DOWNSTREAM: Fastfoward camx Topic branch to AU200

* commit '14416b24d6229fcacde62b3826e6e60898a2c53a':
  msm: ipa: add new IP filtering bitmaps
  ARM: dts: msm: Add battery data for MLP356477 battery
  msm: kgsl: Avoid sending 0 BW and GPU freq to GMU
  kernel: Restrict permissions of /proc/iomem.
  defconfig: sdm845: enable refgen regulator driver
  ARM: dts: msm: keep refgen regulator always-on for SDM845 v2
  ARM: dts: msm: add refgen regulator device for SDM845 v2
  defconfig: sdm845: enable regulator proxy consumer driver
  regulator: add refgen regulator driver
  ARM: dts: msm: update the energy model for SDM845v2
  msm: kgsl: Remove GPU_CC_GX_CXO_CLK from list of clocks
  ARM: dts: msm: Add the silver BIN1 table for SDM845 v2
  diag: Fix possible usage of freed resource issue
  msm: ADSPRPC: validate user buffers after copying from user
  leds: qpnp-wled: Cap the lower limit of brightness level
  drm/msm/sde: handle color processing in secure state
  drm/msm/sde: cleanup handling of secure buffer in planes
  drm/msm/sde: manage secure and non-secure transition in sde
  msm: gsi: check channel state on timeout
  drm/dp: add HBR3 link rate definitions
  ANDROID: fix acl leaks
  power: smblib: make OTG_VOTER suspend input only in OTG state
  cpufreq: schedutil: Add current capacity info to schedutil tracepoint
  msm: vidc: Add new trace events
  Enable multi-channel bit for SCO Tx with water mark level 1
  msm: kgsl: Pass GPU HW version to GMU
  msm: vidc: Send profile/level to the userspace
  msm: vidc: Support low latency for decode
  tracing: do not leak kernel addresses
  msm: kgsl: Update the smmu magic for A6XX preemption
  drm/msm/dp: add dp_debug module
  drivers: cpuidle: check if its okay to do cluster low power modes
  clk: qcom: clk-cpu-osm: Updates to OSM DATA MEM programming
  ARM: dts: msm: add msm-ext-display module for sdm845
  drm/sde: set DisplayPort/HDMI switch
  drm/msm/dp: add audio support
  qcdev: Check the digest length during the SHA operations
  ASoC: sdm660: Remove LPI gpio configuration for codec interrupt
  iommu: arm-smmu: Enable sid switch usecase
  iommu: arm-smmu: Remove unused functions for qsmmuv500
  iommu: arm-smmu: Remove regulator_bulk_enable call
  drm/msm/dp: add hardware catalog for audio
  platform: msm: add support for external display module
  leds: remove unused driver leds-qpnp-flash.c
  ARM: dts: msm: disable reg dma block for sdm845
  ARM: dts: msm: Add MX regulator thermal config for SDM845
  defconfig: Enable regulator cooling device for SDM845
  drivers: thermal: regulator_cdev: Add a voltage regulator cooling device
  netfilter: xt_quota2: 4.9 netlink notification fix
  power: qpnp-fg-gen3: improve cycle counter algorithm
  power: qpnp-fg-gen3: make TTF monotonic by limiting slope
  power: qpnp-fg-gen3: optimize TTF for QNOVO
  power: qpnp-fg-gen3: prepare for QNOVO TTF
  ARM64: Increase the number of gpios to 1280
  defconfig: Enable regulator AOP cooling device for SDM845 and SDM670
  msm: kgsl: Trigger preemption only when preemption is enabled
  time: sched_clock: record cycle count in suspend and resume
  msm: adsprpc: Avoid leak info of pointers addresses to dmesg
  ARM: dts: msm: Add support for haptics on PM660
  ARM: dts: msm: add SPMI PMIC arbiter device for sdxpoorwills
  msm: kgsl: Disable microcode save/restore of perf counter values on A6x
  iommu/io-pgtable-fast: invalidate TLBs on unmap
  clk: qcom: clk-cpu-osm: Update logic to check if OSMs been enabled in TZ
  driver: thermal: regulator_aop: Rename AOP Regulator cooling device
  cpufreq: schedutil: Avoid WALT logic when WALT sysctl flag not set
  checkpatch: Check to make sure DT property names are lowercase
  checkpatch: Only newline after };
  drm/msm/sde: add check for inline rotation source split cfg
  drm/msm/sde: add ubwc equivalent tile formats
  ARM: dts: msm: Resolve XPU fault on qseecom memory on sdm845
  power: fg-util: add median filter for circular buffer
  power: qpnp-fg-gen3: use the CC_STEP and CC_STEP_SEL properties
  power_supply: add CC_STEP and CC_STEP_SEL properties
  qpnp-smb2: Ignore status 7 register while qnovo is enabled
  qcom: qnovo: restart pulse train in stall state
