Merge "ARM: dts: msm: Enable cpu clock node for SDM632"
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index f56516c..f42fcd4 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -131,7 +131,7 @@
 KBUILD_CFLAGS	+=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm
 KBUILD_AFLAGS	+=$(CFLAGS_ABI) $(AFLAGS_ISA) $(arch-y) $(tune-y) -include asm/unified.h -msoft-float
 
-CHECKFLAGS	+= -D__arm__
+CHECKFLAGS	+= -D__arm__ -m32
 
 #Default value
 head-y		:= arch/arm/kernel/head$(MMUEXT).o
diff --git a/arch/arm/configs/msm8909w-perf_defconfig b/arch/arm/configs/msm8909w-perf_defconfig
index 52ae800..0c04f9c 100644
--- a/arch/arm/configs/msm8909w-perf_defconfig
+++ b/arch/arm/configs/msm8909w-perf_defconfig
@@ -425,6 +425,8 @@
 CONFIG_MSM_GLINK_PKT=y
 CONFIG_MSM_SUBSYSTEM_RESTART=y
 CONFIG_MSM_PIL=y
+CONFIG_MSM_PIL_SSR_GENERIC=y
+CONFIG_MSM_PIL_MSS_QDSP6V5=y
 CONFIG_MSM_EVENT_TIMER=y
 CONFIG_QTI_RPM_STATS_LOG=y
 CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC=y
diff --git a/arch/arm/configs/msm8909w_defconfig b/arch/arm/configs/msm8909w_defconfig
index 52ae800..0c04f9c 100644
--- a/arch/arm/configs/msm8909w_defconfig
+++ b/arch/arm/configs/msm8909w_defconfig
@@ -425,6 +425,8 @@
 CONFIG_MSM_GLINK_PKT=y
 CONFIG_MSM_SUBSYSTEM_RESTART=y
 CONFIG_MSM_PIL=y
+CONFIG_MSM_PIL_SSR_GENERIC=y
+CONFIG_MSM_PIL_MSS_QDSP6V5=y
 CONFIG_MSM_EVENT_TIMER=y
 CONFIG_QTI_RPM_STATS_LOG=y
 CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC=y
diff --git a/arch/arm64/boot/dts/qcom/apq8053-lite-dragon.dtsi b/arch/arm64/boot/dts/qcom/apq8053-lite-dragon.dtsi
index 76b1fa2..f2d4ef3 100644
--- a/arch/arm64/boot/dts/qcom/apq8053-lite-dragon.dtsi
+++ b/arch/arm64/boot/dts/qcom/apq8053-lite-dragon.dtsi
@@ -344,47 +344,54 @@
 };
 
 &pmi8950_gpios {
-	gpio@c000 {	/* GPIO_1 */
-		status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&pmi_gpio1_default>;
+	pmi_gpio1_default: pmi8950_gpio1 {
+		pins = "gpio1";
+		function = "normal";
+		input-enable;
+		power-source = <0>;
+		status = "okay";
 	};
 };
 
 &pmi8950_mpps {
-	mpp@a200 {	/* MPP_3 */
-		qcom,mode = <1>;		/* Digital output */
-		qcom,output-type = <0>;	/* CMOS logic */
-		qcom,vin-sel = <2>;		/* 1.8V */
-		qcom,src-sel = <0>;		/* Constant */
-		qcom,master-en = <1>;	/* Enable GPIO */
-		qcom,invert = <0>;
-		status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&ext_fet_wled_pwr_en_default>;
+	ext_fet_wled_pwr_en_default: pmi8950_mpp3 {
+		pins = "mpp3";  /* MPP_3 */
+		function = "digital"; /* Digital */
+		output-high; /* Output */
+		drive-strength = <2>; /* 1.8 mA */
+		power-source = <1>;
+		bias-disable = <0>; /* no pull */
+		status = "okay";
 	};
 };
 
 &pm8953_gpios {
-	gpio@c000 {	/* GPIO_1 */
-		status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&pm_gpio1_div_clk2_default>;
+	pm_gpio1_div_clk2_default: pm8953_gpio1 {
+		pins = "gpio1";
+		function = "normal";
+		output-high;
+		power-source = <1>;
+		status = "okay";
 	};
 };
 
 &pm8953_mpps {
-	mpp@a000 {	/* MPP_1 */		/* VDD_PX */
-		status = "disabled";
-	};
-	mpp@a100 {	/* MPP_2 */
-		status = "disabled";
-	};
-	mpp@a200 {	/* MPP_3 */
-		status = "disabled";
-	};
-
-	mpp@a300 {	/* MPP_4 */		/* WLED_PWM_CTRL */
-		qcom,mode = <1>;		/* Digital output */
-		qcom,output-type = <0>;	/* CMOS logic */
-		qcom,vin-sel = <0>;		/* VPH_PWR */
-		qcom,src-sel = <4>;		/* DTEST1 */
-		qcom,master-en = <1>;	/* Enable GPIO */
-		qcom,invert = <0>;
-		status = "ok";
+	pinctrl-names = "default";
+	pinctrl-0 = <&pm_mpp4_wled_pwm_ctrl_default>;
+	pm_mpp4_wled_pwm_ctrl_default: pm8953_mpp4 {
+		pins = "mpp4"; /* WLED_PWM_CTRL */
+		function = "digital"; /* Digital */
+		output-high;	/* Output */
+		drive-strength = <2>; /* 1.8 mA */
+		power-source = <0>; /* VPH_PWR */
+		qcom,dtest = <1>; /* DTEST1 */
+		bias-disable = <0>; /* no pull */
+		status = "okay";
 	};
 };
diff --git a/arch/arm64/boot/dts/qcom/msm8909.dtsi b/arch/arm64/boot/dts/qcom/msm8909.dtsi
index 7b38370..5e56c49 100644
--- a/arch/arm64/boot/dts/qcom/msm8909.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8909.dtsi
@@ -334,7 +334,7 @@
 		compatible = "qcom,gcc-mdss-8909";
 		clocks = <&mdss_dsi0_pll clk_dsi_pll0_pixel_clk_src>,
 			 <&mdss_dsi0_pll clk_dsi_pll0_byte_clk_src>;
-		clock-names = "pixel_src", "byte_src";
+		clock-names = "pclk0_src", "byte0_src";
 		#clock-cells = <1>;
 	};
 
@@ -1363,6 +1363,7 @@
 		qcom,scm_core_clk_src-freq = <80000000>;
 
 		qcom,pas-id = <9>;
+		qcom,mas-crypto = <&mas_crypto>;
 		qcom,proxy-timeout-ms = <100>;
 		qcom,firmware-name = "venus";
 		memory-region = <&venus_qseecom_mem>;
@@ -1792,6 +1793,7 @@
 		qcom,sysmon-id = <6>;
 		qcom,ssctl-instance-id = <0x13>;
 		qcom,firmware-name = "wcnss";
+		qcom,mas-crypto = <&mas_crypto>;
 
 		/* GPIO inputs from wcnss */
 		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_4_in 0 0>;
@@ -1835,6 +1837,7 @@
 		qcom,pil-self-auth;
 		qcom,sysmon-id = <0>;
 		qcom,ssctl-instance-id = <0x12>;
+		qcom,reset-clk;
 
 		/* GPIO inputs from mss */
 		qcom,gpio-err-fatal = <&smp2pgpio_ssr_smp2p_1_in 0 0>;
diff --git a/arch/arm64/boot/dts/qcom/msm8937-mdss-panels.dtsi b/arch/arm64/boot/dts/qcom/msm8937-mdss-panels.dtsi
index 8d18bdd..bca8912 100644
--- a/arch/arm64/boot/dts/qcom/msm8937-mdss-panels.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8937-mdss-panels.dtsi
@@ -20,7 +20,8 @@
 #include "dsi-panel-r69006-1080p-video.dtsi"
 #include "dsi-adv7533-1080p.dtsi"
 #include "dsi-adv7533-720p.dtsi"
-
+#include "dsi-panel-hx8399c-fhd-plus-video.dtsi"
+#include "dsi-panel-hx8399c-hd-plus-video.dtsi"
 &soc {
 	dsi_panel_pwr_supply: dsi_panel_pwr_supply {
 		#address-cells = <1>;
diff --git a/arch/arm64/boot/dts/qcom/msm8937.dtsi b/arch/arm64/boot/dts/qcom/msm8937.dtsi
index d9651f8..8f769fe 100644
--- a/arch/arm64/boot/dts/qcom/msm8937.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8937.dtsi
@@ -889,6 +889,10 @@
 		};
 	};
 
+	qcom,iris-fm {
+		compatible = "qcom,iris_fm";
+	};
+
 	rpm_bus: qcom,rpm-smd {
 		compatible = "qcom,rpm-smd";
 		rpm-channel-name = "rpm_requests";
diff --git a/arch/arm64/boot/dts/qcom/msm8953.dtsi b/arch/arm64/boot/dts/qcom/msm8953.dtsi
index 892edd2..50ee0e8 100644
--- a/arch/arm64/boot/dts/qcom/msm8953.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8953.dtsi
@@ -1187,6 +1187,10 @@
 		};
 	};
 
