_mapping:
 	for_each_sg(sgt->sgl, sg, count, i)
-		iommu_unmap(cb->mapping->domain, sg_dma_address(sg),
+		iommu_unmap(cb->iommu_domain, sg_dma_address(sg),
 				sg_dma_len(sg));
 	return -EINVAL;
 }
@@ -692,7 +692,7 @@
 	for (i = start; i <= end; i++) {
 		if (wdi_res[i].valid) {
 			for (j = 0; j < wdi_res[i].nents; j++) {
-				iommu_unmap(cb->mapping->domain,
+				iommu_unmap(cb->iommu_domain,
 					wdi_res[i].res[j].iova,
 					wdi_res[i].res[j].size);
 				ipa3_ctx->wdi_map_cnt--;
@@ -728,7 +728,7 @@
 	for (i = start; i <= end; i++) {
 		if (wdi_res[i].valid) {
 			for (j = 0; j < wdi_res[i].nents; j++) {
-				iommu_unmap(cb->mapping->domain,
+				iommu_unmap(cb->iommu_domain,
 					wdi_res[i].res[j].iova,
 					wdi_res[i].res[j].size);
 				ipa3_ctx->wdi_map_cnt--;
@@ -2894,7 +2894,7 @@
 	for (i = 0; i < num_buffers; i++) {
 		IPADBG("i=%d pa=0x%pa iova=0x%lx sz=0x%zx\n", i,
 			&info[i].pa, info[i].iova, info[i].size);
-		info[i].result = ipa3_iommu_map(cb->iommu,
+		info[i].result = ipa3_iommu_map(cb->iommu_domain,
 			rounddown(info[i].iova, PAGE_SIZE),
 			rounddown(info[i].pa, PAGE_SIZE),
 			roundup(info[i].size + info[i].pa -
@@ -2924,7 +2924,7 @@
 	for (i = 0; i < num_buffers; i++) {
 		IPADBG("i=%d pa=0x%pa iova=0x%lx sz=0x%zx\n", i,
 			&info[i].pa, info[i].iova, info[i].size);
-		info[i].result = iommu_unmap(cb->iommu,
+		info[i].result = iommu_unmap(cb->iommu_domain,
 			rounddown(info[i].iova, PAGE_SIZE),
 			roundup(info[i].size + info[i].pa -
 				rounddown(info[i].pa, PAGE_SIZE), PAGE_SIZE));
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index d27a637..b81dbd9 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -1033,6 +1033,38 @@
  *	%NL80211_ATTR_CHANNEL_WIDTH,%NL80211_ATTR_NSS attributes with its
  *	address(specified in %NL80211_ATTR_MAC).
  *
+ * @NL80211_CMD_GET_FTM_RESPONDER_STATS: Retrieve FTM responder statistics, in
+ *	the %NL80211_ATTR_FTM_RESPONDER_STATS attribute.
+ *
+ * @NL80211_CMD_PEER_MEASUREMENT_START: start a (set of) peer measurement(s)
+ *	with the given parameters, which are encapsulated in the nested
+ *	%NL80211_ATTR_PEER_MEASUREMENTS attribute. Optionally, MAC address
+ *	randomization may be enabled and configured by specifying the
+ *	%NL80211_ATTR_MAC and %NL80211_ATTR_MAC_MASK attributes.
+ *	If a timeout is requested, use the %NL80211_ATTR_TIMEOUT attribute.
+ *	A u64 cookie for further %NL80211_ATTR_COOKIE use is is returned in
+ *	the netlink extended ack message.
+ *
+ *	To cancel a measurement, close the socket that requested it.
+ *
+ *	Measurement results are reported to the socket that requested the
+ *	measurement using @NL80211_CMD_PEER_MEASUREMENT_RESULT when they
+ *	become available, so applications must ensure a large enough socket
+ *	buffer size.
+ *
+ *	Depending on driver support it may or may not be possible to start
+ *	multiple concurrent measurements.
+ * @NL80211_CMD_PEER_MEASUREMENT_RESULT: This command number is used for the
+ *	result notification from the driver to the requesting socket.
+ * @NL80211_CMD_PEER_MEASUREMENT_COMPLETE: Notification only, indicating that
+ *	the measurement completed, using the measurement cookie
+ *	(%NL80211_ATTR_COOKIE).
+ *
+ * @NL80211_CMD_NOTIFY_RADAR: Notify the kernel that a radar signal was
+ *	detected and reported by a neighboring device on the channel
+ *	indicated by %NL80211_ATTR_WIPHY_FREQ and other attributes
+ *	determining the width and type.
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -1245,6 +1277,14 @@
 