  qpnp-qnovo: add debounce for charger
  qpnp-qnovo: prevent pulse train while esr is in progress
  qpnp-fg-gen3: qnovo ESR/IADC workarounds
  qpnp-qnovo: IADC/ESR workarounds
  power: qcom-step-chg: Add temperature based step-charging
  msm: ipa: fix race condition around sys->len
  qpnp-smb2: Support faking battery full status in WiPower
  qcom: battery: Fix parallel disabled issue on charging boot
  drivers: qcom: system_pm: allow idle drivers to query system state
  ASoC: msm: make SND_SOC_660 to depend on ARCH_QCOM instead of specific SOC
  msm: vidc: add P010 support in uapi
  media: broadcast: tspp: Add SMMU translation for ION buffers
  ASoC: msm: qdspv2: initialize struct member before being used
  msm: vidc: Update core and stage selection logic
  drm/msm/sde: switch to lp2 for pm suspend call during lp1
  ARM: dts: msm: Update memory map for sdm845
  spi: spi-geni-qcom: Introduce GSI DMA mode
  power: qcom: smb-lib: optimize parallel current limiting with PD
  msm: ipa: fix client cons check on hw stats
  platform: msm: qcom-geni-se: Modify GSI switch sequence
  msm: sde: cleanup format validation for sbuf mode
  ARM: dts: msm: move PMI8998 devices into overlays for sdm845
  usb: dwc3: Suspend USB SS PHY in host mode with device connect case
  platform: msm: qcom-geni-se: Fix error during bus voting
  drivers: qcom: rpmh: export controller status
  drm/msm/sde: fix validation in secure state check
  ASoC: wcd-mbhc: Increase number of measurements for impedance calc to 900
  ASoC: APR: initialize struct member before being used
  ASoC: msm: Free the gpio on remove
  btfm: Correct the slimbus turn on/off sequence for FM ports
  ASoC: msm: qdsp6v2: Replace default Tx voice topology
  drm/msm/sde: move lp handling to kickoff callback
  ARM: dts: msm: Change battery profile for QRD845 device
  ARM: dts: msm: Add battery profile for GT3746A6 battery
  tty: serial: msm_geni_serial: Fix the race condition during RX
  input: misc: hbtp_input: Support for Region of Interest/sensors
  i2c: qcom: geni: Use GSI DMA-engine if FIFO is disabled
  drm/msm/sde: set inline rotator output x & y offset to 0
  ARM: dts: msm: configure vref LDO for isens hardware in SDM845
  dwc3-msm: Add functionality to restart USB host mode
  drivers: qcom: rpmh: crash on lack of response
  spcom: ignore CONNECTED notification while closing the channel
  drivers: swr-wcd-ctrl: Fix wsa mute at boot
  mm: cma: fix stack corruption due to sprintf usage
  drm/msm/sde: update te vsync enable sequence change
  spcom: avoid race condition when handling commands
  spcom: move SPCOM_MAX_CHANNELS define to uapi/linux/spcom.h
  ARM: dts: msm: Enable auto-calibration for WLED on PM660/PMI8998
  leds: qpnp-wled: Add auto-calibration logic for WLED
  Revert "ARM: dts: msm: Defer regulator disable for SDM845 GPU SMMU"
  Revert "arm64: defconfig: Enable QSEE IPC irq bridge"
  Revert "ARM: dts: msm: Enable support for QSEE IPC irq bridge on sdm845"
  ARM: dts: msm: Add display support for SDM845 based SMD670 interposer
  driver: thermal: lmh-dcvsh: Expose lmh frequency limit sysfs
  drm/msm/dp: use fixed NVID for VGA dongles
  ARM: dts: msm: Update the CPU clock speedbin table for SDM845v2
  drm/msm/sde: Update color processing on suspend/resume transitions
  msm: sde: move vbif init after clock enable
  drm/msm/sde: override kms post open function
  drm/msm/sde: update sspp dirty flags if inline cfg changes
  drm/msm/sde: clear vbif errors before kickoff
  drm/msm/sde: delay inline rotate start until kickoff
  msm: kgsl: Add support for GPU AB voting
  ARM: dts: msm: Add support for GPU AB vote on SDM845
  cma: Store a name in the cma structure
  ARM: dts: msm: Add FastRPC QoS latency control for sdm845
  msm: ADSPRPC: add support for fastrpc control interface
  diag: Add support for header untagging
  ARM: dts: msm: Add audio support for SDM845 Interposer SDM670
  ARM: dts: msm: Initial change for audio on sdm670
  defconfig: msm: Add perf configuration support for sdm670
  btfm: provide a way to query wcn3990 status
  msm: msm_bus: Do not send tcs sets when size is 0
  ARM: dts: msm: vote for half of GPU IB in DCVS in SDM845
  ARM: dts: msm: update APC0 speed bin 1 CPRh regulator config for SDM845 v2
