diff --git a/Documentation/devicetree/bindings/regulator/gdsc-regulator.txt b/Documentation/devicetree/bindings/regulator/gdsc-regulator.txt
index 4ef8d7a..a6b0cdd 100644
--- a/Documentation/devicetree/bindings/regulator/gdsc-regulator.txt
+++ b/Documentation/devicetree/bindings/regulator/gdsc-regulator.txt
@@ -72,7 +72,9 @@
  - qcom,en-rest-wait-val: Input value for EN_REST_WAIT controls state transition
 			  delay after receiving ack signal (gds_enr_ack) from the
 			  longest en_rest power switch chain.
-
+ - qcom,skip-disable-before-sw-enable: Presence denotes a hardware requirement
+					to leave the GDSC on that has been
+					enabled by an entity external to HLOS.
 Example:
 	gdsc_oxili_gx: qcom,gdsc@fd8c4024 {
 		compatible = "qcom,gdsc";
diff --git a/arch/arm64/boot/dts/qcom/msm-audio-lpass.dtsi b/arch/arm64/boot/dts/qcom/msm-audio-lpass.dtsi
index dcbfe47..bb05a2e 100644
--- a/arch/arm64/boot/dts/qcom/msm-audio-lpass.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm-audio-lpass.dtsi
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -286,6 +286,15 @@
 			compatible = "qcom,msm-dai-q6-dev";
 			qcom,msm-dai-q6-dev-id = <32770>;
 		};
+		proxy_rx: qcom,msm-dai-q6-proxy-rx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <8194>;
+		};
+
+		proxy_tx: qcom,msm-dai-q6-proxy-tx {
+			compatible = "qcom,msm-dai-q6-dev";
+			qcom,msm-dai-q6-dev-id = <8195>;
+		};
 
 		usb_audio_rx: qcom,msm-dai-q6-usb-audio-rx {
 			compatible = "qcom,msm-dai-q6-dev";
diff --git a/arch/arm64/boot/dts/qcom/sda429-bg-dvt2-wtp-overlay.dts b/arch/arm64/boot/dts/qcom/sda429-bg-dvt2-wtp-overlay.dts
index 1994c5c..78970d5 100644
--- a/arch/arm64/boot/dts/qcom/sda429-bg-dvt2-wtp-overlay.dts
+++ b/arch/arm64/boot/dts/qcom/sda429-bg-dvt2-wtp-overlay.dts
@@ -25,6 +25,18 @@
 	qcom,pmic-id = <0x0002001b 0x0 0x0 0x0>;
 };
 
+&modem_mem {
+	reg = <0x0 0x86800000 0x0 0x1F00000>;
+};
+
+&adsp_fw_mem {
+	reg = <0x0 0x88700000 0x0 0x1500000>;
+};
+
+&wcnss_fw_mem {
+	reg = <0x0 0x89c00000 0x0 0x700000>;
+};
+
 &mdss_dsi0 {
 	qcom,dsi-pref-prim-pan = <&dsi_auo_416p_amoled_cmd>;
 	/delete-property/ vdd-supply;
@@ -39,6 +51,36 @@
 	/delete-node/ qcom,panel-supply-entry@0;
 };
 
+&i2c_4 {
+	status = "ok";
+	tsc@24 {
+		status = "disabled";
+	};
+
+	raydium_ts@39 {
+		compatible = "raydium,raydium-ts";
+		reg = <0x39>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <13 0x2008>;
+		vdd_ana-supply = <&pm660_l11>;
+		vcc_i2c-supply = <&pm660_l13>;
+		pinctrl-names = "pmx_ts_active","pmx_ts_suspend",
+					"pmx_ts_release";
+		pinctrl-0 = <&ts_int_active &ts_reset_active>;
+		pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>;
+		pinctrl-2 = <&ts_release>;
+		raydium,reset-gpio = <&tlmm 64 0x00>;
+		raydium,irq-gpio = <&tlmm 65 0x00>;
+		raydium,num-max-touches = <2>;
+		raydium,soft-reset-delay-ms = <50>;
+		raydium,hard-reset-delay-ms = <100>;
+		raydium,x_max = <416>;
+		raydium,y_max = <416>;
+		raydium,display-coords= <0  0 416 416>;
+		raydium,fw_id = <0x2202>;
+	};
+};
+
 &usb_otg {
 	HSUSB_3p3-supply = <&L16A>;
 };
diff --git a/arch/arm64/boot/dts/qcom/sda429-bg-wdp-overlay.dts b/arch/arm64/boot/dts/qcom/sda429-bg-wdp-overlay.dts
index 4e70535..8c021377 100644
--- a/arch/arm64/boot/dts/qcom/sda429-bg-wdp-overlay.dts
+++ b/arch/arm64/boot/dts/qcom/sda429-bg-wdp-overlay.dts
@@ -25,6 +25,18 @@
 	qcom,pmic-id = <0x0002001b 0x0 0x0 0x0>;
 };
 