 	NL80211_CMD_CONTROL_PORT_FRAME,
 
+	NL80211_CMD_GET_FTM_RESPONDER_STATS,
+
+	NL80211_CMD_PEER_MEASUREMENT_START,
+	NL80211_CMD_PEER_MEASUREMENT_RESULT,
+	NL80211_CMD_PEER_MEASUREMENT_COMPLETE,
+
+	NL80211_CMD_NOTIFY_RADAR,
+
 	/* add new commands above here */
 
 	/* used to define NL80211_CMD_MAX below */
@@ -5223,6 +5263,17 @@
  * @NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT: Driver/device can omit all data
  *	except for supported rates from the probe request content if requested
  *	by the %NL80211_SCAN_FLAG_MIN_PREQ_CONTENT flag.
+ * @NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER: Driver supports enabling fine
+ *	timing measurement responder role.
+ *
+ * @NL80211_EXT_FEATURE_CAN_REPLACE_PTK0: Driver/device confirm that they are
+ *	able to rekey an in-use key correctly. Userspace must not rekey PTK keys
+ *	if this flag is not set. Ignoring this can leak clear text packets and/or
+ *	freeze the connection.
+ *
+ * @NL80211_EXT_FEATURE_AIRTIME_FAIRNESS: Driver supports getting airtime
+ *	fairness for transmitted packets and has enabled airtime fairness
+ *	scheduling.
  *
  * @NUM_NL80211_EXT_FEATURES: number of extended features.
  * @MAX_NL80211_EXT_FEATURES: highest extended feature index.
@@ -5259,6 +5310,9 @@
 	NL80211_EXT_FEATURE_TXQS,
 	NL80211_EXT_FEATURE_SCAN_RANDOM_SN,
 	NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT,
+	NL80211_EXT_FEATURE_CAN_REPLACE_PTK0,
+	NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER,
+	NL80211_EXT_FEATURE_AIRTIME_FAIRNESS,
 
 	/* add new features before the definition below */
 	NUM_NL80211_EXT_FEATURES,
diff --git a/include/uapi/media/cam_defs.h b/include/uapi/media/cam_defs.h
index d78d175..8bc5613 100644
--- a/include/uapi/media/cam_defs.h
+++ b/include/uapi/media/cam_defs.h
@@ -56,6 +56,10 @@
 #define CAM_UBWC_CFG_VERSION_1              1
 #define CAM_UBWC_CFG_VERSION_2              2
 
+#define CAM_MAX_ACQ_RES    5
+#define CAM_MAX_HW_SPLIT   3
+
+
 /**
  * enum flush_type_t - Identifies the various flush types
  *
@@ -551,6 +555,7 @@
 #define CAM_API_COMPAT_CONSTANT                   0xFEFEFEFE
 
 #define CAM_ACQUIRE_HW_STRUCT_VERSION_1           1
+#define CAM_ACQUIRE_HW_STRUCT_VERSION_2           2
 
 /**
  * struct cam_acquire_hw_cmd_v1 - Control payload for acquire HW IOCTL (Ver 1)
@@ -581,6 +586,51 @@
 	uint64_t        resource_hdl;
 };
 