  ARM: dts: msm: Specify bmd-en-delay-ms for QRD845 device
  power: qpnp-fg-gen3: Add property to set delay between RID and BMD
  usb: pd: Support revision 3.0 in sink-only mode
  usb: pd: simplify pd_phy_write() and pd_phy_signal() usage
  usb: pd: rename enum pd_msg_type to pd_sop_type
  ARM: dts: msm: Change memlat freq tables for SDM845
  clk: qcom: gpucc-sdm845: Fix gfx3d clock frequency for SDM845 V2
  drm/msm/dsi-staging: add dsi phy isolate enable config
  drm/msm/sde: return last misr status during idle pc
  ARM: dts: msm: update dual dsi sim panel res for sdm845 target
  defconfig: sdxpoorwills: disable DCC console
  drm/msm/sde: memory leak fix for virtual plane formats
  drm/msm/sde: virtual plane validation fixes for tiled formats
  drm/msm/sde: set the tile height for all supported formats
  msm: vidc: Print noc error information after pagefault
  msm: vidc: Handle rotation during capability check
  msm: kgsl: Dump GMU snapshot
  ARM: dts: msm: Fix mic detection for SDM845 QRD
  drivers: soc: apr: add initialization of a local variable
  drm/msm: support backoff time update only in sde rsc
  drm/msm: update irq registration during seamless mode switch
  drm/msm: fix sde debug bus test point for valid status
  ARM: dts: msm: Update latency for Sleep modes
  drivers: lmh-dcvsh: Add isens vref regulator support
  btfm: Enable multichannel bit for SCO Rx
  ASoC: msm: add support for bit width selection
  nl80211: Update ERP info using NL80211_CMD_UPDATE_CONNECT_PARAMS
  msm: vidc: Add support for TME
  cfg80211: Include length of kek in rekey data
  qbt1000: Validate FP app name before qseecom_start_app
  arm: dma-mapping: Add dma_remap functions
  msm: msm_bus: Ignore -EBUSY from RPMH when sending AWAKE requests
  seemp: adjust interpretation of rooting report
  defconfig: sdm845: Enable FORTIFY_SOURCE
  drm/msm/sde: add null checks for pingpong and encoder hardware
  drm/msm: allow rsc clients to wait on crtc id on transition
  ARM: dts: msm: Add the syscon compatible string to clock nodes on SDM845v2
  drivers: edac: Update banks for edac sysfs entry
  clk: Add separate function to print clocks enabled during suspend
  clk: qcom: Fix clock GPUCC PLL1 crash when call regulator_set_voltage
  drm/msm/sde: increase gpu input fence timeout to 10 seconds
  drm/msm: dispatch sync commit to display thread
  drm/msm/sde: reuse rotator from previous crtc states
  msm: sde: allow offline session to wait for inline closing
  drm/msm: clean up inline rotator register dump
  msm: sde: clean up evtlog & trace for inline rotator
  drm/msm/sde: toggle vblank using enable state in display thread
  msm: kgsl: Always do an OOB for DCVS
  msm: kgsl: Use the proper power level indexes
  msm: kgsl: Use OPP API to query VLVL of GPU/GMU frequency
  msm: kgsl: Remove code that touches GFX clock
  msm: kgsl: Update the context create flags
  msm: vidc: Return only active state VBs during flush
  drm/msm: Fix potential buffer overflow issue
  ARM: dts: msm: Add SDM845 Interposer SDM670 support
  mm: run the showmem notifier in alloc failure
  mm, oom: run the showmem notifier in oom
  mm: cma: Register with show_mem notification framework
  lowmemorykiller: Run the showmem notifier when killing
  mm: cma: print allocation failure reason and bitmap status
  diag: Add NULL pointer checks
  ion: Correct argument of Set/ClearPagePrivate of secure CMA
  ARM: dts: msm: Defer regulator disable for SDM845 GPU SMMU
  iommu/arm-smmu:  Add support for regulator deferred disable
  msm: ADSPRPC: Queue one more intent to avoid race condition
  wil6210: protect against invalid length of tx management frame
  ASoC: msm: Add support for Stereo EC Reference
  ASoC: msm_sdw: Set codec directory name at runtime
  pinctrl: lpi: Update LPI address size and offset for SDM670
  pinctrl: qcom: Add direct connect configuration for sdm670
  Prevent heap overflow in uvc driver
  ANDROID: ion: Fix uninitialized variable
  ANDROID: ion: Protect kref from userspace manipulation
  video: adf: zero out mapping data on adf_buffer_map() failure
  CHROMIUM: usb: gadget: configfs: Fix KASAN use-after-free
  android: fiq_debugger: restrict access to critical commands.