+&modem_mem {
+	reg = <0x0 0x86800000 0x0 0x1F00000>;
+};
+
+&adsp_fw_mem {
+	reg = <0x0 0x88700000 0x0 0x1500000>;
+};
+
+&wcnss_fw_mem {
+	reg = <0x0 0x89c00000 0x0 0x700000>;
+};
+
 &usb_otg {
 	HSUSB_3p3-supply = <&L16A>;
 };
diff --git a/arch/arm64/boot/dts/qcom/sda429-bg-wtp-overlay.dts b/arch/arm64/boot/dts/qcom/sda429-bg-wtp-overlay.dts
index 9b9a849..e8c11bb 100644
--- a/arch/arm64/boot/dts/qcom/sda429-bg-wtp-overlay.dts
+++ b/arch/arm64/boot/dts/qcom/sda429-bg-wtp-overlay.dts
@@ -25,6 +25,18 @@
 	qcom,pmic-id = <0x0002001b 0x0 0x0 0x0>;
 };
 
+&modem_mem {
+	reg = <0x0 0x86800000 0x0 0x1F00000>;
+};
+
+&adsp_fw_mem {
+	reg = <0x0 0x88700000 0x0 0x1500000>;
+};
+
+&wcnss_fw_mem {
+	reg = <0x0 0x89c00000 0x0 0x700000>;
+};
+
 &mdss_dsi0 {
 	qcom,dsi-pref-prim-pan = <&dsi_auo_416p_amoled_cmd>;
 	/delete-property/ vdd-supply;
diff --git a/arch/arm64/boot/dts/qcom/sda429-spyro-qrd-dvt-overlay.dts b/arch/arm64/boot/dts/qcom/sda429-spyro-qrd-dvt-overlay.dts
index 46fe9d5..2bab608 100644
--- a/arch/arm64/boot/dts/qcom/sda429-spyro-qrd-dvt-overlay.dts
+++ b/arch/arm64/boot/dts/qcom/sda429-spyro-qrd-dvt-overlay.dts
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2019-2020, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -24,6 +24,18 @@
 	qcom,pmic-id = <0x0002001b 0x0 0x0 0x0>;
 };
 
+&modem_mem {
+	reg = <0x0 0x86800000 0x0 0x1F00000>;
+};
+
+&adsp_fw_mem {
+	reg = <0x0 0x88700000 0x0 0x1500000>;
+};
+
+&wcnss_fw_mem {
+	reg = <0x0 0x89c00000 0x0 0x700000>;
+};
+
 &usb_otg {
 	HSUSB_3p3-supply = <&L16A>;
 };
diff --git a/arch/arm64/boot/dts/qcom/sdm429-bg-dvt2-wtp-overlay.dts b/arch/arm64/boot/dts/qcom/sdm429-bg-dvt2-wtp-overlay.dts
index b2f9204..31d0c07b0 100644
--- a/arch/arm64/boot/dts/qcom/sdm429-bg-dvt2-wtp-overlay.dts
+++ b/arch/arm64/boot/dts/qcom/sdm429-bg-dvt2-wtp-overlay.dts
@@ -39,6 +39,36 @@
 	/delete-node/ qcom,panel-supply-entry@0;
 };
 