+	qcom,iris-fm {
+		compatible = "qcom,iris_fm";
+	};
+
 	rpm_bus: qcom,rpm-smd {
 		compatible = "qcom,rpm-smd";
 		rpm-channel-name = "rpm_requests";
diff --git a/arch/arm64/boot/dts/qcom/sdm439-cdp.dtsi b/arch/arm64/boot/dts/qcom/sdm439-cdp.dtsi
index c28f42e..83a4651 100644
--- a/arch/arm64/boot/dts/qcom/sdm439-cdp.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm439-cdp.dtsi
@@ -104,3 +104,67 @@
 		};
 	};
 };
+
+&pm8953_gpios {
+	bklt_en {
+		bklt_en_default: bklt_en_default {
+		pins = "gpio4";
+		function = "normal";
+		power-source = <0>;
+		output-high;
+		};
+	};
+};
+
+&pm8953_pwm {
+	status = "ok";
+};
+
+#include "msm8937-mdss-panels.dtsi"
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_hx8399c_truly_vid>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active &bklt_en_default>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+
+	qcom,platform-bklight-en-gpio = <&pm8953_gpios 4 0>;
+	qcom,platform-te-gpio = <&tlmm 24 0>;
+	qcom,platform-reset-gpio = <&tlmm 61 0>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+
+};
+
+&dsi_hx8399c_truly_vid {
+	qcom,mdss-dsi-panel-timings =
+		[f3 3a 26 00 6c 6e 2c 3e 2f 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x02>;
+	qcom,mdss-dsi-t-clk-pre = <0x2d>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-pmic-bank-select = <0>;
+	qcom,mdss-dsi-pwm-gpio = <&pm8953_gpios 8 0>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+};
+
+
+&dsi_hx8399c_hd_vid {
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-pmic-bank-select = <0>;
+	qcom,mdss-dsi-pwm-gpio = <&pm8953_gpios 8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm439-mtp.dtsi b/arch/arm64/boot/dts/qcom/sdm439-mtp.dtsi
index ed2ecc9..17218a8 100644
--- a/arch/arm64/boot/dts/qcom/sdm439-mtp.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm439-mtp.dtsi
@@ -104,3 +104,66 @@
 		};
 	};
 };
+
+#include "msm8937-mdss-panels.dtsi"
+
+&pm8953_gpios {
+	bklt_en {
+		bklt_en_default: bklt_en_default {
+		pins = "gpio4";
+		function = "normal";
+		power-source = <0>;
+		output-high;
+		};
+	};
+};
+
+&pm8953_pwm {
+	status = "ok";
+};
+
+&mdss_mdp {
+	qcom,mdss-pref-prim-intf = "dsi";
+};
+
+&mdss_dsi {
+	hw-config = "single_dsi";
+};
+
+&mdss_dsi0 {
+	qcom,dsi-pref-prim-pan = <&dsi_hx8399c_truly_vid>;
+	pinctrl-names = "mdss_default", "mdss_sleep";
+	pinctrl-0 = <&mdss_dsi_active &mdss_te_active &bklt_en_default>;
+	pinctrl-1 = <&mdss_dsi_suspend &mdss_te_suspend>;
+
+	qcom,platform-bklight-en-gpio = <&pm8953_gpios 4 0>;
+	qcom,platform-te-gpio = <&tlmm 24 0>;
+	qcom,platform-reset-gpio = <&tlmm 61 0>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+
+};
+
+&dsi_hx8399c_truly_vid {
+	qcom,mdss-dsi-panel-timings =
+		[f3 3a 26 00 6c 6e 2c 3e 2f 03 04 00];
+	qcom,mdss-dsi-t-clk-post = <0x02>;
+	qcom,mdss-dsi-t-clk-pre = <0x2d>;
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-pmic-bank-select = <0>;
+	qcom,mdss-dsi-pwm-gpio = <&pm8953_gpios 8 0>;
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+};
+
+&dsi_hx8399c_hd_vid {
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-pan-enable-dynamic-fps;
+	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_pwm";
+	qcom,mdss-dsi-bl-pmic-pwm-frequency = <100>;
+	qcom,mdss-dsi-bl-pmic-bank-select = <0>;
+	qcom,mdss-dsi-pwm-gpio = <&pm8953_gpios 8 0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm439-pm8953.dtsi b/arch/arm64/boot/dts/qcom/sdm439-pm8953.dtsi
index 1c0a1fc..3c8a298 100644
--- a/arch/arm64/boot/dts/qcom/sdm439-pm8953.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm439-pm8953.dtsi
@@ -125,8 +125,8 @@
 };
 
 &mdss_dsi {
-	/delete-property/ vdda-supply;
-	/delete-property/ vddio-supply;
+	vdda-supply = <&pm8953_l2>; /*1.2V*/
+	vddio-supply = <&pm8953_l6>; /*1.8V*/
 };
 
 &usb_otg {
@@ -137,21 +137,22 @@
 };
 
 &mdss_dsi0_pll {
-	/delete-property/ vddio-supply;
+	vddio-supply = <&pm8953_l6>;
 };
 
 &mdss_dsi1_pll {
-	/delete-property/ vddio-supply;
+	vddio-supply = <&pm8953_l6>;
 };
 
 &mdss_dsi0 {
-	/delete-property/ vdd-supply;
-	/delete-property/ vddio-supply;
+	vdd-supply = <&pm8953_l17>;
+	vddio-supply = <&pm8953_l6>;
 };
 
 &mdss_dsi1 {
-	/delete-property/ vdd-supply;
-	/delete-property/ vddio-supply;
+	status = "disabled";
+	vdd-supply = <&pm8953_l17>;
+	vddio-supply = <&pm8953_l6>;
 };
 
 &int_codec {
@@ -266,3 +267,33 @@
 	/delete-node/ case_therm;
 };
 
+&pil_mss {
+	vdd_mss-supply = <&pm8953_s1>;
+	vdd_cx-supply = <&pm8953_s2_level>;
+	vdd_cx-voltage = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+	vdd_mx-supply = <&pm8953_s7_level_ao>;
+	vdd_mx-uV = <RPM_SMD_REGULATOR_LEVEL_TURBO>;
+	vdd_pll-supply = <&pm8953_l7>;
+};
+
+&soc {
+	qcom,lpass@c200000 {
+		vdd_cx-supply = <&pm8953_s2_level>;
+	};
+
+	qcom,pronto@a21b000 {
+		vdd_pronto_pll-supply = <&pm8953_l7>;
+	};
+
+	qcom,wcnss-wlan@0a000000 {
+		qcom,pronto-vddmx-supply = <&pm8953_s7_level_ao>;
+		qcom,pronto-vddcx-supply = <&pm8953_s2_level>;
+		qcom,pronto-vddpx-supply = <&pm8953_l5>;
+		qcom,iris-vddxo-supply   = <&pm8953_l7>;
+		qcom,iris-vddrfa-supply  = <&pm8953_l19>;
+		qcom,iris-vddpa-supply   = <&pm8953_l9>;
+		qcom,iris-vdddig-supply  = <&pm8953_l5>;
+		qcom,wcnss-adc_tm = <&pm8953_adc_tm>;
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/sdm670-gpu.dtsi b/arch/arm64/boot/dts/qcom/sdm670-gpu.dtsi
index cfe004e..e86117d 100644
--- a/arch/arm64/boot/dts/qcom/sdm670-gpu.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670-gpu.dtsi
@@ -360,7 +360,7 @@
 					reg = <0>;
 					qcom,gpu-freq = <700000000>;
 					qcom,bus-freq = <11>;
-					qcom,bus-min = <8>;
+					qcom,bus-min = <9>;
 					qcom,bus-max = <11>;
 				};
 
@@ -368,7 +368,7 @@
 				qcom,gpu-pwrlevel@1 {
 					reg = <1>;
 					qcom,gpu-freq = <650000000>;
-					qcom,bus-freq = <11>;
+					qcom,bus-freq = <10>;
 					qcom,bus-min = <8>;
 					qcom,bus-max = <11>;
 				};
@@ -377,27 +377,27 @@
 				qcom,gpu-pwrlevel@2 {
 					reg = <2>;
 					qcom,gpu-freq = <565000000>;
-					qcom,bus-freq = <11>;
+					qcom,bus-freq = <9>;
 					qcom,bus-min = <8>;
-					qcom,bus-max = <11>;
+					qcom,bus-max = <10>;
 				};
 
 				/* SVS_L1 */
 				qcom,gpu-pwrlevel@3 {
 					reg = <3>;
 					qcom,gpu-freq = <430000000>;
-					qcom,bus-freq = <11>;
-					qcom,bus-min = <8>;
-					qcom,bus-max = <11>;
+					qcom,bus-freq = <8>;
+					qcom,bus-min = <7>;
+					qcom,bus-max = <10>;
 				};
 
 				/* SVS */
 				qcom,gpu-pwrlevel@4 {
 					reg = <4>;
 					qcom,gpu-freq = <355000000>;
-					qcom,bus-freq = <8>;
+					qcom,bus-freq = <7>;
 					qcom,bus-min = <5>;
-					qcom,bus-max = <9>;
+					qcom,bus-max = <8>;
 				};
 
 				/* LOW SVS */
@@ -406,7 +406,7 @@
 					qcom,gpu-freq = <267000000>;
 					qcom,bus-freq = <6>;
 					qcom,bus-min = <4>;
-					qcom,bus-max = <8>;
+					qcom,bus-max = <7>;
 				};
 
 				/* MIN SVS */
diff --git a/arch/arm64/boot/dts/qcom/sdm670.dtsi b/arch/arm64/boot/dts/qcom/sdm670.dtsi
index eb997ad..4d4e918 100644
--- a/arch/arm64/boot/dts/qcom/sdm670.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670.dtsi
@@ -2469,6 +2469,7 @@
 		compatible = "qcom,msm-fastrpc-compute";
 		qcom,adsp-remoteheap-vmid = <22 37>;
 		qcom,fastrpc-adsp-audio-pdr;
+		qcom,fastrpc-adsp-sensors-pdr;
 
 		qcom,msm_fastrpc_compute_cb1 {
 			compatible = "qcom,msm-fastrpc-compute-cb";
@@ -2543,6 +2544,7 @@
 			label = "adsprpc-smd";
 			iommus = <&apps_smmu 0x1806 0x0>;
 			dma-coherent;
+			shared-cb;
 		};
 	};
 
diff --git a/drivers/clk/msm/mdss/mdss-dsi-pll-8996-util.c b/drivers/clk/msm/mdss/mdss-dsi-pll-8996-util.c
index 20b8e34..7121261 100644
--- a/drivers/clk/msm/mdss/mdss-dsi-pll-8996-util.c
+++ b/drivers/clk/msm/mdss/mdss-dsi-pll-8996-util.c
@@ -424,8 +424,8 @@
 	pdb->in.pll_ip_trim = 4;	/* 4, reg: 0x0404 */
 	pdb->in.pll_cpcset_cur = 1;	/* 1, reg: 0x04f0, bit 0 - 2 */
 	pdb->in.pll_cpmset_cur = 1;	/* 1, reg: 0x04f0, bit 3 - 5 */
-	pdb->in.pll_icpmset = 4;	/* 4, reg: 0x04fc, bit 3 - 5 */
-	pdb->in.pll_icpcset = 4;	/* 4, reg: 0x04fc, bit 0 - 2 */
+	pdb->in.pll_icpmset = 7;	/* 7, reg: 0x04fc, bit 3 - 5 */
+	pdb->in.pll_icpcset = 7;	/* 7, reg: 0x04fc, bit 0 - 2 */
 	pdb->in.pll_icpmset_p = 0;	/* 0, reg: 0x04f4, bit 0 - 2 */
 	pdb->in.pll_icpmset_m = 0;	/* 0, reg: 0x04f4, bit 3 - 5 */
 	pdb->in.pll_icpcset_p = 0;	/* 0, reg: 0x04f8, bit 0 - 2 */
diff --git a/drivers/irqchip/qcom/mpm.c b/drivers/irqchip/qcom/mpm.c
index 72bd7fd..dff8bee 100644
--- a/drivers/irqchip/qcom/mpm.c
+++ b/drivers/irqchip/qcom/mpm.c
@@ -162,13 +162,26 @@
 	}
 }
 