  ANDROID: ion: check for kref overflow
  cgroup: prefer %pK to %p
  ion: Convert allocation counters to long
  iommu: io-pgtable-arm: Remove duplicate tlb flush
  ARM: dts: msm: Correct required clocks for kgsl_iommu for sdm845
  iommu: arm-smmu: Disable ATOS feature for the QSMMUV2 model
  ASoC: msm: qdsp6v2: Set path type to LIVE_REC in LISTEN passthrough case
  msm: vidc: Fix VP9 decoder failure due to scaling feature
  usb: misc: lvstest: add entry to place port in compliance mode
  usb: xhci: Support enabling of compliance mode for xhci 1.1
  drivers: mailbox: qti-tcs: fix for h/w issue with RSC clock gating
  ARM: dts: msm: add PM8998 LDO 1 active-only regulator device for sdm845
  scsi: ufs: add ufs card removal support
  regulator: rpmh-regulator: correct initial wake-only state request
  USB: f_ccid: Unblock ccid_ctrl_read() during disconnect
  ARM: dts: msm: Update USB bus voting to allow low svs on SDM845
  drm/msm/sde: correct scale offset for some gamut modes
  tty: serial: msm_geni_serial: Add SE DMA transfer mode support
  drm/msm/sde: handle atomic commit with dynamic mode switch
  drm/msm/dsi-staging: add support for dynamic mode switch
  drm/msm: defer DSI panel timing parameter parsing
  msm: kgsl: Dump the RB registers correctly on A6XX
  mfd: wcd9xxx: Add support for gpio controlled buck VSEL pin
  msm: kgsl: Do not memset pages to zero while adding to pool
  ARM: dts: msm: Enable SMMU GDSCs for sdm670
  icnss: Delay Shutdown/reinit sequence for all cases
  ARM: dts: msm: Add fastrpc device tree nodes for sdm670
  ASoC: core: Fix possible NULL pointer dereference
  msm: ipa3: Fix IPA aggregation force close call
  ARM: dts: msm: switch to RPMh controlled PMIC regulators for sdm670
  core_ctl: Switch isolation to new hotplug state callbacks
  include/linux/string.h: add the option of fortified string.h functions
  lkdtm: hide stack overflow warning for corrupt-stack test
  lkdtm: Prevent the compiler from optimising lkdtm_CORRUPT_STACK()
  lkdtm: Add tests for struct list corruption
  IB/rxe: do not copy extra stack memory to skb
  staging/rts5208: Fix read overflow in memcpy
  kexec_file: adjust declaration of kexec_purgatory
  efi: avoid fortify checks in EFI stub
  arm64, vdso: Define vdso_{start,end} as array
  arm64: Use __pa_symbol for kernel symbols
  arm64: Add cast for virt_to_pfn
  mm: Introduce lm_alias
  msm: vidc: Map rate control vbr_vfr to vbr_cfr
  ARM: dts: msm: Update the SDCC2 clock frequency on SDM845 v2
  serial: msm_geni_serial: Remove proxy driver resource vote for HS UART
  lpm: add sysfs tunable for bias hyst
  soc: qcom: scm: fix boot issue when compiled with clang
  msm: ipa3: fix the Use-after-free in ipa3_dma_destroy
  soc: qcom: ipc_router: Improve IPC attribution
  coresight: tmc: Fix the spinlock release in tmc etr disable function
  msm:kgsl: Add Limits Management code to A6XX platform
  ASoC: msm: qdspv2: Fix missing mutex unlock in LSM client driver
  ASoC: msm: qdsp6v2: Add support to query AVCS version info
  drm/msm/dp: retry failed AUX transactions
  drm/msm/dp: update parsing of AUX configuration settings
  msm: ipa: Fix wrong usage and cleanup code
  msm: ipa: Fix invalid source pipe index
  msm: ipa3: Fix Q6 resourse manager de-init
  cpufreq: cpu-boost: utilize latest sched_boost API
  ARM: dts: msm: Update the revision id for v1 chips on SDM845
  arm64: ascii armor the arm64 boot init stack canary
  random,stackprotect: introduce get_random_canary function
  random: convert get_random_int/long into get_random_u32/u64
  kthread: Fix use-after-free if kthread fork fails
  arm64: uaccess: consistently check object sizes
  clk: qcom: clk-cpu-osm: Rework the MEM_ACC_LEVEL setting logic
  power: pmic-voter: make debug status more parsable
  ARM: dts: msm: Add graphic clock support for SDM845 v2
  clk: qcom: Add GPU CC and GFX clock driver support for SDM845 v2
  clk: qcom: gcc-sdm845: Enable the gcc_aggre_noc_pcie_tbu_clk explicitly
  drm/msm/dsi-staging: fix DSI controller init sequence
  msm: wlan: Regulatory updates
  sched: Don't update idle_cpus_mask during core isolation
  ASoC: msm: Change wsa dt property to optional
  ASoC: wsa881x: Add support to stub out wsa functionality
  ARM: dts: msm: Add DT node for aop-qmp clock controller on SDM845 v2
  clk: qcom: clk-aop-qmp: Add support for the qdss_ao clock resource
  usb: gadget: mtp: Move mutex_init() to alloc_inst_mtp_ptp()
  USB: f_mtp: Perform vfs_write under mutex protection
  SDM660: ADSPRPC: Align the size of IOVA to 128MB
  msm: ipa: Fix for missing int overflow check in the refcount library
  msm: ipa3: Fix to avoid accessing of uninitialized structure
  soc: qcom: Notify to app pd clients in ind_ack thread
  sdm660: ADSPRPC: Null check file session ctx during mmap create
  msm: ADSPRPC: avoid sending new requests to dsp while device_release
  mmc: host: Capture error states in Trace logs.