+&i2c_4 {
+	status = "ok";
+	tsc@24 {
+		status = "disabled";
+	};
+
+	raydium_ts@39 {
+		compatible = "raydium,raydium-ts";
+		reg = <0x39>;
+		interrupt-parent = <&tlmm>;
+		interrupts = <13 0x2008>;
+		vdd_ana-supply = <&pm660_l11>;
+		vcc_i2c-supply = <&pm660_l13>;
+		pinctrl-names = "pmx_ts_active","pmx_ts_suspend",
+					"pmx_ts_release";
+		pinctrl-0 = <&ts_int_active &ts_reset_active>;
+		pinctrl-1 = <&ts_int_suspend &ts_reset_suspend>;
+		pinctrl-2 = <&ts_release>;
+		raydium,reset-gpio = <&tlmm 64 0x00>;
+		raydium,irq-gpio = <&tlmm 65 0x00>;
+		raydium,num-max-touches = <2>;
+		raydium,soft-reset-delay-ms = <50>;
+		raydium,hard-reset-delay-ms = <100>;
+		raydium,x_max = <416>;
+		raydium,y_max = <416>;
+		raydium,display-coords= <0  0 416 416>;
+		raydium,fw_id = <0x2202>;
+	};
+};
+
 &usb_otg {
 	HSUSB_3p3-supply = <&L16A>;
 };
diff --git a/arch/arm64/boot/dts/qcom/sdm429-spyro.dtsi b/arch/arm64/boot/dts/qcom/sdm429-spyro.dtsi
index d993dc2..d83cc5f 100644
--- a/arch/arm64/boot/dts/qcom/sdm429-spyro.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm429-spyro.dtsi
@@ -48,3 +48,7 @@
 		};
 	};
 };
+
+&usb_otg {
+	qcom,enumeration-check-for-sdp;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm429w-bg-pm660.dtsi b/arch/arm64/boot/dts/qcom/sdm429w-bg-pm660.dtsi
index bb73889..f453259 100644
--- a/arch/arm64/boot/dts/qcom/sdm429w-bg-pm660.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm429w-bg-pm660.dtsi
@@ -29,7 +29,3 @@
 &pm660_fg {
 	qcom,fg-disable-in-twm;
 };
-
-&pm660_haptics {
-	qcom,haptics-ext-pin-twm;
-};
diff --git a/arch/arm64/boot/dts/qcom/sdm670-audio.dtsi b/arch/arm64/boot/dts/qcom/sdm670-audio.dtsi
index 0ea1660..8b46a2f 100644
--- a/arch/arm64/boot/dts/qcom/sdm670-audio.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670-audio.dtsi
@@ -65,18 +65,18 @@
 			<&sb_4_rx>, <&sb_4_tx>, <&sb_5_rx>, <&sb_5_tx>,
 			<&sb_6_rx>, <&sb_7_rx>, <&sb_7_tx>,
 			<&sb_8_rx>, <&sb_8_tx>,
+			<&proxy_rx>, <&proxy_tx>,
 			<&afe_pcm_rx>, <&afe_pcm_tx>, <&afe_proxy_rx>,
 			<&afe_proxy_tx>, <&incall_record_rx>,
 			<&incall_record_tx>, <&incall_music_rx>,
 			<&incall_music_2_rx>,
 			<&usb_audio_rx>, <&usb_audio_tx>,
 			<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_tx_0>,
-			<&dai_pri_tdm_tx_1>, <&dai_pri_tdm_tx_2>,
-			<&dai_pri_tdm_tx_3>, <&dai_sec_tdm_rx_0>,
-			<&dai_sec_tdm_tx_0>, <&dai_tert_tdm_rx_0>,
-			<&dai_tert_tdm_tx_0>, <&dai_quat_tdm_rx_0>,
-			<&dai_quat_tdm_tx_0>, <&dai_quin_tdm_rx_0>,
-			<&dai_quin_tdm_tx_0>, <&afe_loopback_tx>;
+			<&dai_sec_tdm_rx_0>, <&dai_sec_tdm_tx_0>,
+			<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_tx_0>,
+			<&dai_quat_tdm_rx_0>, <&dai_quat_tdm_tx_0>,
+			<&dai_quin_tdm_rx_0>, <&dai_quin_tdm_tx_0>,
+			<&afe_loopback_tx>;
 		asoc-cpu-names = "msm-dai-q6-dp.24608",
 			"msm-dai-q6-mi2s.0", "msm-dai-q6-mi2s.1",
 			"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
@@ -93,18 +93,18 @@
 			"msm-dai-q6-dev.16396",
 			"msm-dai-q6-dev.16398", "msm-dai-q6-dev.16399",
 			"msm-dai-q6-dev.16400", "msm-dai-q6-dev.16401",
+			"msm-dai-q6-dev.8194", "msm-dai-q6-dev.8195",
 			"msm-dai-q6-dev.224", "msm-dai-q6-dev.225",
 			"msm-dai-q6-dev.241", "msm-dai-q6-dev.240",
 			"msm-dai-q6-dev.32771", "msm-dai-q6-dev.32772",
 			"msm-dai-q6-dev.32773", "msm-dai-q6-dev.32770",
 			"msm-dai-q6-dev.28672", "msm-dai-q6-dev.28673",
 			"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36865",
-			"msm-dai-q6-tdm.36867", "msm-dai-q6-tdm.36869",
-			"msm-dai-q6-tdm.36871", "msm-dai-q6-tdm.36880",
-			"msm-dai-q6-tdm.36881", "msm-dai-q6-tdm.36896",
-			"msm-dai-q6-tdm.36897", "msm-dai-q6-tdm.36912",
-			"msm-dai-q6-tdm.36913", "msm-dai-q6-tdm.36928",
-			"msm-dai-q6-tdm.36929", "msm-dai-q6-dev.24577";
+			"msm-dai-q6-tdm.36880", "msm-dai-q6-tdm.36881",
+			"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36897",
+			"msm-dai-q6-tdm.36912", "msm-dai-q6-tdm.36913",
+			"msm-dai-q6-tdm.36928", "msm-dai-q6-tdm.36929",
+			"msm-dai-q6-dev.24577";
 	};
 