-static inline void msm_mpm_set_type(struct irq_data *d,
+static void msm_mpm_program_set_type(bool set, unsigned int reg,
+					unsigned int index, unsigned int mask)
+{
+	u32 type;
+
+	type = msm_mpm_read(reg, index);
+	if (set)
+		type = ENABLE_TYPE(type, mask);
+	else
+		type = CLEAR_TYPE(type, mask);
+
+	msm_mpm_write(reg, index, type);
+}
+
+static void msm_mpm_set_type(struct irq_data *d,
 					unsigned int flowtype)
 {
 	int mpm_pin[MAX_MPM_PIN_PER_IRQ] = {-1, -1};
 	unsigned long flags;
 	int i = 0;
-	u32 type;
 	unsigned int index, mask;
 	unsigned int reg = 0;
 
@@ -180,24 +193,24 @@
 		index = mpm_pin[i]/32;
 		mask = mpm_pin[i]%32;
 
-		if (flowtype & IRQ_TYPE_LEVEL_HIGH)
-			reg = MPM_REG_FALLING_EDGE;
-
-		if (flowtype & IRQ_TYPE_EDGE_RISING)
-			reg = MPM_REG_RISING_EDGE;
-
-		if (flowtype & IRQ_TYPE_EDGE_FALLING)
-			reg = MPM_REG_POLARITY;
-
 		spin_lock_irqsave(&mpm_lock, flags);
-		type = msm_mpm_read(reg, index);
-
-		if (flowtype)
-			type = ENABLE_TYPE(type, mask);
+		reg = MPM_REG_RISING_EDGE;
+		if (flowtype & IRQ_TYPE_EDGE_RISING)
+			msm_mpm_program_set_type(1, reg, index, mask);
 		else
-			type = CLEAR_TYPE(type, mask);
+			msm_mpm_program_set_type(0, reg, index, mask);
 
-		msm_mpm_write(reg, index, type);
+		reg = MPM_REG_FALLING_EDGE;
+		if (flowtype & IRQ_TYPE_EDGE_FALLING)
+			msm_mpm_program_set_type(1, reg, index, mask);
+		else
+			msm_mpm_program_set_type(0, reg, index, mask);
+
+		reg = MPM_REG_POLARITY;
+		if (flowtype & IRQ_TYPE_LEVEL_HIGH)
+			msm_mpm_program_set_type(1, reg, index, mask);
+		else
+			msm_mpm_program_set_type(0, reg, index, mask);
 		spin_unlock_irqrestore(&mpm_lock, flags);
 	}
 }
diff --git a/drivers/mailbox/msm_qmp.c b/drivers/mailbox/msm_qmp.c
index d6e41ae..9e898b8 100644
--- a/drivers/mailbox/msm_qmp.c
+++ b/drivers/mailbox/msm_qmp.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -893,7 +893,7 @@
 								mdev->name);
 
 	ret = devm_request_irq(&pdev->dev, mdev->rx_irq_line, qmp_irq_handler,
-		IRQF_TRIGGER_RISING | IRQF_NO_SUSPEND | IRQF_SHARED,
+		IRQF_TRIGGER_RISING | IRQF_SHARED,
 		edge_node->name, mdev);
 	if (ret < 0) {
 		qmp_mbox_remove(pdev);
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c b/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c
index fda45cb..691b492 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c
@@ -26,6 +26,7 @@
 #include <media/v4l2-ioctl.h>
 #include <media/v4l2-device.h>
 #include <media/videobuf2-core.h>
+#include <media/msmb_generic_buf_mgr.h>
 
 #include "msm.h"
 #include "msm_buf_mgr.h"
diff --git a/drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c b/drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c
index e350096..e458b4df 100644
--- a/drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c
+++ b/drivers/media/platform/msm/camera_v2/msm_buf_mgr/msm_generic_buf_mgr.c
@@ -167,6 +167,33 @@
 	return ret;
 }
 
+static int32_t msm_buf_mngr_buf_error(struct msm_buf_mngr_device *buf_mngr_dev,
+	struct msm_buf_mngr_info *buf_info)
+{
+	unsigned long flags;
+	struct msm_get_bufs *bufs, *save;
+	int32_t ret = -EINVAL;
+
+	spin_lock_irqsave(&buf_mngr_dev->buf_q_spinlock, flags);
+	list_for_each_entry_safe(bufs, save, &buf_mngr_dev->buf_qhead, entry) {
+		if ((bufs->session_id == buf_info->session_id) &&
+			(bufs->stream_id == buf_info->stream_id) &&
+			(bufs->index == buf_info->index)) {
+			ret = buf_mngr_dev->vb2_ops.buf_error
+					(bufs->vb2_v4l2_buf,
+						buf_info->session_id,
+						buf_info->stream_id,
+						buf_info->frame_id,
+						&buf_info->timestamp,
+						buf_info->reserved);
+			list_del_init(&bufs->entry);
+			kfree(bufs);
+			break;
+		}
+	}
+	spin_unlock_irqrestore(&buf_mngr_dev->buf_q_spinlock, flags);
+	return ret;
+}
 
 static int32_t msm_buf_mngr_put_buf(struct msm_buf_mngr_device *buf_mngr_dev,
 	struct msm_buf_mngr_info *buf_info)
@@ -478,6 +505,9 @@
 	case VIDIOC_MSM_BUF_MNGR_BUF_DONE:
 		rc = msm_buf_mngr_buf_done(msm_buf_mngr_dev, argp);
 		break;
+	case VIDIOC_MSM_BUF_MNGR_BUF_ERROR:
+		rc = msm_buf_mngr_buf_error(msm_buf_mngr_dev, argp);
+		break;
 	case VIDIOC_MSM_BUF_MNGR_PUT_BUF:
 		rc = msm_buf_mngr_put_buf(msm_buf_mngr_dev, argp);
 		break;
@@ -576,6 +606,7 @@
 	case VIDIOC_MSM_BUF_MNGR_GET_BUF:
 	case VIDIOC_MSM_BUF_MNGR_BUF_DONE:
 	case VIDIOC_MSM_BUF_MNGR_PUT_BUF:
+	case VIDIOC_MSM_BUF_MNGR_BUF_ERROR:
 		rc = msm_cam_buf_mgr_ops(cmd, argp);
 		break;
 	case VIDIOC_MSM_BUF_MNGR_INIT:
@@ -724,6 +755,9 @@
 	case VIDIOC_MSM_BUF_MNGR_BUF_DONE32:
 		cmd = VIDIOC_MSM_BUF_MNGR_BUF_DONE;
 		break;
+	case VIDIOC_MSM_BUF_MNGR_BUF_ERROR32:
+		cmd = VIDIOC_MSM_BUF_MNGR_BUF_ERROR;
+		break;
 	case VIDIOC_MSM_BUF_MNGR_PUT_BUF32:
 		cmd = VIDIOC_MSM_BUF_MNGR_PUT_BUF;
 		break;
@@ -742,6 +776,7 @@
 	switch (cmd) {
 	case VIDIOC_MSM_BUF_MNGR_GET_BUF:
 	case VIDIOC_MSM_BUF_MNGR_BUF_DONE:
+	case VIDIOC_MSM_BUF_MNGR_BUF_ERROR:
 	case VIDIOC_MSM_BUF_MNGR_FLUSH:
 	case VIDIOC_MSM_BUF_MNGR_PUT_BUF: {
 		struct msm_buf_mngr_info32_t buf_info32;
diff --git a/drivers/media/platform/msm/camera_v2/msm_sd.h b/drivers/media/platform/msm/camera_v2/msm_sd.h
index f45c0d7..64cb785 100644
--- a/drivers/media/platform/msm/camera_v2/msm_sd.h
+++ b/drivers/media/platform/msm/camera_v2/msm_sd.h
@@ -81,6 +81,9 @@
 		unsigned int stream_id, uint32_t sequence, struct timeval *ts,
 		uint32_t reserved);
 	int (*flush_buf)(int session_id, unsigned int stream_id);
+	int (*buf_error)(struct vb2_v4l2_buffer *vb2_v4l2_buf, int session_id,
+		unsigned int stream_id, uint32_t sequence, struct timeval *ts,
+		uint32_t reserved);
 };
 
 #define MSM_SD_NOTIFY_GET_SD 0x00000001
diff --git a/drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c b/drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c
index 87e0172..6e528a6 100644
--- a/drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c
+++ b/drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c
@@ -461,6 +461,69 @@
 	return rc;
 }
 
+static int msm_vb2_buf_error(struct vb2_v4l2_buffer *vb, int session_id,
+				unsigned int stream_id, uint32_t sequence,
+				struct timeval *ts, uint32_t buf_type)
+{
+	unsigned long flags, rl_flags;
+	struct msm_vb2_buffer *msm_vb2;
+	struct msm_stream *stream;
+	struct msm_session *session;
+	struct vb2_v4l2_buffer *vb2_v4l2_buf = NULL;
+	int rc = 0;
+
+	session = msm_get_session(session_id);
+	if (IS_ERR_OR_NULL(session))
+		return -EINVAL;
+
+	read_lock_irqsave(&session->stream_rwlock, rl_flags);
+
+	stream = msm_get_stream(session, stream_id);
+	if (IS_ERR_OR_NULL(stream)) {
+		read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
+		return -EINVAL;
+	}
+
+	spin_lock_irqsave(&stream->stream_lock, flags);
+	if (vb) {
+		list_for_each_entry(msm_vb2, &(stream->queued_list), list) {
+			vb2_v4l2_buf = &(msm_vb2->vb2_v4l2_buf);
+			if (vb2_v4l2_buf == vb)
+				break;
+		}
+		if (vb2_v4l2_buf != vb) {
+			pr_err("VB buffer is INVALID ses_id=%d, str_id=%d, vb=%pK\n",
+				    session_id, stream_id, vb);
+			spin_unlock_irqrestore(&stream->stream_lock, flags);
+			read_unlock_irqrestore(&session->stream_rwlock,
+				rl_flags);
+			return -EINVAL;
+		}
+		msm_vb2 =
+			container_of(vb2_v4l2_buf, struct msm_vb2_buffer,
+				vb2_v4l2_buf);
+		/* put buf before buf done */
+		if (msm_vb2->in_freeq) {
+			vb2_v4l2_buf->sequence = sequence;
+			vb2_v4l2_buf->timecode.type = buf_type;
+			vb2_v4l2_buf->vb2_buf.timestamp =
+				(ts->tv_sec * 1000000 + ts->tv_usec) * 1000;
+			vb2_buffer_done(&vb2_v4l2_buf->vb2_buf,
+				VB2_BUF_STATE_ERROR);
+			msm_vb2->in_freeq = 0;
+			rc = 0;
+		} else
+			rc = -EINVAL;
+	} else {
+		pr_err(" VB buffer is NULL for ses_id=%d, str_id=%d\n",
+			    session_id, stream_id);
+		rc = -EINVAL;
+	}
+	spin_unlock_irqrestore(&stream->stream_lock, flags);
+	read_unlock_irqrestore(&session->stream_rwlock, rl_flags);
+	return rc;
+}
+
 long msm_vb2_return_buf_by_idx(int session_id, unsigned int stream_id,
 				uint32_t index)
 {
@@ -559,6 +622,7 @@
 	req->put_buf = msm_vb2_put_buf;
 	req->buf_done = msm_vb2_buf_done;
 	req->flush_buf = msm_vb2_flush_buf;
+	req->buf_error = msm_vb2_buf_error;
 	return 0;
 }
 