  defconfig: sdm845: Enable CTR crypto in kernel
  defconfig: sdm670: Remove msm-core driver
  soc: qcom: msm_performance: Include msm-core header
  msm: ipa: add support for packet length update
  msm: vidc: Convert useltr index value to bit mask
  ARM: dts: msm: Enable llc bw voting as per load
  msm: vidc: Add support for llc split bandwidth
  msm: vidc: Add support for runtime input CR
  sched: bring back sched_migrate_task trace point
  sched: move task_util() to sched.h
  soc: eud: Fix event handling for input suspend/unsuspend
  ASoC: msm: qdsp6v2: Add capture support for MultiMedia10 FE
  crypto: msm: Fix buffer overflow issue
  ARM: dts: msm: Remove the qcom,pc-override-index flag on SDM845
  btfm: cleanup slimbus device node in failure scenerios
  crypto: Change format specifier %p to %pK
  soc: qcom: pil: Signal call to cleanup TZ internal state in failure
  crypto: msm: Fix several race condition issues in crypto drivers
  ASoC: msm8996: remove unused machine driver
  compat_qcedev: Fix accessing userspace memory in kernel space
  usb: dwc3: dwc3-msm: Handle floating charger PMI notification properly
  usb: pd: policy_engine: Add support to handle floating charger
  usb: dwc3-msm: Add support to handle floating D+/D- lines
  pinctrl: qcom: Update pinctrl for SDM845 v2
  pinctrl: qcom: Dynamic detection of tile bases
  ARM: dts: msm: Enable the OSM clock driver support on SDM845 v2
  ARM: dts: msm: Enable support for QSEE IPC irq bridge on sdm845
  arm64: defconfig: Enable QSEE IPC irq bridge
  soc: qcom: Add Snapshot of QSEE IPC irq driver
  drivers: soc: qcom: Ensure bytes_received is initialized
  qcom: scm: Remove inputs printing from scm_call2_atomic
  drivers: cpuidle: lpm-levels: respect CPU bias
  ARM: dts: msm: Add PIL sub-system for IPA FWs on sdxpoorwills
  sched: add sched_get_cpu_last_busy_time() API
  Perf: core: create/delete shared kernel events
  msm: ADSPRPC: Fix for NULL pointer dereference
  arm: dma-mapping: flush highmem mappings
  ARM: dma-mapping: Allow highmem pages to not have a mapping
  arm: dma: Allow CMA pages to not have a kernel mapping.
  mmc: core: fix typo in mmc_stop_host
  msm: kgsl: Enable dynamic bus scaling for the GPU
  clk: qcom: clk-cpu-osm: Correct the logic to return the CPU cycle counter
  msm: vidc: Update profile/level capabilities
  ARM: dts: msm: add VDD_APC0/1 CPR regulator configurations for sdm845v2
  regulator: cprh-kbss-regulator: add support for SDM845v2 CPR controllers
  ARM: dts: msm: Update count unit for CPU bwmon on sdm845v2
  drm/msm/sde: enable write_gather_en in VBIF for all write clients
  msm: ipa4: add unit test for statistics
  drm/msm/sde: report qseed3 h/w version in plane caps
  drm/msm/sde: register set_power callback for dsi driver
  drm/msm/dsi-staging: add lp1/lp2 command support
  drm/msm/sde: select shorter idle pc timeout for lp modes
  ASoC: wcd934x-dsp-cntl: notify online event after clocks are disabled
  ARM: dts: msm: modify mdss mdp clock rates for sdm845 HW
  msm: ipa4: add support for statistics
  clk: qcom: gcc-sdm845: Update the SDCC2 clock frequency on SDM845 v2
  drm/msm: add more vbif error info to vbif debug bus dump
  arm64: dma-mapping: fix aliasing issues with non-CMA alloc
  ion: Set the page private bit for secure CMA buffers
  ASoC: msm: qdsp6v2: make audio debugfs read and release exclusive
  arm: Skip DMA zeroing completely only if specified
  msm: kgsl: Fix a race condition when destroying fence events
  f_audio_source: Use f_audiosource as first device name
  mmc: card: blk: Add support for deferred SD bus resume
  ARM: dts: msm: Add sdhc1 for sdm670 rumi
  soc: qcom: secure_buffer: Remove deprecated functions
  ARM: dts: msm: modify QRD panel support configuration for SDM845
  trace: prevent NULL pointer dereference
  msm: vidc: Flush debug message queue before power collpase
  coresight: tmc: Read the TMC mode register only if clk is enabled
  coresight: stm: Fix missing disable flag when disabling STM
  ARM: dts: msm: specify haptics device for sdm845 QRD
  soc: qcom: msm_bus: add mutex lock for cllist data
  usb: bam: Remove inactivity_timer sysfs attribute
  msm: vidc: Fix use-after-free memory failure
  clk: qcom: clk-cpu-osm: Add support for trustzone enablement of OSM
  power: qpnp-fg-gen3: Use msoc for recharge-soc comparison
  power: smb-lib: enable DPDM regulator at CC attach
  power: smb-lib: Update the FLOAT detection logic
  power: smb-lib: Move to SW based step-charging