 	tasha_snd: sound-tasha {
@@ -145,7 +145,8 @@
 			<&dai_sec_tdm_rx_0>, <&dai_sec_tdm_tx_0>,
 			<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_tx_0>,
 			<&dai_quat_tdm_rx_0>, <&dai_quat_tdm_tx_0>,
-			<&dai_quin_tdm_rx_0>, <&dai_quin_tdm_tx_0>;
+			<&dai_quin_tdm_rx_0>, <&dai_quin_tdm_tx_0>,
+			<&proxy_rx>, <&proxy_tx>;
 		asoc-cpu-names = "msm-dai-q6-mi2s.0", "msm-dai-q6-mi2s.1",
 			"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
 			"msm-dai-q6-mi2s.4",
@@ -170,7 +171,8 @@
 			"msm-dai-q6-tdm.36880", "msm-dai-q6-tdm.36881",
 			"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36897",
 			"msm-dai-q6-tdm.36912", "msm-dai-q6-tdm.36913",
-			"msm-dai-q6-tdm.36928", "msm-dai-q6-tdm.36929";
+			"msm-dai-q6-tdm.36928", "msm-dai-q6-tdm.36929",
+			"msm-dai-q6-dev.8194", "msm-dai-q6-dev.8195";
 	};
 
 	int_codec: sound {
@@ -210,7 +212,8 @@
 			<&dai_sec_tdm_rx_0>, <&dai_sec_tdm_tx_0>,
 			<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_tx_0>,
 			<&dai_quat_tdm_rx_0>, <&dai_quat_tdm_tx_0>,
-			<&dai_quin_tdm_rx_0>, <&dai_quin_tdm_tx_0>;
+			<&dai_quin_tdm_rx_0>, <&dai_quin_tdm_tx_0>,
+			<&proxy_rx>, <&proxy_tx>;
 		asoc-cpu-names = "msm-dai-q6-dp.24608",
 			"msm-dai-q6-mi2s.0","msm-dai-q6-mi2s.1",
 			"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
@@ -232,7 +235,8 @@
 			"msm-dai-q6-tdm.36880", "msm-dai-q6-tdm.36881",
 			"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36897",
 			"msm-dai-q6-tdm.36912", "msm-dai-q6-tdm.36913",
-			"msm-dai-q6-tdm.36928", "msm-dai-q6-tdm.36929";
+			"msm-dai-q6-tdm.36928", "msm-dai-q6-tdm.36929",
+			"msm-dai-q6-dev.8194", "msm-dai-q6-dev.8195";
 	};
 
 	cpe: qcom,msm-cpe-lsm {
@@ -243,40 +247,6 @@
 		compatible = "qcom,msm-cpe-lsm";
 		qcom,msm-cpe-lsm-id = <3>;
 	};
-
-	pri_tdm_tx: qcom,msm-dai-tdm-pri-tx {
-		compatible = "qcom,msm-dai-tdm";
-		qcom,msm-cpudai-tdm-group-id = <37121>;
-		qcom,msm-cpudai-tdm-group-num-ports = <4>;
-		qcom,msm-cpudai-tdm-group-port-id = <36865 36867 36869 36871>;
-		qcom,msm-cpudai-tdm-clk-rate = <1536000>;
-		qcom,msm-cpudai-tdm-clk-internal = <1>;
-		qcom,msm-cpudai-tdm-sync-mode = <1>;
-		qcom,msm-cpudai-tdm-sync-src = <1>;
-		qcom,msm-cpudai-tdm-data-out = <0>;
-		qcom,msm-cpudai-tdm-invert-sync = <1>;
-		qcom,msm-cpudai-tdm-data-delay = <1>;
-		dai_pri_tdm_tx_0: qcom,msm-dai-q6-tdm-pri-tx-0 {
-			compatible = "qcom,msm-dai-q6-tdm";
-			qcom,msm-cpudai-tdm-dev-id = <36865>;
-			qcom,msm-cpudai-tdm-data-align = <0>;
-		};
-		dai_pri_tdm_tx_1: qcom,msm-dai-q6-tdm-pri-tx-1 {
-			compatible = "qcom,msm-dai-q6-tdm";
-			qcom,msm-cpudai-tdm-dev-id = <36867>;
-			qcom,msm-cpudai-tdm-data-align = <0>;
-		};
-		dai_pri_tdm_tx_2: qcom,msm-dai-q6-tdm-pri-tx-2 {
-			compatible = "qcom,msm-dai-q6-tdm";
-			qcom,msm-cpudai-tdm-dev-id = <36869>;
-			qcom,msm-cpudai-tdm-data-align = <0>;
-		};
-		dai_pri_tdm_tx_3: qcom,msm-dai-q6-tdm-pri-tx-3 {
-			compatible = "qcom,msm-dai-q6-tdm";
-			qcom,msm-cpudai-tdm-dev-id = <36871>;
-			qcom,msm-cpudai-tdm-data-align = <0>;
-		};
-	};
 };
 