diff --git a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
index 70bb3f2..1ad2f257 100644
--- a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
+++ b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
@@ -1617,6 +1617,7 @@
 	case VIDIOC_MSM_BUF_MNGR_PUT_BUF:
 	case VIDIOC_MSM_BUF_MNGR_BUF_DONE:
 	case VIDIOC_MSM_BUF_MNGR_GET_BUF:
+	case VIDIOC_MSM_BUF_MNGR_BUF_ERROR:
 	default: {
 		struct msm_buf_mngr_info *buff_mgr_info =
 			(struct msm_buf_mngr_info *)arg;
@@ -3604,7 +3605,7 @@
 			break;
 		}
 		buff_mgr_info.frame_id = frame_info.frame_id;
-		rc = msm_cpp_buffer_ops(cpp_dev, VIDIOC_MSM_BUF_MNGR_BUF_DONE,
+		rc = msm_cpp_buffer_ops(cpp_dev, VIDIOC_MSM_BUF_MNGR_BUF_ERROR,
 			0x0, &buff_mgr_info);
 		if (rc < 0) {
 			pr_err("error in buf done\n");
diff --git a/drivers/soc/qcom/glink_smem_native_xprt.c b/drivers/soc/qcom/glink_smem_native_xprt.c
index d9cd0fa..baebb25 100644
--- a/drivers/soc/qcom/glink_smem_native_xprt.c
+++ b/drivers/soc/qcom/glink_smem_native_xprt.c
@@ -2548,7 +2548,7 @@
 
 	einfo->irq_line = irq_line;
 	rc = request_irq(irq_line, irq_handler,
-			IRQF_TRIGGER_RISING | IRQF_NO_SUSPEND | IRQF_SHARED,
+			IRQF_TRIGGER_RISING | IRQF_SHARED,
 			node->name, einfo);
 	if (rc < 0) {
 		pr_err("%s: request_irq on %d failed: %d\n", __func__, irq_line,
diff --git a/drivers/soc/qcom/pil-msa.c b/drivers/soc/qcom/pil-msa.c
index 80dd2f7..c7e820a 100644
--- a/drivers/soc/qcom/pil-msa.c
+++ b/drivers/soc/qcom/pil-msa.c
@@ -801,6 +801,11 @@
 
 	if (!pil->minidump)
 		return 0;
+	if (pil->minidump) {
+		if (pil->minidump->md_ss_enable_status != MD_SS_ENABLED)
+			return 0;
+	}
+
 	/*
 	 * Bring subsystem out of reset and enable required
 	 * regulators and clocks.
diff --git a/drivers/thermal/qpnp-adc-tm.c b/drivers/thermal/qpnp-adc-tm.c
index 6a3c06f..5c0022e 100644
--- a/drivers/thermal/qpnp-adc-tm.c
+++ b/drivers/thermal/qpnp-adc-tm.c
@@ -2232,6 +2232,71 @@
 
 static int qpnp_adc_tm_read_status(struct qpnp_adc_tm_chip *chip)
 {
+	int rc = 0, sensor_notify_num = 0, i = 0, sensor_num = 0;
+	unsigned long flags;
+
+	if (qpnp_adc_tm_is_valid(chip))
+		return -ENODEV;
+
+	mutex_lock(&chip->adc->adc_lock);
+
+	rc = qpnp_adc_tm_req_sts_check(chip);
+	if (rc) {
+		pr_err("adc-tm-tm req sts check failed with %d\n", rc);
+		goto fail;
+	}
+
+	if (chip->th_info.adc_tm_high_enable) {
+		spin_lock_irqsave(&chip->th_info.adc_tm_high_lock, flags);
+		sensor_notify_num = chip->th_info.adc_tm_high_enable;
+		chip->th_info.adc_tm_high_enable = 0;
+		spin_unlock_irqrestore(&chip->th_info.adc_tm_high_lock, flags);
+		while (i < chip->max_channels_available) {
+			if ((sensor_notify_num & 0x1) == 1) {
+				sensor_num = i;
+				rc = qpnp_adc_tm_disable_rearm_high_thresholds(
+						chip, sensor_num);
+				if (rc < 0) {
+					pr_err("rearm threshold failed\n");
+					goto fail;
+				}
+			}
+			sensor_notify_num >>= 1;
+			i++;
+		}
+	}
+
+	if (chip->th_info.adc_tm_low_enable) {
+		spin_lock_irqsave(&chip->th_info.adc_tm_low_lock, flags);
+		sensor_notify_num = chip->th_info.adc_tm_low_enable;
+		chip->th_info.adc_tm_low_enable = 0;
+		spin_unlock_irqrestore(&chip->th_info.adc_tm_low_lock, flags);
+		i = 0;
+		while (i < chip->max_channels_available) {
+			if ((sensor_notify_num & 0x1) == 1) {
+				sensor_num = i;
+				rc = qpnp_adc_tm_disable_rearm_low_thresholds(
+						chip, sensor_num);
+				if (rc < 0) {
+					pr_err("rearm threshold failed\n");
+					goto fail;
+				}
+			}
+			sensor_notify_num >>= 1;
+			i++;
+		}
+	}
+
+fail:
+	mutex_unlock(&chip->adc->adc_lock);
+	if (rc < 0)
+		atomic_dec(&chip->wq_cnt);
+
+	return rc;
+}
+
+static int qpnp_adc_tm_hc_read_status(struct qpnp_adc_tm_chip *chip)
+{
 	int rc = 0, sensor_num = 0;
 
 	if (qpnp_adc_tm_is_valid(chip))
@@ -2300,9 +2365,15 @@
 
 	pr_debug("thr:0x%x\n", chip->th_info.adc_tm_high_enable);
 
-	rc = qpnp_adc_tm_read_status(chip);
-	if (rc < 0)
-		pr_err("adc-tm high thr work failed\n");
+	if (!chip->adc_tm_hc) {
+		rc = qpnp_adc_tm_read_status(chip);
+		if (rc < 0)
+			pr_err("adc-tm high thr work failed\n");
+	} else {
+		rc = qpnp_adc_tm_hc_read_status(chip);
+		if (rc < 0)
+			pr_err("adc-tm-hc high thr work failed\n");
+	}
 }
 
 static irqreturn_t qpnp_adc_tm_high_thr_isr(int irq, void *data)
@@ -2406,9 +2477,15 @@
 
 	pr_debug("thr:0x%x\n", chip->th_info.adc_tm_low_enable);
 
-	rc = qpnp_adc_tm_read_status(chip);
-	if (rc < 0)
-		pr_err("adc-tm low thr work failed\n");
+	if (!chip->adc_tm_hc) {
+		rc = qpnp_adc_tm_read_status(chip);
+		if (rc < 0)
+			pr_err("adc-tm low thr work failed\n");
+	} else {
+		rc = qpnp_adc_tm_hc_read_status(chip);
+		if (rc < 0)
+			pr_err("adc-tm-hc low thr work failed\n");
+	}
 }
 
 static irqreturn_t qpnp_adc_tm_low_thr_isr(int irq, void *data)
diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
index 25b2cdd..1979156 100644
--- a/drivers/usb/gadget/function/f_midi.c
+++ b/drivers/usb/gadget/function/f_midi.c
@@ -218,9 +218,23 @@
 };
 
 static inline struct usb_request *midi_alloc_ep_req(struct usb_ep *ep,
-						    unsigned length)
+				unsigned int length, size_t extra_buf_alloc)
 {
-	return alloc_ep_req(ep, length);
+	struct usb_request      *req;
+
+	req = usb_ep_alloc_request(ep, GFP_ATOMIC);
+	if (!req)
+		return NULL;
+
+	req->length = usb_endpoint_dir_out(ep->desc) ?
+				usb_ep_align(ep, length) : length;
+	req->buf = kmalloc(req->length + extra_buf_alloc, GFP_ATOMIC);
+	if (!req->buf) {
+		usb_ep_free_request(ep, req);
+		return NULL;
+	}
+
+	return req;
 }
 
 static const uint8_t f_midi_cin_length[] = {
@@ -374,7 +388,8 @@
 	/* pre-allocate write usb requests to use on f_midi_transmit. */
 	while (kfifo_avail(&midi->in_req_fifo)) {
 		struct usb_request *req =
-			midi_alloc_ep_req(midi->in_ep, midi->buflen);
+			midi_alloc_ep_req(midi->in_ep, midi->buflen,
+						midi->gadget->extra_buf_alloc);
 
 		if (req == NULL)
 			return -ENOMEM;
@@ -388,7 +403,7 @@
 	/* allocate a bunch of read buffers and queue them all at once. */
 	for (i = 0; i < midi->qlen && err == 0; i++) {
 		struct usb_request *req =
-			midi_alloc_ep_req(midi->out_ep, midi->buflen);
+			midi_alloc_ep_req(midi->out_ep, midi->buflen, 0);
 
 		if (req == NULL)
 			return -ENOMEM;
diff --git a/drivers/video/fbdev/msm/mdp3.c b/drivers/video/fbdev/msm/mdp3.c
index 5cf439c..00183f8 100644
--- a/drivers/video/fbdev/msm/mdp3.c
+++ b/drivers/video/fbdev/msm/mdp3.c
@@ -44,7 +44,6 @@
 
 #include <linux/msm-bus.h>
 #include <linux/msm-bus-board.h>
-#include <linux/qcom_iommu.h>
 