  power: qcom-step-chg: Add a new file for step-charging
  power: smb-lib: Restart charging from soft JEITA
  drivers: cpuidle: lpm-levels: Update ordering for broadcast timer
  msm: kgsl: Bypass GMU write/read buffers
  power: smb-lib: Improve the OTG enable workaround for PM660
  smb-lib: fix usbin_icl_change interrupt storm
  power: smb138x-charger: set buck freq to 700kHz in slave mode
  ASoC: wcd-dsp-mgr: fix race during subsystem restart
  ARM: dts: msm: add QUAT TDM pinctrl configurations on SDM845
  msm: vidc: Video system cache resource management update
  msm: ipa: add new API for ipa bridge (formerly ODU bridge)
  Kconfig: enable default config for audio.
  msm: ADSPRPC: Queue receive intent for adsprpc glink channel
  msm: vidc: Allocate bus vote data memory correctly
  ARM: dts: msm: remove SDR104 workaround from SDM845 v2
  soc: qcom: sleepstate: Enable/Disable IPCRTR wakelocks
  ARM: dts: msm: Reduce CNOC bus voting for USB slave on SDM845
  sched: Scheduler pl enhancement
  spi: spi-geni-qcom: Set oversampling based on core revision
  msm: ipa3: add a lock for active client logging
  ARM: dts: msm: change VDD_APC1 CPR regulator compatible string for sdm845
  clk: qcom: clk-rcg2: Allow DFS clients to scale the RCG while its enabled
  ARM: dts: msm: Enable SMMU stage 1 bypass mode with USB on SDM845
  power: pmic-voter: use force_val in rerun election
  leds: qpnp-flash-v2: Calculate the IRES current dynamically
  ASoC: codecs: Update Depends on macro for HDMI codec
  ASoC: msm: Use CONFIG_SND_SOC_660 to compile machine driver
  msm: kgsl: Dump the A6XX VBIF debugbus correctly
  sched: walt: Add CFS_BANDWIDTH support
  cfg80211: Add macros to indicate backport support for FILS
  cfg80211: Add support for FILS shared key authentication offload
  cfg80211: Use a structure to pass connect response params
  wireless: define cipher/AKM suites using a macro
  cfg80211: Fix documentation for connect result
  msm: wlan: Define CFG80211_CONNECT_TIMEOUT_REASON_CODE
  cfg80211: Specify the reason for connect timeout
  SoC: msm: audio-effects: return directly to avoid integer overflow
  msm: vidc: Add HFI interfaces for TME support
  msm: ADSPRPC: Null check for file session context
  ARM: dts: msm: Add support for CDSP PIL on sdm670
  ARM: dts: msm: Add support for Venus PIL on sdm670
  ARM: dts: msm: Add priority to QMP device tree on sdm670
  ARM: dts: msm: add spss_utils to sdm845 v2
  coresight-ost: switch to no log api for STM device writes
  msm: vidc: Skip cache invalidating extradata buffer
  sched: walt: move the cumulative window demand updates to enqueue
  sched: walt: fix cumulative window demand update bugs
  sched: walt: refactor the walt stats update code
  sched: remove "hmp" references in the code
  defconfig: Enable sysmon communication for SDM845
  dtc: add integer overflow checks in fdt header
  drm/msm/sde: modify pitch verification condition for linear format
  drivers: mailbox: qti-tcs: increase debug verbosity
  msm: kgsl: Don't signal the timeline if its refcount is zero
  ASoC: msm: Add support for sdm670 soundcard
  msm: kgsl: Prevent a deadlock when removing debugfs nodes
  diag: Flush control workqueue immediately on channel close
  ARM: dts: msm: Remove WLED short circuit properties for PM660
  drm/msm/dp: add input validation for bpc function
  drm/msm/hdcp1x: add support for HDCP 1.x
  drm/msm/dp: add a separate header for register definitions
  drm/msm/dp: add support for HDCP 2.2
  coresight-tmc: add support to configure flush and reset CTIs
  coresight: add support to read cti data
  Linux 4.9.40
  alarmtimer: don't rate limit one-shot timers
  tracing: Fix kmemleak in instance_rmdir
  PM / Domains: defer dev_pm_domain_set() until genpd->attach_dev succeeds if present
  reiserfs: Don't clear SGID when inheriting ACLs
  spmi: Include OF based modalias in device uevent
  of: device: Export of_device_{get_modalias, uvent_modalias} to modules
  acpi/nfit: Fix memory corruption/Unregister mce decoder on failure
  ovl: fix random return value on mount
  hfsplus: Don't clear SGID when inheriting ACLs
  mlx5: Avoid that mlx5_ib_sg_to_klms() overflows the klms[] array
  drm/mst: Avoid processing partially received up/down message transactions
  drm/mst: Avoid dereferencing a NULL mstb in drm_dp_mst_handle_up_req()
  drm/mst: Fix error handling during MST sideband message reception
  RDMA/core: Initialize port_num in qp_attr
  ceph: fix race in concurrent readdir