 &slim_aud {
diff --git a/arch/arm64/boot/dts/qcom/sdm670.dtsi b/arch/arm64/boot/dts/qcom/sdm670.dtsi
index d7b1b06..5990f9b 100644
--- a/arch/arm64/boot/dts/qcom/sdm670.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670.dtsi
@@ -3004,6 +3004,7 @@
 	parent-supply = <&pm660l_s2_level>;
 	domain-addr = <&gpu_gx_domain_addr>;
 	sw-reset = <&gpu_gx_sw_reset>;
+	qcom,skip-disable-before-sw-enable;
 	qcom,reset-aon-logic;
 	status = "ok";
 };
diff --git a/drivers/bus/mhi/core/mhi_main.c b/drivers/bus/mhi/core/mhi_main.c
index 1b81eb8..0dfeff0 100644
--- a/drivers/bus/mhi/core/mhi_main.c
+++ b/drivers/bus/mhi/core/mhi_main.c
@@ -1049,7 +1049,9 @@
 
 	result.transaction_status = (ev_code == MHI_EV_CC_OVERFLOW) ?
 		-EOVERFLOW : 0;
-	result.bytes_xferd = xfer_len;
+
+	/* truncate to buf len if xfer_len is larger */
+	result.bytes_xferd = min_t(u16, xfer_len, buf_info->len);
 	result.buf_addr = buf_info->cb_buf;
 	result.dir = mhi_chan->dir;
 
@@ -1287,7 +1289,7 @@
 		chan = MHI_TRE_GET_EV_CHID(local_rp);
 		if (chan >= mhi_cntrl->max_chan) {
 			MHI_ERR("invalid channel id %u\n", chan);
-			continue;
+			goto next_er_element;
 		}
 		mhi_chan = &mhi_cntrl->mhi_chan[chan];
 
@@ -1299,6 +1301,7 @@
 			event_quota--;
 		}
 
+next_er_element:
 		mhi_recycle_ev_ring_element(mhi_cntrl, ev_ring);
 		local_rp = ev_ring->rp;
 		dev_rp = mhi_to_virtual(ev_ring, er_ctxt->rp);
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c
index a0652b7..2d23442 100644
--- a/drivers/char/adsprpc.c
+++ b/drivers/char/adsprpc.c
@@ -720,12 +720,20 @@
 {
 	struct fastrpc_apps *me = &gfa;
 	struct fastrpc_file *fl;
-	int vmid;
+	int vmid, cid = -1, err = 0;
 	struct fastrpc_session_ctx *sess;
 
 	if (!map)
 		return;
 	fl = map->fl;
+	cid = fl->cid;
+	VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
+	if (err) {
+		err = -ECHRNG;
+		pr_err("adsprpc: ERROR:%s, Invalid channel id: %d, err:%d",
+			__func__, cid, err);
+		return;
+	}
 	if (map->flags == ADSP_MMAP_HEAP_ADDR ||
 				map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
 		spin_lock(&me->hlock);
@@ -805,15 +813,21 @@
 	struct fastrpc_apps *me = &gfa;
 	struct fastrpc_session_ctx *sess;
 	struct fastrpc_apps *apps = fl->apps;
-	int cid = fl->cid;
-	struct fastrpc_channel_ctx *chan = &apps->channel[cid];
 	struct fastrpc_mmap *map = NULL;
+	struct fastrpc_channel_ctx *chan = NULL;
 	unsigned long attrs;
 	dma_addr_t region_phys = 0;
 	void *region_vaddr = NULL;
 	unsigned long flags;
-	int err = 0, vmid;
+	int err = 0, vmid, cid = -1;
 
+	cid = fl->cid;
+	VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
+	if (err) {
+		err = -ECHRNG;
+		goto bail;
+	}
+	chan = &apps->channel[cid];
 	if (!fastrpc_mmap_find(fl, fd, va, len, mflags, 1, ppmap))
 		return 0;
 	map = kzalloc(sizeof(*map), GFP_KERNEL);
@@ -1850,12 +1864,22 @@
 {
 	struct smq_msg *msg = &ctx->msg;
 	struct fastrpc_file *fl = ctx->fl;
-	struct fastrpc_channel_ctx *channel_ctx = &fl->apps->channel[fl->cid];
-	int err = 0, len;
+	int err = 0, len, cid = -1;
+	struct fastrpc_channel_ctx *channel_ctx = NULL;
+
+	cid = fl->cid;
+	VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
+	if (err) {
+		err = -ECHRNG;
+		goto bail;
+	}
+	channel_ctx = &fl->apps->channel[fl->cid];
 