 #include <linux/msm_dma_iommu_mapping.h>
 
@@ -116,39 +115,14 @@
 	[MDP3_IOMMU_DOMAIN_UNSECURE] = {
 		.domain_type = MDP3_IOMMU_DOMAIN_UNSECURE,
 		.client_name = "mdp_ns",
-		.partitions = {
-			{
-				.start = SZ_128K,
-				.size = SZ_1G - SZ_128K,
-			},
-		},
 		.npartitions = 1,
+		.domain_idx = MDP3_IOMMU_DOMAIN_UNSECURE,
 	},
 	[MDP3_IOMMU_DOMAIN_SECURE] = {
 		.domain_type = MDP3_IOMMU_DOMAIN_SECURE,
 		.client_name = "mdp_secure",
-		.partitions = {
-			{
-				.start = SZ_1G,
-				.size = SZ_1G,
-			},
-		},
 		.npartitions = 1,
-	},
-};
-
-struct mdp3_iommu_ctx_map mdp3_iommu_contexts[MDP3_IOMMU_CTX_MAX] = {
-	[MDP3_IOMMU_CTX_MDP_0] = {
-		.ctx_type = MDP3_IOMMU_CTX_MDP_0,
-		.domain = &mdp3_iommu_domains[MDP3_IOMMU_DOMAIN_UNSECURE],
-		.ctx_name = "mdp_0",
-		.attached = 0,
-	},
-	[MDP3_IOMMU_CTX_MDP_1] = {
-		.ctx_type = MDP3_IOMMU_CTX_MDP_1,
-		.domain = &mdp3_iommu_domains[MDP3_IOMMU_DOMAIN_SECURE],
-		.ctx_name = "mdp_1",
-		.attached = 0,
+		.domain_idx = MDP3_IOMMU_DOMAIN_SECURE,
 	},
 };
 
@@ -785,7 +759,7 @@
 	ret = devm_request_irq(&mdp3_res->pdev->dev,
 				mdp3_hw->irq_info->irq,
 				mdp3_irq_handler,
-				IRQF_DISABLED, "MDP", mdp3_res);
+				0, "MDP", mdp3_res);
 	if (ret) {
 		pr_err("mdp request_irq() failed!\n");
 		return ret;
@@ -795,7 +769,6 @@
 	return 0;
 }
 
-
 static int mdp3_get_iommu_domain(u32 type)
 {
 	if (type >= MDSS_IOMMU_MAX_DOMAIN)
@@ -807,155 +780,6 @@
 	return mdp3_res->domains[type].domain_idx;
 }
 
-int mdp3_iommu_attach(int context)
-{
-	int rc = 0;
-	struct mdp3_iommu_ctx_map *context_map;
-	struct mdp3_iommu_domain_map *domain_map;
-
-	if (context >= MDP3_IOMMU_CTX_MAX)
-		return -EINVAL;
-
-	context_map = mdp3_res->iommu_contexts + context;
-	if (context_map->attached) {
-		pr_warn("mdp iommu already attached\n");
-		return 0;
-	}
-
-	domain_map = context_map->domain;
-
-	rc = iommu_attach_device(domain_map->domain, context_map->ctx);
-	if (rc) {
-		pr_err("mpd3 iommu attach failed\n");
-		return -EINVAL;
-	}
-
-	context_map->attached = true;
-	return 0;
-}
-
-int mdp3_iommu_dettach(int context)
-{
-	struct mdp3_iommu_ctx_map *context_map;
-	struct mdp3_iommu_domain_map *domain_map;
-
-	if (!mdp3_res->iommu_contexts ||
-		context >= MDP3_IOMMU_CTX_MAX)
-		return -EINVAL;
-
-	context_map = mdp3_res->iommu_contexts + context;
-	if (!context_map->attached) {
-		pr_warn("mdp iommu not attached\n");
-		return 0;
-	}
-
-	domain_map = context_map->domain;
-	iommu_detach_device(domain_map->domain, context_map->ctx);
-	context_map->attached = false;
-
-	return 0;
-}
-
-int mdp3_iommu_domain_init(void)
-{
-	struct msm_iova_layout layout;
-	int i;
-
-	if (mdp3_res->domains) {
-		pr_warn("iommu domain already initialized\n");
-		return 0;
-	}
-
-	for (i = 0; i < MDP3_IOMMU_DOMAIN_MAX; i++) {
-		int domain_idx;
-
-		layout.client_name = mdp3_iommu_domains[i].client_name;
-		layout.partitions = mdp3_iommu_domains[i].partitions;
-		layout.npartitions = mdp3_iommu_domains[i].npartitions;
-		layout.is_secure = (i == MDP3_IOMMU_DOMAIN_SECURE);
-
-		domain_idx = msm_register_domain(&layout);
-		if (IS_ERR_VALUE(domain_idx))
-			return -EINVAL;
-
-		mdp3_iommu_domains[i].domain_idx = domain_idx;
-		mdp3_iommu_domains[i].domain = msm_get_iommu_domain(domain_idx);
-		if (IS_ERR_OR_NULL(mdp3_iommu_domains[i].domain)) {
-			pr_err("unable to get iommu domain(%d)\n",
-				domain_idx);
-			if (!mdp3_iommu_domains[i].domain)
-				return -EINVAL;
-			else
-				return PTR_ERR(mdp3_iommu_domains[i].domain);
-		}
-	}
-
-	mdp3_res->domains = mdp3_iommu_domains;
-
-	return 0;
-}
-
-int mdp3_iommu_context_init(void)
-{
-	int i;
-
-	if (mdp3_res->iommu_contexts) {
-		pr_warn("iommu context already initialized\n");
-		return 0;
-	}
-
-	for (i = 0; i < MDP3_IOMMU_CTX_MAX; i++) {
-		mdp3_iommu_contexts[i].ctx =
-			msm_iommu_get_ctx(mdp3_iommu_contexts[i].ctx_name);
-
-		if (IS_ERR_OR_NULL(mdp3_iommu_contexts[i].ctx)) {
-			pr_warn("unable to get iommu ctx(%s)\n",
-				mdp3_iommu_contexts[i].ctx_name);
-			if (!mdp3_iommu_contexts[i].ctx)
-				return -EINVAL;
-			else
-				return PTR_ERR(mdp3_iommu_contexts[i].ctx);
-		}
-	}
-
-	mdp3_res->iommu_contexts = mdp3_iommu_contexts;
-
-	return 0;
-}
-
-int mdp3_iommu_init(void)
-{
-	int ret;
-
-	mutex_init(&mdp3_res->iommu_lock);
-
-	ret = mdp3_iommu_domain_init();
-	if (ret) {
-		pr_err("mdp3 iommu domain init fails\n");
-		return ret;
-	}
-
-	ret = mdp3_iommu_context_init();
-	if (ret) {
-		pr_err("mdp3 iommu context init fails\n");
-		return ret;
-	}
-	return ret;
-}
-
-void mdp3_iommu_deinit(void)
-{
-	int i;
-
-	if (!mdp3_res->domains)
-		return;
-
-	for (i = 0; i < MDP3_IOMMU_DOMAIN_MAX; i++) {
-		if (!IS_ERR_OR_NULL(mdp3_res->domains[i].domain))
-			msm_unregister_domain(mdp3_res->domains[i].domain);
-	}
-}
-
 static int mdp3_check_version(void)
 {
 	int rc;
@@ -1151,11 +975,9 @@
 		mdp3_res->ion_client = NULL;
 		return -EINVAL;
 	}
+	mutex_init(&mdp3_res->iommu_lock);
 
-	rc = mdp3_iommu_init();
-	if (rc)
-		return rc;
-
+	mdp3_res->domains = mdp3_iommu_domains;
 	mdp3_res->bus_handle = mdp3_bus_handle;
 	rc = mdp3_bus_scale_register();
 	if (rc) {
@@ -1171,18 +993,20 @@
 static void mdp3_res_deinit(void)
 {
 	struct mdss_hw *mdp3_hw;
-	int i;
+	int rc = 0;
 
 	mdp3_hw = &mdp3_res->mdp3_hw;
 	mdp3_bus_scale_unregister();
-
 	mutex_lock(&mdp3_res->iommu_lock);
-	for (i = 0; i < MDP3_IOMMU_CTX_MAX; i++)
-		mdp3_iommu_dettach(i);
+	if (mdp3_res->iommu_ref_cnt) {
+		mdp3_res->iommu_ref_cnt--;
+		if (mdp3_res->iommu_ref_cnt == 0)
+			rc = mdss_smmu_detach(mdss_res);
+		} else {
+			pr_err("iommu ref count %d\n", mdp3_res->iommu_ref_cnt);
+		}
 	mutex_unlock(&mdp3_res->iommu_lock);
 
-	mdp3_iommu_deinit();
-
 	if (!IS_ERR_OR_NULL(mdp3_res->ion_client))
 		ion_client_destroy(mdp3_res->ion_client);
 