  staging: lustre: ko2iblnd: check copy_from_iter/copy_to_iter return code
  staging: sm750fb: avoid conflicting vesafb
  staging: comedi: ni_mio_common: fix AO timer off-by-one regression
  staging: rtl8188eu: add TL-WN722N v2 support
  Revert "perf/core: Drop kernel samples even though :u is specified"
  perf annotate: Fix broken arrow at row 0 connecting jmp instruction to its target
  iser-target: Avoid isert_conn->cm_id dereference in isert_login_recv_done
  target: Fix COMPARE_AND_WRITE caw_sem leak during se_cmd quiesce
  udf: Fix deadlock between writeback and udf_setsize()
  NFS: only invalidate dentrys that are clearly invalid.
  sunrpc: use constant time memory comparison for mac
  IB/core: Namespace is mandatory input for address resolution
  IB/iser: Fix connection teardown race condition
  Input: i8042 - fix crash at boot time
  MIPS: Fix a typo: s/preset/present/ in r2-to-r6 emulation error message
  MIPS: Send SIGILL for R6 branches in `__compute_return_epc_for_insn'
  MIPS: Send SIGILL for linked branches in `__compute_return_epc_for_insn'
  MIPS: Rename `sigill_r6' to `sigill_r2r6' in `__compute_return_epc_for_insn'
  MIPS: Send SIGILL for BPOSGE32 in `__compute_return_epc_for_insn'
  MIPS: math-emu: Prevent wrong ISA mode instruction emulation
  MIPS: Fix unaligned PC interpretation in `compute_return_epc'
  MIPS: Actually decode JALX in `__compute_return_epc_for_insn'
  MIPS: Save static registers before sysmips
  MIPS: Fix MIPS I ISA /proc/cpuinfo reporting
  x86/ioapic: Pass the correct data to unmask_ioapic_irq()
  x86/acpi: Prevent out of bound access caused by broken ACPI tables
  Revert "ACPI / EC: Enable event freeze mode..." to fix a regression
  ACPI / EC: Drop EC noirq hooks to fix a regression
  ubifs: Don't leak kernel memory to the MTD
  MIPS: Negate error syscall return in trace
  MIPS: Fix mips_atomic_set() with EVA
  MIPS: Fix mips_atomic_set() retry condition
  ftrace: Fix uninitialized variable in match_records()
  nvme-rdma: remove race conditions from IB signalling
  vfio: New external user group/file match
  vfio: Fix group release deadlock
  ovl: drop CAP_SYS_RESOURCE from saved mounter's credentials
  drm/ttm: Fix use-after-free in ttm_bo_clean_mm
  f2fs: Don't clear SGID when inheriting ACLs
  f2fs: sanity check size of nat and sit cache
  xfs: Don't clear SGID when inheriting ACLs
  ipmi:ssif: Add missing unlock in error branch
  ipmi: use rcu lock around call to intf->handlers->sender()
  drm/radeon: Fix eDP for single-display iMac10,1 (v2)
  drm/radeon/ci: disable mclk switching for high refresh rates (v2)
  drm/amd/amdgpu: Return error if initiating read out of range on vram
  s390/syscalls: Fix out of bounds arguments access
  Raid5 should update rdev->sectors after reshape
  ext2: Don't clear SGID when inheriting ACLs
  libnvdimm: fix badblock range handling of ARS range
  libnvdimm, btt: fix btt_rw_page not returning errors
  cx88: Fix regression in initial video standard setting
  x86/xen: allow userspace access during hypercalls
  md: don't use flush_signals in userspace processes
  usb: renesas_usbhs: gadget: disable all eps when the driver stops
  usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
  USB: cdc-acm: add device-id for quirky printer
  usb: storage: return on error to avoid a null pointer dereference
  mxl111sf: Fix driver to use heap allocate buffers for USB messages
  xhci: Bad Ethernet performance plugged in ASM1042A host
  xhci: Fix NULL pointer dereference when cleaning up streams for removed host
  xhci: fix 20000ms port resume timeout
  ipvs: SNAT packet replies only for NATed connections
  PCI/PM: Restore the status of PCI devices across hibernation
  PCI: rockchip: Use normal register bank for config accessors
  PCI: Work around poweroff & suspend-to-RAM issue on Macbook Pro 11
  af_key: Fix sadb_x_ipsecrequest parsing
  powerpc/mm/radix: Properly clear process table entry
  powerpc/asm: Mark cr0 as clobbered in mftb()
  powerpc: Fix emulation of mfocrf in emulate_step()
  powerpc: Fix emulation of mcrf in emulate_step()
  powerpc/64: Fix atomic64_inc_not_zero() to return an int
  powerpc/pseries: Fix passing of pp0 in updatepp() and updateboltedpp()
  xen/scsiback: Fix a TMR related use-after-free
  iscsi-target: Add login_keys_workaround attribute for non RFC initiators
  scsi: Add STARGET_CREATED_REMOVE state to scsi_target_state
  scsi: ses: do not add a device to an enclosure if enclosure_add_links() fails.