+/**
+ * struct cam_acquired_hw_info - Update the acquired hardware info
+ *
+ * @acquired_hw_id:     Acquired hardware mask
+ * @acquired_hw_path:   Acquired path mask for an input
+ *                      if input splits into multiple paths,
+ *                      its updated per hardware
+ * valid_acquired_hw:   Valid num of acquired hardware
+ */
+struct cam_acquired_hw_info {
+	uint32_t    acquired_hw_id[CAM_MAX_ACQ_RES];
+	uint32_t    acquired_hw_path[CAM_MAX_ACQ_RES][CAM_MAX_HW_SPLIT];
+	uint32_t    valid_acquired_hw;
+};
+
+/**
+ * struct cam_acquire_hw_cmd_v2 - Control payload for acquire HW IOCTL (Ver 2)
+ *
+ * @struct_version:     = CAM_ACQUIRE_HW_STRUCT_VERSION_2 for this struct
+ *                      This value should be the first 32-bits in any structure
+ *                      related to this IOCTL. So that if the struct needs to
+ *                      change, we can first read the starting 32-bits, get the
+ *                      version number and then typecast the data to struct
+ *                      accordingly.
+ * @reserved:           Reserved field for 64-bit alignment
+ * @session_handle:     Session handle for the acquire command
+ * @dev_handle:         Device handle to be returned
+ * @handle_type:        Tells you how to interpret the variable resource_hdl-
+ *                      1 = user pointer, 2 = mem handle
+ * @data_size:          Total size of data contained in memory pointed
+ *                      to by resource_hdl
+ * @resource_hdl:       Resource handle that refers to the actual
+ *                      resource data.
+ */
+struct cam_acquire_hw_cmd_v2 {
+	uint32_t                    struct_version;
+	uint32_t                    reserved;
+	int32_t                     session_handle;
+	int32_t                     dev_handle;
+	uint32_t                    handle_type;
+	uint32_t                    data_size;
+	uint64_t                    resource_hdl;
+	struct cam_acquired_hw_info hw_info;
+};
+
 #define CAM_RELEASE_HW_STRUCT_VERSION_1           1
 
 /**
diff --git a/include/uapi/media/cam_isp.h b/include/uapi/media/cam_isp.h
index bba8eeb..38521ab 100644
--- a/include/uapi/media/cam_isp.h
+++ b/include/uapi/media/cam_isp.h
@@ -98,6 +98,22 @@
 #define CAM_ISP_GENERIC_BLOB_TYPE_UBWC_CONFIG_V2      6
 #define CAM_ISP_GENERIC_BLOB_TYPE_IFE_CORE_CONFIG     7
 
+#define CAM_ISP_VC_DT_CFG    4
+
+#define CAM_ISP_IFE0_HW          0x1
+#define CAM_ISP_IFE1_HW          0x2
+#define CAM_ISP_IFE0_LITE_HW     0x4
+#define CAM_ISP_IFE1_LITE_HW     0x8
+#define CAM_ISP_IFE2_LITE_HW     0x10
+
+#define CAM_ISP_PXL_PATH          0x1
+#define CAM_ISP_PPP_PATH          0x2
+#define CAM_ISP_LCR_PATH          0x4
+#define CAM_ISP_RDI0_PATH         0x8
+#define CAM_ISP_RDI1_PATH         0x10
+#define CAM_ISP_RDI2_PATH         0x20
+#define CAM_ISP_RDI3_PATH         0x40
+
 /* Query devices */
 /**
  * struct cam_isp_dev_cap_info - A cap info for particular hw type
@@ -159,6 +175,36 @@
 };
 
 /**
+ * struct cam_isp_out_port_info_v2 - An output port resource info
+ *
+ * @res_type:                   output resource type defined in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @format:                     output format of the resource
+ * @wdith:                      output width in pixels
+ * @height:                     output height in lines
+ * @comp_grp_id:                composite group id for the resource.
+ * @split_point:                split point in pixels for the dual VFE.
+ * @secure_mode:                flag to tell if output should be run in secure
+ *                              mode or not. See cam_defs.h for definition
+ * @wm_mode:                    WM mode
+ * @out_port_res1:              Output reserved field
+ * @out_port_res2:              Output reserved field
+ *
+ */
+struct cam_isp_out_port_info_v2 {
+	uint32_t                res_type;
+	uint32_t                format;
+	uint32_t                width;
+	uint32_t                height;
+	uint32_t                comp_grp_id;
+	uint32_t                split_point;
+	uint32_t                secure_mode;
+	uint32_t                wm_mode;
+	uint32_t                out_port_res1;
+	uint32_t                out_port_res2;
+};
+
+/**
  * struct cam_isp_in_port_info - An input port resource info
  *
  * @res_type:                   input resource type define in file
@@ -221,6 +267,83 @@
 };
 