@@ -1503,317 +1327,6 @@
 	mdp3_batfet_ctrl(enable);
 }
 
-static void mdp3_iommu_heap_unmap_iommu(struct mdp3_iommu_meta *meta)
-{
-	unsigned int domain_num;
-	unsigned int partition_num = 0;
-	struct iommu_domain *domain;
-
-	domain_num = (mdp3_res->domains +
-			MDP3_IOMMU_DOMAIN_UNSECURE)->domain_idx;
-	domain = msm_get_iommu_domain(domain_num);
-
-	if (!domain) {
-		pr_err("Could not get domain %d. Corruption?\n", domain_num);
-		return;
-	}
-
-	iommu_unmap_range(domain, meta->iova_addr, meta->mapped_size);
-	msm_free_iova_address(meta->iova_addr, domain_num, partition_num,
-		meta->mapped_size);
-}
-
-static void mdp3_iommu_meta_destroy(struct kref *kref)
-{
-	struct mdp3_iommu_meta *meta =
-			container_of(kref, struct mdp3_iommu_meta, ref);
-
-	rb_erase(&meta->node, &mdp3_res->iommu_root);
-	mdp3_iommu_heap_unmap_iommu(meta);
-	dma_buf_put(meta->dbuf);
-	kfree(meta);
-}
-
-
-static void mdp3_iommu_meta_put(struct mdp3_iommu_meta *meta)
-{
-	/* Need to lock here to prevent race against map/unmap */
-	mutex_lock(&mdp3_res->iommu_lock);
-	kref_put(&meta->ref, mdp3_iommu_meta_destroy);
-	mutex_unlock(&mdp3_res->iommu_lock);
-}
-
-static struct mdp3_iommu_meta *mdp3_iommu_meta_lookup(struct sg_table *table)
-{
-	struct rb_root *root = &mdp3_res->iommu_root;
-	struct rb_node **p = &root->rb_node;
-	struct rb_node *parent = NULL;
-	struct mdp3_iommu_meta *entry = NULL;
-
-	while (*p) {
-		parent = *p;
-		entry = rb_entry(parent, struct mdp3_iommu_meta, node);
-
-		if (table < entry->table)
-			p = &(*p)->rb_left;
-		else if (table > entry->table)
-			p = &(*p)->rb_right;
-		else
-			return entry;
-	}
-	return NULL;
-}
-
-void mdp3_unmap_iommu(struct ion_client *client, struct ion_handle *handle)
-{
-	struct mdp3_iommu_meta *meta;
-	struct sg_table *table;
-
-	table = ion_sg_table(client, handle);
-
-	mutex_lock(&mdp3_res->iommu_lock);
-	meta = mdp3_iommu_meta_lookup(table);
-	if (!meta) {
-		WARN(1, "%s: buffer was never mapped for %pK\n", __func__,
-				handle);
-		mutex_unlock(&mdp3_res->iommu_lock);
-		return;
-	}
-	mutex_unlock(&mdp3_res->iommu_lock);
-
-	mdp3_iommu_meta_put(meta);
-}
-
-static void mdp3_iommu_meta_add(struct mdp3_iommu_meta *meta)
-{
-	struct rb_root *root = &mdp3_res->iommu_root;
-	struct rb_node **p = &root->rb_node;
-	struct rb_node *parent = NULL;
-	struct mdp3_iommu_meta *entry;
-
-	while (*p) {
-		parent = *p;
-		entry = rb_entry(parent, struct mdp3_iommu_meta, node);
-
-		if (meta->table < entry->table) {
-			p = &(*p)->rb_left;
-		} else if (meta->table > entry->table) {
-			p = &(*p)->rb_right;
-		} else {
-			pr_err("%s: handle %pK already exists\n", __func__,
-				entry->handle);
-			WARN_ON(1);
-		}
-	}
-
-	rb_link_node(&meta->node, parent, p);
-	rb_insert_color(&meta->node, root);
-}
-
-static int mdp3_iommu_map_iommu(struct mdp3_iommu_meta *meta,
-	unsigned long align, unsigned long iova_length,
-	unsigned int padding, unsigned long flags)
-{
-	struct iommu_domain *domain;
-	int ret = 0;
-	unsigned long size;
-	unsigned long unmap_size;
-	struct sg_table *table;
-	int prot = IOMMU_WRITE | IOMMU_READ;
-	unsigned int domain_num = (mdp3_res->domains +
-			MDP3_IOMMU_DOMAIN_UNSECURE)->domain_idx;
-	unsigned int partition_num = 0;
-
-	size = meta->size;
-	table = meta->table;
-
-	/* Use the biggest alignment to allow bigger IOMMU mappings.
-	 * Use the first entry since the first entry will always be the
-	 * biggest entry. To take advantage of bigger mapping sizes both the
-	 * VA and PA addresses have to be aligned to the biggest size.
-	 */
-	if (table->sgl->length > align)
-		align = table->sgl->length;
-
-	ret = msm_allocate_iova_address(domain_num, partition_num,
-			meta->mapped_size, align,
-			(unsigned long *)&meta->iova_addr);
-
-	if (ret)
-		goto out;
-
-	domain = msm_get_iommu_domain(domain_num);
-
-	if (!domain) {
-		ret = -ENOMEM;
-		goto out1;
-	}
-
-	/* Adding padding to before buffer */
-	if (padding) {
-		unsigned long phys_addr = sg_phys(table->sgl);
-
-		ret = msm_iommu_map_extra(domain, meta->iova_addr, phys_addr,
-				padding, SZ_4K, prot);
-		if (ret)
-			goto out1;
-	}
-
-	/* Mapping actual buffer */
-	ret = iommu_map_range(domain, meta->iova_addr + padding,
-			table->sgl, size, prot);
-	if (ret) {
-		pr_err("%s: could not map %pa in domain %pK\n",
-			__func__, &meta->iova_addr, domain);
-			unmap_size = padding;
-		goto out2;
-	}
-
-	/* Adding padding to end of buffer */
-	if (padding) {
-		unsigned long phys_addr = sg_phys(table->sgl);
-		unsigned long extra_iova_addr = meta->iova_addr +
-				padding + size;
-		ret = msm_iommu_map_extra(domain, extra_iova_addr, phys_addr,
-				padding, SZ_4K, prot);
-		if (ret) {
-			unmap_size = padding + size;
-			goto out2;
-		}
-	}
-	return ret;
-
-out2:
-	iommu_unmap_range(domain, meta->iova_addr, unmap_size);
-out1:
-	msm_free_iova_address(meta->iova_addr, domain_num, partition_num,
-				iova_length);
-
-out:
-	return ret;
-}
-
-static struct mdp3_iommu_meta *mdp3_iommu_meta_create(struct ion_client *client,
-	struct ion_handle *handle, struct sg_table *table, unsigned long size,
-	unsigned long align, unsigned long iova_length, unsigned int padding,
-	unsigned long flags, dma_addr_t *iova)
-{
-	struct mdp3_iommu_meta *meta;
-	int ret;
-
-	meta = kzalloc(sizeof(*meta), GFP_KERNEL);
-
-	if (!meta)
-		return ERR_PTR(-ENOMEM);
-
-	meta->handle = handle;
-	meta->table = table;
-	meta->size = size;
-	meta->mapped_size = iova_length;
-	meta->dbuf = ion_share_dma_buf(client, handle);
-	kref_init(&meta->ref);
-
-	ret = mdp3_iommu_map_iommu(meta,
-		align, iova_length, padding, flags);
-	if (ret < 0)	{
-		pr_err("%s: Unable to map buffer\n", __func__);
-		goto out;
-	}
-
-	*iova = meta->iova_addr;
-	mdp3_iommu_meta_add(meta);
-
-	return meta;
-out:
-	kfree(meta);
-	return ERR_PTR(ret);
-}
-
-/*
- * PPP hw reads in tiles of 16 which might be outside mapped region
- * need to map buffers ourseleve to add extra padding
- */
-int mdp3_self_map_iommu(struct ion_client *client, struct ion_handle *handle,
-	unsigned long align, unsigned long padding, dma_addr_t *iova,
-	unsigned long *buffer_size, unsigned long flags,
-	unsigned long iommu_flags)
-{
-	struct mdp3_iommu_meta *iommu_meta = NULL;
-	struct sg_table *table;
-	struct scatterlist *sg;
-	unsigned long size = 0, iova_length = 0;
-	int ret = 0;
-	int i;
-
-	table = ion_sg_table(client, handle);
-	if (IS_ERR_OR_NULL(table))
-		return PTR_ERR(table);
-
-	for_each_sg(table->sgl, sg, table->nents, i)
-		size += sg->length;
-
-	padding = PAGE_ALIGN(padding);
-
-	/* Adding 16 lines padding before and after buffer */
-	iova_length = size + 2 * padding;
-
-	if (size & ~PAGE_MASK) {
-		pr_debug("%s: buffer size %lx is not aligned to %lx",
-			__func__, size, PAGE_SIZE);
-		ret = -EINVAL;
-		goto out;
-	}
-
-	if (iova_length & ~PAGE_MASK) {
-		pr_debug("%s: iova_length %lx is not aligned to %lx",
-			__func__, iova_length, PAGE_SIZE);
-		ret = -EINVAL;
-		goto out;
-	}
-
-	mutex_lock(&mdp3_res->iommu_lock);
-	iommu_meta = mdp3_iommu_meta_lookup(table);
-
-	if (!iommu_meta) {
-		iommu_meta = mdp3_iommu_meta_create(client, handle, table, size,
-				align, iova_length, padding, flags, iova);
-		if (!IS_ERR_OR_NULL(iommu_meta)) {
-			iommu_meta->flags = iommu_flags;
-			ret = 0;
-		} else {
-			ret = PTR_ERR(iommu_meta);
-			goto out_unlock;
-		}
-	} else {
-		if (iommu_meta->flags != iommu_flags) {
-			pr_err("%s: hndl %pK already mapped with diff flag\n",
-				__func__, handle);
-			ret = -EINVAL;
-			goto out_unlock;
-		} else if (iommu_meta->mapped_size != iova_length) {
-			pr_err("%s: hndl %pK already mapped with diff len\n",
-				__func__, handle);
-			ret = -EINVAL;
-			goto out_unlock;
-		} else {
-			kref_get(&iommu_meta->ref);
-			*iova = iommu_meta->iova_addr;
-		}
-	}
-	WARN_ON(iommu_meta->size != size);
-	mutex_unlock(&mdp3_res->iommu_lock);
-
-	*iova = *iova + padding;
-	*buffer_size = size;
-	return ret;
-
-out_unlock:
-	mutex_unlock(&mdp3_res->iommu_lock);
-out:
-	mdp3_iommu_meta_put(iommu_meta);
-	return ret;
-}
-
 int mdp3_put_img(struct mdp3_img_data *data, int client)
 {
 	struct ion_client *iclient = mdp3_res->ion_client;
@@ -1877,10 +1390,10 @@
 					img->memory_id);
 			return -EINVAL;
 		}
-		if (MAJOR(f.file->f_dentry->d_inode->i_rdev) == FB_MAJOR) {
-			fb_num = MINOR(f.file->f_dentry->d_inode->i_rdev);
+		if (MAJOR(f.file->f_path.dentry->d_inode->i_rdev) == FB_MAJOR) {
+			fb_num = MINOR(f.file->f_path.dentry->d_inode->i_rdev);
 			ret = mdss_fb_get_phys_info(&data->addr,
-						&data->len, fb_num);
+							&data->len, fb_num);
 			if (ret) {
 				pr_err("mdss_fb_get_phys_info() failed\n");
 				fdput(f);
@@ -2155,29 +1668,6 @@
 	return rc;
 }
 
-void mdp3_free(struct msm_fb_data_type *mfd)
-{
-	size_t size = 0;
-	int dom;
-	unsigned long phys;
-
-	if (!mfd->iova || !mfd->fbi->screen_base) {
-		pr_info("no fbmem allocated\n");
-		return;
-	}
-
-	size = mfd->fbi->fix.smem_len;
-	phys = mfd->fbi->fix.smem_start;
-	dom = mdp3_res->domains[MDP3_IOMMU_DOMAIN_UNSECURE].domain_idx;
-	iommu_unmap(mdp3_res->domains[MDP3_IOMMU_DOMAIN_UNSECURE].domain,
-			phys, size);
-	msm_iommu_unmap_contig_buffer(mfd->iova, dom, 0, size);
-
-	mfd->fbi->screen_base = NULL;
-	mfd->fbi->fix.smem_start = 0;
-	mfd->iova = 0;
-}
-
 void mdp3_release_splash_memory(struct msm_fb_data_type *mfd)
 {
 	/* Give back the reserved memory to the system */
@@ -2188,7 +1678,6 @@
 				mdp3_res->splash_mem_addr,
 				mdp3_res->splash_mem_size);
 		}
-		mdp3_free(mfd);
 		pr_debug("mdp3_release_splash_memory\n");
 		memblock_free(mdp3_res->splash_mem_addr,
 				mdp3_res->splash_mem_size);
@@ -3056,8 +2545,7 @@
 #define mdp3_resume  NULL
 #endif
 
-
-#ifdef CONFIG_PM_RUNTIME
+#ifdef CONFIG_PM
 static int mdp3_runtime_resume(struct device *dev)
 {
 	bool device_on = true;
diff --git a/drivers/video/fbdev/msm/mdp3_ctrl.c b/drivers/video/fbdev/msm/mdp3_ctrl.c
index ba0a9aa..4a844e9 100644
--- a/drivers/video/fbdev/msm/mdp3_ctrl.c
+++ b/drivers/video/fbdev/msm/mdp3_ctrl.c
@@ -22,13 +22,13 @@
 #include <linux/delay.h>
 #include <linux/dma-buf.h>
 #include <linux/pm_runtime.h>
-#include <linux/sw_sync.h>
 #include <linux/iommu.h>
 