 	VERIFY(err, NULL != channel_ctx->chan);
-	if (err)
+	if (err) {
+		err = -ECHRNG;
 		goto bail;
+	}
 	msg->pid = fl->tgid;
 	msg->tid = current->pid;
 	if (fl->sessionid)
@@ -1974,11 +1998,22 @@
 {
 	struct smq_invoke_ctx *ctx = NULL;
 	struct fastrpc_ioctl_invoke *invoke = &inv->inv;
-	int cid = fl->cid;
-	int interrupted = 0;
-	int err = 0;
+	int err = 0, cid = -1, interrupted = 0;
 	struct timespec invoket = {0};
-	int64_t *perf_counter = getperfcounter(fl, PERF_COUNT);
+	int64_t *perf_counter = NULL;
+
+	cid = fl->cid;
+	VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
+	if (err) {
+		err = -ECHRNG;
+		goto bail;
+	}
+	VERIFY(err, fl->sctx != NULL);
+	if (err) {
+		err = -EBADR;
+		goto bail;
+	}
+	perf_counter = getperfcounter(fl, PERF_COUNT);
 
 	if (fl->profile)
 		getnstimeofday(&invoket);
@@ -1992,13 +2027,6 @@
 		}
 	}
 
-	VERIFY(err, fl->sctx != NULL);
-	if (err)
-		goto bail;
-	VERIFY(err, fl->cid >= 0 && fl->cid < NUM_CHANNELS);
-	if (err)
-		goto bail;
-
 	if (!kernel) {
 		VERIFY(err, 0 == context_restore_interrupted(fl, inv,
 								&ctx));
@@ -3408,7 +3436,7 @@
 static int fastrpc_channel_open(struct fastrpc_file *fl)
 {
 	struct fastrpc_apps *me = &gfa;
-	int cid, ii, err = 0;
+	int cid = -1, ii, err = 0;
 
 	mutex_lock(&me->smd_mutex);
 
@@ -3416,9 +3444,11 @@
 	if (err)
 		goto bail;
 	cid = fl->cid;
-	VERIFY(err, cid >= 0 && cid < NUM_CHANNELS);
-	if (err)
+	VERIFY(err, cid >= ADSP_DOMAIN_ID && cid < NUM_CHANNELS);
+	if (err) {
+		err = -ECHRNG;
 		goto bail;
+	}
 	if (me->channel[cid].ssrcount !=
 				 me->channel[cid].prevssrcount) {
 		if (!me->channel[cid].issubsystemup) {
diff --git a/drivers/clk/qcom/gdsc-regulator.c b/drivers/clk/qcom/gdsc-regulator.c
index 15a93cd..1ffb341 100644
--- a/drivers/clk/qcom/gdsc-regulator.c
+++ b/drivers/clk/qcom/gdsc-regulator.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2019, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2020, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -92,6 +92,7 @@
 	int			root_clk_idx;
 	u32			gds_timeout;
 	u32			flags;
+	bool			skip_disable_before_enable;
 };
 
 enum gdscr_status {
@@ -379,6 +380,7 @@
 		clk_disable_unprepare(sc->clocks[sc->root_clk_idx]);
 
 	sc->is_gdsc_enabled = true;
+	sc->skip_disable_before_enable = false;
 
 	mutex_unlock(&gdsc_seq_lock);
 
@@ -391,6 +393,16 @@
 	uint32_t regval;
 	int i, ret = 0;
 
+	/*
+	 * Protect GDSC against late_init disabling when the GDSC is enabled
+	 * by an entity outside external to HLOS.
+	 */
+	if (sc->skip_disable_before_enable) {
+		dev_dbg(&rdev->dev, "Skip Disabling: %s\n", sc->rdesc.name);
+		sc->skip_disable_before_enable = false;
+		return 0;
+	}
+
 	mutex_lock(&gdsc_seq_lock);
 
 	if (sc->force_root_en)
@@ -827,6 +839,9 @@
 			clk_set_flags(sc->clocks[i], CLKFLAG_NORETAIN_PERIPH);
 	}
 
+	sc->skip_disable_before_enable = of_property_read_bool(
+		pdev->dev.of_node, "qcom,skip-disable-before-sw-enable");
+
 	reg_config.dev = &pdev->dev;
 	reg_config.init_data = init_data;
 	reg_config.driver_data = sc;
diff --git a/drivers/input/misc/qti-haptics.c b/drivers/input/misc/qti-haptics.c
index a2c8e76..11d23e5 100644
--- a/drivers/input/misc/qti-haptics.c
+++ b/drivers/input/misc/qti-haptics.c
@@ -251,6 +251,13 @@
 	{REG_HAP_EN_CTL1, 0x80}, /* Enable haptics driver */
 };
 