 /**
+ * struct cam_isp_in_port_info_v2 - An input port resource info
+ *
+ * @res_type:                   input resource type define in file
+ *                              cam_isp_vfe.h or cam_isp_ife.h
+ * @lane_type:                  lane type: c-phy or d-phy.
+ * @lane_num:                   active lane number
+ * @lane_cfg:                   lane configurations: 4 bits per lane
+ * @vc:                         input virtual channel number
+ * @dt:                         input data type number
+ * @num_valid_vc_dt:            valid vc and dt in array
+ * @format:                     input format
+ * @test_pattern:               test pattern for the testgen
+ * @usage_type:                 whether dual vfe is required
+ * @left_start:                 left input start offset in pixels
+ * @left_stop:                  left input stop offset in pixels
+ * @left_width:                 left input width in pixels
+ * @right_start:                right input start offset in pixels.
+ *                              Only for Dual VFE
+ * @right_stop:                 right input stop offset in pixels.
+ *                              only for Dual VFE
+ * @right_width:                right input width in pixels.
+ *                              only for dual VFE
+ * @line_start:                 top of the line number
+ * @line_stop:                  bottome of the line number
+ * @height:                     input height in lines
+ * @pixel_clk;                  sensor output clock
+ * @batch_size:                 batch size for HFR mode
+ * @dsp_mode:                   DSP stream mode (Defines as CAM_ISP_DSP_MODE_*)
+ * @hbi_cnt:                    HBI count for the camif input
+ * @cust_node:                  if any custom HW block is present before IFE
+ * @num_out_res:                number of the output resource associated
+ * @horizontal_bin:             Horizontal Binning info
+ * @qcfa_bin:                   Quadra Binning info
+ * @csid_res_1:                 payload for future use
+ * @csid_res_2:                 payload for future use
+ * @ife_res_1:                  payload for future use
+ * @ife_res_2:                  payload for future use
+ * @data:                       payload that contains the output resources
+ *
+ */
+struct cam_isp_in_port_info_v2 {
+	uint32_t                        res_type;
+	uint32_t                        lane_type;
+	uint32_t                        lane_num;
+	uint32_t                        lane_cfg;
+	uint32_t                        vc[CAM_ISP_VC_DT_CFG];
+	uint32_t                        dt[CAM_ISP_VC_DT_CFG];
+	uint32_t                        num_valid_vc_dt;
+	uint32_t                        format;
+	uint32_t                        test_pattern;
+	uint32_t                        usage_type;
+	uint32_t                        left_start;
+	uint32_t                        left_stop;
+	uint32_t                        left_width;
+	uint32_t                        right_start;
+	uint32_t                        right_stop;
+	uint32_t                        right_width;
+	uint32_t                        line_start;
+	uint32_t                        line_stop;
+	uint32_t                        height;
+	uint32_t                        pixel_clk;
+	uint32_t                        batch_size;
+	uint32_t                        dsp_mode;
+	uint32_t                        hbi_cnt;
+	uint32_t                        cust_node;
+	uint32_t                        num_out_res;
+	uint32_t                        offline_mode;
+	uint32_t                        horizontal_bin;
+	uint32_t                        qcfa_bin;
+	uint32_t                        csid_res_1;
+	uint32_t                        csid_res_2;
+	uint32_t                        ife_res_1;
+	uint32_t                        ife_res_2;
+	struct cam_isp_out_port_info_v2 data[1];
+};
+
+/**
  * struct cam_isp_resource - A resource bundle
  *
  * @resoruce_id:                resource id for the resource bundle
@@ -433,8 +556,6 @@
 	uint32_t    latency_buf_size;
 } __attribute__((packed));
 