 #include "mdp3_ctrl.h"
 #include "mdp3.h"
 #include "mdp3_ppp.h"
 #include "mdss_smmu.h"
+#include "mdss_sync.h"
 
 #define VSYNC_EXPIRE_TICK	4
 
@@ -233,7 +233,7 @@
 
 	mutex_lock(&mfd->mdp_sync_pt_data.sync_mutex);
 	if (mdp3_session->retire_cnt > 0) {
-		sw_sync_timeline_inc(mdp3_session->vsync_timeline, val);
+		mdss_inc_timeline(mfd->mdp_sync_pt_data.timeline_retire, val);
 		mdp3_session->retire_cnt -= min(val, mdp3_session->retire_cnt);
 	}
 	mutex_unlock(&mfd->mdp_sync_pt_data.sync_mutex);
@@ -2117,7 +2117,7 @@
 static int mdp3_histo_ioctl(struct msm_fb_data_type *mfd, u32 cmd,
 				void __user *argp)
 {
-	int ret = -ENOTSUP;
+	int ret = -ENOTSUPP;
 	struct mdp_histogram_data hist;
 	struct mdp_histogram_start_req hist_req;
 	u32 block;
@@ -2821,8 +2821,8 @@
 	mdp3_session = (struct mdp3_session_data *)mfd->mdp.private1;
 
 	snprintf(name, sizeof(name), "mdss_fb%d_retire", mfd->index);
-	mdp3_session->vsync_timeline = sw_sync_timeline_create(name);
-	if (mdp3_session->vsync_timeline == NULL) {
+	mfd->mdp_sync_pt_data.timeline_retire = mdss_create_timeline(name);
+	if (mfd->mdp_sync_pt_data.timeline_retire == NULL) {
 		pr_err("cannot vsync create time line");
 		return -ENOMEM;
 	}
@@ -2875,8 +2875,9 @@
 	mutex_init(&mdp3_session->lock);
 	INIT_WORK(&mdp3_session->clk_off_work, mdp3_dispatch_clk_off);
 
-	init_kthread_worker(&mdp3_session->worker);
-	init_kthread_work(&mdp3_session->dma_done_work, mdp3_dispatch_dma_done);
+	kthread_init_worker(&mdp3_session->worker);
+	kthread_init_work(&mdp3_session->dma_done_work, mdp3_dispatch_dma_done);
+
 
 	mdp3_session->thread = kthread_run(kthread_worker_fn,
 					   &mdp3_session->worker,
diff --git a/drivers/video/fbdev/msm/mdp3_ctrl.h b/drivers/video/fbdev/msm/mdp3_ctrl.h
index 2cc3421..b7b667b 100644
--- a/drivers/video/fbdev/msm/mdp3_ctrl.h
+++ b/drivers/video/fbdev/msm/mdp3_ctrl.h
@@ -79,7 +79,7 @@
 	int (*wait_for_dma_done)(struct mdp3_session_data *session);
 
 	/* For retire fence */
-	struct sw_sync_timeline *vsync_timeline;
+	struct mdss_timeline *vsync_timeline;
 	int retire_cnt;
 	struct work_struct retire_work;
 };
diff --git a/drivers/video/fbdev/msm/mdp3_layer.c b/drivers/video/fbdev/msm/mdp3_layer.c
index 6c45395..0078466 100644
--- a/drivers/video/fbdev/msm/mdp3_layer.c
+++ b/drivers/video/fbdev/msm/mdp3_layer.c
@@ -21,8 +21,6 @@
 #include <linux/delay.h>
 #include <linux/msm_mdp.h>
 #include <linux/memblock.h>
-#include <linux/sync.h>
-#include <linux/sw_sync.h>
 #include <linux/file.h>
 
 #include <soc/qcom/event_timer.h>
@@ -31,17 +29,18 @@
 #include "mdp3_ppp.h"
 #include "mdp3_ctrl.h"
 #include "mdss_fb.h"
+#include "mdss_sync.h"
 
 enum {
 	MDP3_RELEASE_FENCE = 0,
 	MDP3_RETIRE_FENCE,
 };
 
-static struct sync_fence *__mdp3_create_fence(struct msm_fb_data_type *mfd,
+static struct mdss_fence *__mdp3_create_fence(struct msm_fb_data_type *mfd,
 	struct msm_sync_pt_data *sync_pt_data, u32 fence_type,
 	int *fence_fd, int value)
 {
-	struct sync_fence *sync_fence = NULL;
+	struct mdss_fence *sync_fence = NULL;
 	char fence_name[32];
 	struct mdp3_session_data *mdp3_session;
 
@@ -56,38 +55,42 @@
 
 	if ((fence_type == MDP3_RETIRE_FENCE) &&
 		(mfd->panel.type == MIPI_CMD_PANEL)) {
-		if (mdp3_session->vsync_timeline) {
-			value = mdp3_session->vsync_timeline->value + 1 +
-				mdp3_session->retire_cnt++;
-			sync_fence = mdss_fb_sync_get_fence(
-					mdp3_session->vsync_timeline,
+		if (sync_pt_data->timeline_retire) {
+			value = sync_pt_data->timeline_retire->value + 1 +
+						mdp3_session->retire_cnt++;
+					sync_fence = mdss_fb_sync_get_fence(
+					sync_pt_data->timeline_retire,
 						fence_name, value);
+
 		} else {
 			return ERR_PTR(-EPERM);
 		}
 	} else {
-		sync_fence = mdss_fb_sync_get_fence(sync_pt_data->timeline,
-			fence_name, value);
-	}
+		if (fence_type == MDP3_RETIRE_FENCE)
+			sync_fence = mdss_fb_sync_get_fence(
+						sync_pt_data->timeline_retire,
+							fence_name, value);
+		else
+			sync_fence = mdss_fb_sync_get_fence(
+						sync_pt_data->timeline,
+							fence_name, value);
+		}
 
 	if (IS_ERR_OR_NULL(sync_fence)) {
 		pr_err("%s: unable to retrieve release fence\n", fence_name);
 		goto end;
 	}
 
-	/* get fence fd */
-	*fence_fd = get_unused_fd_flags(0);
+	*fence_fd = mdss_get_sync_fence_fd(sync_fence);
 	if (*fence_fd < 0) {
 		pr_err("%s: get_unused_fd_flags failed error:0x%x\n",
 			fence_name, *fence_fd);
-		sync_fence_put(sync_fence);
-		sync_fence = NULL;
-		goto end;
+			mdss_put_sync_fence(sync_fence);
+			sync_fence = NULL;
+			goto end;
 	}
-
-	sync_fence_install(sync_fence, *fence_fd);
+	pr_debug("%s:val=%d\n", mdss_get_sync_fence_name(sync_fence), value);
 end:
-
 	return sync_fence;
 }
 
@@ -101,7 +104,7 @@
 static int __mdp3_handle_buffer_fences(struct msm_fb_data_type *mfd,
 	struct mdp_layer_commit_v1 *commit, struct mdp_input_layer *layer_list)
 {
-	struct sync_fence *fence, *release_fence, *retire_fence;
+	struct mdss_fence *fence, *release_fence, *retire_fence;
 	struct msm_sync_pt_data *sync_pt_data = NULL;
 	struct mdp_input_layer *layer;
 	int value;
@@ -127,7 +130,7 @@
 		if (layer->buffer.fence < 0)
 			continue;
 
-		fence = sync_fence_fdget(layer->buffer.fence);
+		fence = mdss_get_fd_sync_fence(layer->buffer.fence);
 		if (!fence) {
 			pr_err("%s: sync fence get failed! fd=%d\n",
 				sync_pt_data->fence_name, layer->buffer.fence);
@@ -142,7 +145,7 @@
 	if (ret)
 		goto sync_fence_err;
 
-	value = sync_pt_data->timeline_value + sync_pt_data->threshold +
+	value = sync_pt_data->threshold +
 			atomic_read(&sync_pt_data->commit_cnt);
 
 	release_fence = __mdp3_create_fence(mfd, sync_pt_data,
@@ -166,13 +169,13 @@
 
 retire_fence_err:
 	put_unused_fd(commit->release_fence);
-	sync_fence_put(release_fence);
+	mdss_put_sync_fence(release_fence);
 release_fence_err:
 	commit->retire_fence = -1;
 	commit->release_fence = -1;
 sync_fence_err:
 	for (i = 0; i < sync_pt_data->acq_fen_cnt; i++)
-		sync_fence_put(sync_pt_data->acq_fen[i]);
+		mdss_put_sync_fence(sync_pt_data->acq_fen[i]);
 	sync_pt_data->acq_fen_cnt = 0;
 
 	mutex_unlock(&sync_pt_data->sync_mutex);
diff --git a/drivers/video/fbdev/msm/mdp3_ppp.c b/drivers/video/fbdev/msm/mdp3_ppp.c
index 3b72b2d..612cccc 100644
--- a/drivers/video/fbdev/msm/mdp3_ppp.c
+++ b/drivers/video/fbdev/msm/mdp3_ppp.c
@@ -20,8 +20,6 @@
 #include <linux/uaccess.h>
 #include <linux/sched.h>
 #include <linux/mutex.h>
-#include <linux/sync.h>
-#include <linux/sw_sync.h>
 #include "linux/proc_fs.h"
 #include <linux/delay.h>
 
@@ -30,6 +28,7 @@
 #include "mdp3_hwio.h"
 #include "mdp3.h"
 #include "mdss_debug.h"
+#include "mdss_sync.h"
 
 #define MDP_IS_IMGTYPE_BAD(x) ((x) >= MDP_IMGTYPE_LIMIT)
 #define MDP_RELEASE_BW_TIMEOUT 50
@@ -76,12 +75,12 @@
 	struct mdp_blit_req req_list[MAX_LIST_WINDOW];
 	struct mdp3_img_data src_data[MAX_LIST_WINDOW];
 	struct mdp3_img_data dst_data[MAX_LIST_WINDOW];
-	struct sync_fence *acq_fen[MDP_MAX_FENCE_FD];
+	struct mdss_fence *acq_fen[MDP_MAX_FENCE_FD];
 	u32 acq_fen_cnt;
 	int cur_rel_fen_fd;
 	struct sync_pt *cur_rel_sync_pt;
-	struct sync_fence *cur_rel_fence;
-	struct sync_fence *last_rel_fence;
+	struct mdss_fence *cur_rel_fence;
+	struct mdss_fence *last_rel_fence;
 };
 
 struct blit_req_queue {
@@ -104,7 +103,8 @@
 	struct task_struct *blit_thread;
 	struct blit_req_queue req_q;
 