+static struct hap_addr_val twm_cfg[] = {
+	{REG_HAP_PLAY, 0x00}, /* Stop playing haptics waveform */
+	{REG_HAP_SEL, 0x00}, /* Configure for cmd mode */
+	{REG_HAP_EN_CTL1, 0x00}, /* Enable haptics driver */
+	{REG_HAP_PERPH_RESET_CTL3, 0x0D}, /* Disable SHUTDOWN1_RB reset */
+};
+
 static int wf_repeat[8] = {1, 2, 4, 8, 16, 32, 64, 128};
 static int wf_s_repeat[4] = {1, 2, 4, 8};
 
@@ -1058,20 +1065,30 @@
 	qti_haptics_config_vmax(chip, play->vmax_mv);
 }
 
-static int qti_haptics_twm_config(struct qti_hap_chip *chip)
+static int qti_haptics_twm_config(struct qti_hap_chip *chip, bool ext_pin)
 {
-	int rc, i;
+	int rc = 0, i;
 
-	for (i = 0; i < ARRAY_SIZE(twm_ext_cfg); i++) {
-		rc = qti_haptics_write(chip, twm_ext_cfg[i].addr,
-					&twm_ext_cfg[i].value, 1);
-		if (rc < 0) {
-			dev_err(chip->dev, "Haptics TWM config failed, rc=%d\n",
-				rc);
-			return rc;
+	if (ext_pin) {
+		for (i = 0; i < ARRAY_SIZE(twm_ext_cfg); i++) {
+			rc = qti_haptics_write(chip, twm_ext_cfg[i].addr,
+						&twm_ext_cfg[i].value, 1);
+			if (rc < 0)
+				break;
+		}
+	} else {
+		for (i = 0; i < ARRAY_SIZE(twm_cfg); i++) {
+			rc = qti_haptics_write(chip, twm_cfg[i].addr,
+						&twm_cfg[i].value, 1);
+			if (rc < 0)
+				break;
 		}
 	}
-	pr_debug("Enabled haptics for TWM mode\n");
+
+	if (rc < 0)
+		pr_err("Failed to write twm_config rc=%d\n", rc);
+	else
+		pr_debug("Enabled haptics for TWM mode\n");
 
 	return 0;
 }
@@ -2033,7 +2050,6 @@
 {
 	struct qti_hap_chip *chip = dev_get_drvdata(&pdev->dev);
 	int rc;
-	bool enable_haptics_twm;
 
 	dev_dbg(chip->dev, "Shutdown!\n");
 
@@ -2049,10 +2065,8 @@
 		chip->vdd_enabled = false;
 	}
 
-	enable_haptics_twm = chip->haptics_ext_pin_twm && twm_sys_enable;
-
-	if (chip->twm_state == PMIC_TWM_ENABLE && enable_haptics_twm) {
-		rc = qti_haptics_twm_config(chip);
+	if (chip->twm_state == PMIC_TWM_ENABLE && twm_sys_enable) {
+		rc = qti_haptics_twm_config(chip, chip->haptics_ext_pin_twm);
 		if (rc < 0)
 			pr_err("Haptics TWM config failed rc=%d\n", rc);
 	}
diff --git a/drivers/media/platform/msm/camera_v3/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c b/drivers/media/platform/msm/camera_v3/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
index 91e1e74..d8fd9e0 100644
--- a/drivers/media/platform/msm/camera_v3/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
+++ b/drivers/media/platform/msm/camera_v3/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017-2019, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2020, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -1803,18 +1803,36 @@
 
 static int cam_ife_mgr_check_and_update_fe(
 	struct cam_ife_hw_mgr_ctx         *ife_ctx,
-	struct cam_isp_acquire_hw_info    *acquire_hw_info)
+	struct cam_isp_acquire_hw_info    *acquire_hw_info,
+	uint32_t                           acquire_info_size)
 {
 	int i;
 	struct cam_isp_in_port_info       *in_port = NULL;
 	uint32_t                           in_port_length = 0;
 	uint32_t                           total_in_port_length = 0;
 
+	if (acquire_hw_info->input_info_offset >=
+		acquire_hw_info->input_info_size) {
+		CAM_ERR(CAM_ISP,
+			"Invalid size offset 0x%x is greater then size 0x%x",
+			acquire_hw_info->input_info_offset,
+			acquire_hw_info->input_info_size);
+		return -EINVAL;
+	}
+
 	in_port = (struct cam_isp_in_port_info *)
 		((uint8_t *)&acquire_hw_info->data +
 		 acquire_hw_info->input_info_offset);
 	for (i = 0; i < acquire_hw_info->num_inputs; i++) {
 
+		if (((uint8_t *)in_port +
+			sizeof(struct cam_isp_in_port_info)) >
+			((uint8_t *)acquire_hw_info +
+			acquire_info_size)) {
+			CAM_ERR(CAM_ISP, "Invalid size");
+			return -EINVAL;
+		}
+
 		if ((in_port->num_out_res > CAM_IFE_HW_OUT_RES_MAX) ||
 			(in_port->num_out_res <= 0)) {
 			CAM_ERR(CAM_ISP, "Invalid num output res %u",
@@ -2074,7 +2092,8 @@
 	acquire_hw_info =
 		(struct cam_isp_acquire_hw_info *)acquire_args->acquire_info;
 