-/* Acquire Device/HW v2 */
-
 /**
  * struct cam_isp_core_config - ISP core registers configuration
  *
diff --git a/include/uapi/media/msm_media_info.h b/include/uapi/media/msm_media_info.h
index 785a435..e8efd8b 100644
--- a/include/uapi/media/msm_media_info.h
+++ b/include/uapi/media/msm_media_info.h
@@ -40,10 +40,10 @@
 	 * . . . . . . . . . . . . . . . .  V
 	 * . . . . . . . . . . . . . . . .  --> Buffer size alignment
 	 *
-	 * Y_Stride : Width aligned to 128
-	 * UV_Stride : Width aligned to 128
-	 * Y_Scanlines: Height aligned to 32
-	 * UV_Scanlines: Height/2 aligned to 16
+	 * Y_Stride : Width aligned to 512
+	 * UV_Stride : Width aligned to 512
+	 * Y_Scanlines: Height aligned to 512
+	 * UV_Scanlines: Height/2 aligned to 256
 	 * Total size = align(Y_Stride * Y_Scanlines
 	 *          + UV_Stride * UV_Scanlines, 4096)
 	 */
@@ -75,10 +75,10 @@
 	 * . . . . . . . . . . . . . . . .  V
 	 * . . . . . . . . . . . . . . . .  --> Padding & Buffer size alignment
 	 *
-	 * Y_Stride : Width aligned to 128
-	 * UV_Stride : Width aligned to 128
-	 * Y_Scanlines: Height aligned to 32
-	 * UV_Scanlines: Height/2 aligned to 16
+	 * Y_Stride : Width aligned to 512
+	 * UV_Stride : Width aligned to 512
+	 * Y_Scanlines: Height aligned to 512
+	 * UV_Scanlines: Height/2 aligned to 256
 	 * Total size = align(Y_Stride * Y_Scanlines
 	 *          + UV_Stride * UV_Scanlines, 4096)
 	 */
@@ -775,16 +775,16 @@
 		goto invalid_input;
 
 	switch (color_fmt) {
-	case COLOR_FMT_NV21:
 	case COLOR_FMT_NV12:
-	case COLOR_FMT_NV12_UBWC:
-		alignment = 128;
-		stride = MSM_MEDIA_ALIGN(width, alignment);
-		break;
+	case COLOR_FMT_NV21:
 	case COLOR_FMT_NV12_512:
 		alignment = 512;
 		stride = MSM_MEDIA_ALIGN(width, alignment);
 		break;
+	case COLOR_FMT_NV12_UBWC:
+		alignment = 128;
+		stride = MSM_MEDIA_ALIGN(width, alignment);
+		break;
 	case COLOR_FMT_NV12_BPP10_UBWC:
 		alignment = 256;
 		stride = MSM_MEDIA_ALIGN(width, 192);
@@ -820,14 +820,14 @@
 	switch (color_fmt) {
 	case COLOR_FMT_NV21:
 	case COLOR_FMT_NV12:
-	case COLOR_FMT_NV12_UBWC:
-		alignment = 128;
-		stride = MSM_MEDIA_ALIGN(width, alignment);
-		break;
 	case COLOR_FMT_NV12_512:
 		alignment = 512;
 		stride = MSM_MEDIA_ALIGN(width, alignment);
 		break;
+	case COLOR_FMT_NV12_UBWC:
+		alignment = 128;
+		stride = MSM_MEDIA_ALIGN(width, alignment);
+		break;
 	case COLOR_FMT_NV12_BPP10_UBWC:
 		alignment = 256;
 		stride = MSM_MEDIA_ALIGN(width, 192);
@@ -861,15 +861,15 @@
 		goto invalid_input;
 
 	switch (color_fmt) {
-	case COLOR_FMT_NV21:
 	case COLOR_FMT_NV12:
+	case COLOR_FMT_NV21:
+	case COLOR_FMT_NV12_512:
+		alignment = 512;
+		break;
 	case COLOR_FMT_NV12_UBWC:
 	case COLOR_FMT_P010:
 		alignment = 32;
 		break;
-	case COLOR_FMT_NV12_512:
-		alignment = 512;
-		break;
 	case COLOR_FMT_NV12_BPP10_UBWC:
 	case COLOR_FMT_P010_UBWC:
 		alignment = 16;
@@ -900,14 +900,14 @@
 	switch (color_fmt) {
 	case COLOR_FMT_NV21:
 	case COLOR_FMT_NV12:
+	case COLOR_FMT_NV12_512:
+		alignment = 256;
+		break;
 	case COLOR_FMT_NV12_BPP10_UBWC:
 	case COLOR_FMT_P010_UBWC:
 	case COLOR_FMT_P010:
 		alignment = 16;
 		break;
-	case COLOR_FMT_NV12_512:
-		alignment = 256;
-		break;
 	case COLOR_FMT_NV12_UBWC:
 		alignment = 32;
 		break;