-	struct sw_sync_timeline *timeline;
+	struct mdss_timeline *timeline;
+
 	int timeline_value;
 
 	struct timer_list free_bw_timer;
@@ -1188,19 +1188,19 @@
 	ATRACE_BEGIN(__func__);
 	/* buf sync */
 	for (i = 0; i < req->acq_fen_cnt; i++) {
-		ret = sync_fence_wait(req->acq_fen[i],
+		ret = mdss_wait_sync_fence(req->acq_fen[i],
 				WAIT_FENCE_FINAL_TIMEOUT);
 		if (ret < 0) {
 			pr_err("%s: sync_fence_wait failed! ret = %x\n",
 				__func__, ret);
 			break;
 		}
-		sync_fence_put(req->acq_fen[i]);
+		mdss_put_sync_fence(req->acq_fen[i]);
 	}
 	ATRACE_END(__func__);
 	if (ret < 0) {
 		while (i < req->acq_fen_cnt) {
-			sync_fence_put(req->acq_fen[i]);
+			mdss_put_sync_fence(req->acq_fen[i]);
 			i++;
 		}
 	}
@@ -1209,7 +1209,7 @@
 
 void mdp3_ppp_signal_timeline(struct blit_req_list *req)
 {
-	sw_sync_timeline_inc(ppp_stat->timeline, 1);
+	mdss_inc_timeline(ppp_stat->timeline, 1);
 	MDSS_XLOG(ppp_stat->timeline->value, ppp_stat->timeline_value);
 	req->last_rel_fence = req->cur_rel_fence;
 	req->cur_rel_fence = 0;
@@ -1221,12 +1221,12 @@
 	int i;
 
 	put_unused_fd(req->cur_rel_fen_fd);
-	sync_fence_put(req->cur_rel_fence);
+	mdss_put_sync_fence(req->cur_rel_fence);
 	req->cur_rel_fence = NULL;
 	req->cur_rel_fen_fd = 0;
 	ppp_stat->timeline_value--;
 	for (i = 0; i < req->acq_fen_cnt; i++)
-		sync_fence_put(req->acq_fen[i]);
+		mdss_put_sync_fence(req->acq_fen[i]);
 	req->acq_fen_cnt = 0;
 }
 
@@ -1235,7 +1235,7 @@
 {
 	int i, fence_cnt = 0, ret = 0;
 	int acq_fen_fd[MDP_MAX_FENCE_FD];
-	struct sync_fence *fence;
+	struct mdss_fence *fence;
 
 	if ((buf_sync->acq_fen_fd_cnt > MDP_MAX_FENCE_FD) ||
 		(ppp_stat->timeline == NULL))
@@ -1249,7 +1249,7 @@
 		return ret;
 	}
 	for (i = 0; i < buf_sync->acq_fen_fd_cnt; i++) {
-		fence = sync_fence_fdget(acq_fen_fd[i]);
+		fence = mdss_get_fd_sync_fence(acq_fen_fd[i]);
 		if (fence == NULL) {
 			pr_info("%s: null fence! i=%d fd=%d\n", __func__, i,
 				acq_fen_fd[i]);
@@ -1265,19 +1265,12 @@
 	if (buf_sync->flags & MDP_BUF_SYNC_FLAG_WAIT)
 		mdp3_ppp_wait_for_fence(req);
 
-	req->cur_rel_sync_pt = sw_sync_pt_create(ppp_stat->timeline,
-			ppp_stat->timeline_value++);
 	MDSS_XLOG(ppp_stat->timeline_value);
-	if (req->cur_rel_sync_pt == NULL) {
-		pr_err("%s: cannot create sync point\n", __func__);
-		ret = -ENOMEM;
-		goto buf_sync_err_2;
-	}
+
 	/* create fence */
-	req->cur_rel_fence = sync_fence_create("ppp-fence",
-			req->cur_rel_sync_pt);
+	req->cur_rel_fence = mdss_get_sync_fence(ppp_stat->timeline,
+				"ppp_fence", NULL, ppp_stat->timeline_value++);
 	if (req->cur_rel_fence == NULL) {
-		sync_pt_free(req->cur_rel_sync_pt);
 		req->cur_rel_sync_pt = NULL;
 		pr_err("%s: cannot create fence\n", __func__);
 		ret = -ENOMEM;
@@ -1289,7 +1282,7 @@
 	ppp_stat->timeline_value--;
 buf_sync_err_1:
 	for (i = 0; i < fence_cnt; i++)
-		sync_fence_put(req->acq_fen[i]);
+		mdss_put_sync_fence(req->acq_fen[i]);
 	req->acq_fen_cnt = 0;
 	return ret;
 }
@@ -1586,7 +1579,7 @@
 {
 	struct blit_req_list *req;
 	struct blit_req_queue *req_q = &ppp_stat->req_q;
-	struct sync_fence *fence = NULL;
+	struct mdss_fence *fence = NULL;
 	int count, rc, idx, i;
 
 	count = req_list_header->count;
@@ -1642,13 +1635,8 @@
 	}
 
 	if (async) {
-		req->cur_rel_fen_fd = get_unused_fd_flags(0);
-		if (req->cur_rel_fen_fd < 0) {
-			pr_err("%s: get_unused_fd_flags failed\n", __func__);
-			rc  = -ENOMEM;
-			goto parse_err_1;
-		}
-		sync_fence_install(req->cur_rel_fence, req->cur_rel_fen_fd);
+		req->cur_rel_fen_fd = mdss_get_sync_fence_fd(
+							req->cur_rel_fence);
 		rc = copy_to_user(req_list_header->sync.rel_fen_fd,
 			&req->cur_rel_fen_fd, sizeof(int));
 		if (rc) {
@@ -1664,12 +1652,12 @@
 	kthread_queue_work(&ppp_stat->kworker, &ppp_stat->blit_work);
 	if (!async) {
 		/* wait for release fence */
-		rc = sync_fence_wait(fence,
+		rc = mdss_wait_sync_fence(fence,
 				5 * MSEC_PER_SEC);
 		if (rc < 0)
 			pr_err("%s: sync blit! rc = %x\n", __func__, rc);
 
-		sync_fence_put(fence);
+		mdss_put_sync_fence(fence);
 		fence = NULL;
 	}
 	return 0;
@@ -1697,15 +1685,15 @@
 		return -ENOMEM;
 
 	/*Setup sync_pt timeline for ppp*/
-	ppp_stat->timeline = sw_sync_timeline_create(timeline_name);
+	ppp_stat->timeline = mdss_create_timeline(timeline_name);
 	if (ppp_stat->timeline == NULL) {
 		pr_err("%s: cannot create time line\n", __func__);
 		return -ENOMEM;
 	}
 	ppp_stat->timeline_value = 1;
 
-	init_kthread_worker(&ppp_stat->kworker);
-	init_kthread_work(&ppp_stat->blit_work, mdp3_ppp_blit_handler);
+	kthread_init_worker(&ppp_stat->kworker);
+	kthread_init_work(&ppp_stat->blit_work, mdp3_ppp_blit_handler);
 	ppp_stat->blit_thread = kthread_run(kthread_worker_fn,
 					&ppp_stat->kworker,
 					"mdp3_ppp");
diff --git a/drivers/video/fbdev/msm/mdp3_ppp_hwio.c b/drivers/video/fbdev/msm/mdp3_ppp_hwio.c
index 6f077e2..ec806cf 100644
--- a/drivers/video/fbdev/msm/mdp3_ppp_hwio.c
+++ b/drivers/video/fbdev/msm/mdp3_ppp_hwio.c
@@ -41,7 +41,7 @@
 	LAYER_MAX,
 };
 
-static long long mdp_do_div(long long num, long long den)
+static long long mdp_do_div(uint64_t num, uint64_t den)
 {
 	do_div(num, den);
 	return num;
diff --git a/drivers/video/fbdev/msm/mdss_dsi.c b/drivers/video/fbdev/msm/mdss_dsi.c
index d70c1e8..6bb0960 100644
--- a/drivers/video/fbdev/msm/mdss_dsi.c
+++ b/drivers/video/fbdev/msm/mdss_dsi.c
@@ -743,7 +743,7 @@
 	if (blen < 0)
 		return 0;
 
-	if (copy_to_user(buf, buffer, blen))
+	if (copy_to_user(buf, buffer, min(count, (size_t)blen+1)))
 		return -EFAULT;
 
 	*ppos += blen;
diff --git a/include/media/msmb_generic_buf_mgr.h b/include/media/msmb_generic_buf_mgr.h
index b3e1a02..95cfcad7 100644
--- a/include/media/msmb_generic_buf_mgr.h
+++ b/include/media/msmb_generic_buf_mgr.h
@@ -43,6 +43,8 @@
 #define VIDIOC_MSM_BUF_MNGR_FLUSH32 \
 	_IOWR('V', BASE_VIDIOC_PRIVATE + 39, struct msm_buf_mngr_info32_t)
 
+#define VIDIOC_MSM_BUF_MNGR_BUF_ERROR32 \
+	_IOWR('V', BASE_VIDIOC_PRIVATE + 41, struct msm_buf_mngr_info32_t)
 #endif
 
 #endif
diff --git a/include/trace/events/trace_msm_pil_event.h b/include/trace/events/trace_msm_pil_event.h
index 4795dc5..072bbbb 100644
--- a/include/trace/events/trace_msm_pil_event.h
+++ b/include/trace/events/trace_msm_pil_event.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017, 2018 The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -40,6 +40,7 @@
 		__get_str(fw_name))
 );
 
+#ifdef CONFIG_MSM_PIL
 TRACE_EVENT(pil_notif,
 
 	TP_PROTO(const char *event_name, unsigned long code,
@@ -64,6 +65,9 @@
 		__entry->code,
 		__get_str(fw_name))
 );
+#else
+#define trace_pil_notif(event_name, code, fw_name) do { } while (0)
+#endif
 
 TRACE_EVENT(pil_func,
 
diff --git a/include/uapi/media/msmb_generic_buf_mgr.h b/include/uapi/media/msmb_generic_buf_mgr.h
index 2961cae..8dad9ae 100644
--- a/include/uapi/media/msmb_generic_buf_mgr.h
+++ b/include/uapi/media/msmb_generic_buf_mgr.h
@@ -62,5 +62,7 @@
 	_IOWR('V', BASE_VIDIOC_PRIVATE + 40, \
 	struct msm_camera_private_ioctl_arg)
 
+#define VIDIOC_MSM_BUF_MNGR_BUF_ERROR \
+	_IOWR('V', BASE_VIDIOC_PRIVATE + 41, struct msm_buf_mngr_info)
 #endif