-	rc = cam_ife_mgr_check_and_update_fe(ife_ctx, acquire_hw_info);
+	rc = cam_ife_mgr_check_and_update_fe(ife_ctx, acquire_hw_info,
+		acquire_args->acquire_info_size);
 	if (rc) {
 		CAM_ERR(CAM_ISP, "buffer size is not enough");
 		goto free_cdm;
diff --git a/drivers/net/wireless/cnss2/main.c b/drivers/net/wireless/cnss2/main.c
index 89d6e1c..c115a0e 100644
--- a/drivers/net/wireless/cnss2/main.c
+++ b/drivers/net/wireless/cnss2/main.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2016-2020, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -249,6 +249,8 @@
 {
 	struct cnss_plat_data *plat_priv = cnss_bus_dev_to_plat_priv(dev);
 	int ret = 0;
+	if (!plat_priv)
+		return -ENODEV;
 
 	if (plat_priv->device_id == QCA6174_DEVICE_ID)
 		return 0;
@@ -281,6 +283,8 @@
 int cnss_wlan_disable(struct device *dev, enum cnss_driver_mode mode)
 {
 	struct cnss_plat_data *plat_priv = cnss_bus_dev_to_plat_priv(dev);
+	if (!plat_priv)
+		return -ENODEV;
 
 	if (plat_priv->device_id == QCA6174_DEVICE_ID)
 		return 0;
@@ -369,6 +373,8 @@
 int cnss_set_fw_log_mode(struct device *dev, u8 fw_log_mode)
 {
 	struct cnss_plat_data *plat_priv = cnss_bus_dev_to_plat_priv(dev);
+	if (!plat_priv)
+		return -ENODEV;
 
 	if (plat_priv->device_id == QCA6174_DEVICE_ID)
 		return 0;
diff --git a/drivers/soc/qcom/bgcom_spi.c b/drivers/soc/qcom/bgcom_spi.c
index a6a176a..ff07a32 100644
--- a/drivers/soc/qcom/bgcom_spi.c
+++ b/drivers/soc/qcom/bgcom_spi.c
@@ -1050,6 +1050,7 @@
 {
 	struct bg_spi_priv *bg_spi = spi_get_drvdata(spi);
 
+	bg_com_drv = NULL;
 	mutex_destroy(&bg_spi->xfer_mutex);
 	devm_kfree(&spi->dev, bg_spi);
 	spi_set_drvdata(spi, NULL);
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 2daa8ef..2ade984 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3042,11 +3042,9 @@
 		if (!(dep->flags & DWC3_EP_ENABLED))
 			continue;
 
-		if (dep->endpoint.ep_type == EP_TYPE_GSI && dep->direction)
-			dwc3_notify_event(dwc,
-					DWC3_CONTROLLER_NOTIFY_CLEAR_DB, 0);
 		dwc3_remove_requests(dwc, dep);
 	}
+	dwc3_notify_event(dwc, DWC3_CONTROLLER_NOTIFY_CLEAR_DB, 0);
 	dbg_log_string("DONE");
 }
 
diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c
index 1a7ebc5..625e44d 100755
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -1496,6 +1496,8 @@
 	usb_ep_autoconfig_reset(cdev->gadget);
 	spin_lock_irqsave(&gi->spinlock, flags);
 	cdev->gadget = NULL;
+	cdev->deactivations = 0;
+	gadget->deactivated = false;
 	set_gadget_data(gadget, NULL);
 	spin_unlock_irqrestore(&gi->spinlock, flags);
 }
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index c75e790..a0ad21f 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -550,7 +550,7 @@
 	while ((skb = skb_dequeue(&dev->rx_frames))) {
 		if (status < 0
 				|| ETH_HLEN > skb->len
-				|| skb->len > ETH_FRAME_LEN) {
+				|| skb->len > GETHER_MAX_ETH_FRAME_LEN) {
 			dev->net->stats.rx_errors++;
 			dev->net->stats.rx_length_errors++;
 			DBG(dev, "rx length %d\n", skb->len);
diff --git a/drivers/video/fbdev/msm/mdss_fb.c b/drivers/video/fbdev/msm/mdss_fb.c
index d1bce46..b827eca 100644
--- a/drivers/video/fbdev/msm/mdss_fb.c
+++ b/drivers/video/fbdev/msm/mdss_fb.c
@@ -4470,7 +4470,6 @@
 	}
 
 skip_retire_fence:
-	mdss_get_sync_fence_fd(rel_fence);
 	mutex_unlock(&sync_pt_data->sync_mutex);
 
 	if (buf_sync->flags & MDP_BUF_SYNC_FLAG_WAIT)