  PM / Domains: Fix unsafe iteration over modified list of domains
  PM / Domains: Fix unsafe iteration over modified list of domain providers
  PM / Domains: Fix unsafe iteration over modified list of device links
  ASoC: compress: Derive substream from stream based on direction
  igb: Explicitly select page 0 at initialization
  btrfs: Don't clear SGID when inheriting ACLs
  wlcore: fix 64K page support
  Bluetooth: use constant time memory comparison for secret values
  perf intel-pt: Clear FUP flag on error
  perf intel-pt: Use FUP always when scanning for an IP
  perf intel-pt: Ensure never to set 'last_ip' when packet 'count' is zero
  perf intel-pt: Fix last_ip usage
  perf intel-pt: Ensure IP is zero when state is INTEL_PT_STATE_NO_IP
  perf intel-pt: Fix missing stack clear
  perf intel-pt: Improve sample timestamp
  perf intel-pt: Move decoder error setting into one condition
  NFC: Add sockaddr length checks before accessing sa_family in bind handlers
  nfc: Fix the sockaddr length sanitization in llcp_sock_connect
  nfc: Ensure presence of required attributes in the activate_target handler
  NFC: nfcmrvl: fix firmware-management initialisation
  NFC: nfcmrvl: use nfc-device for firmware download
  NFC: nfcmrvl: do not use device-managed resources
  NFC: nfcmrvl_uart: add missing tty-device sanity check
  NFC: fix broken device allocation
  ath9k: fix an invalid pointer dereference in ath9k_rng_stop()
  ath9k: fix tx99 bus error
  ath9k: fix tx99 use after free
  thermal: cpu_cooling: Avoid accessing potentially freed structures
  thermal: max77620: fix device-node reference imbalance
  s5p-jpeg: don't return a random width/height
  dm mpath: cleanup -Wbool-operation warning in choose_pgpath()
  ir-core: fix gcc-7 warning on bool arithmetic
  disable new gcc-7.1.1 warnings for now
  drm/msm/sde: handle retire fence during late ctl_start_irq
  ARM: dts: msm: Add crypto smr-masks for sdm845
  qce50: Add support for IOMMU S1 translation
  usb: core: Honor device preferred configuration
  ARM: RTIC 3.0:  Enabling MPGen
  Use %zu to print resid (size_t).
  ARM: dts: msm: Reflect updates to the GCC clock frequency plan for SDM845
  ASoC: msm: qdsp6v2: Open unique COPP port for concurrent ULL streams
  mmc: sdhci-msm: consider clock frequency above 200MHz during DLL config
  clk: qcom: gcc-sdm845: Reflect updates to the GCC clock frequency plan
  usb: dwc3-msm: Ensure separate EUD extcon dev is used
  drivers: mailbox: qti-tcs: add IPC logging support
  msm: vidc: Update extradata plane size during valid extradata index
  ARM: dts: msm: Add TSPP smr-masks for sdm845
  media: broadcast: tspp: Add support for IOMMU S1 translation
  diag: Free the read workqueue structure to avoid memory leak
  ASoC: sdm845: add mixer control for MultiMedia5_RX QOS Vote
  mm: add preempt points into __purge_vmap_area_lazy()
  mm: mark all calls into the vmalloc subsystem as potentially sleeping
  mm: add vfree_atomic()
  mm: turn vmap_purge_lock into a mutex
  mm: refactor __purge_vmap_area_lazy()
  mm: remove free_unmap_vmap_area_addr()
  mm: remove free_unmap_vmap_area_noflush()
  defconfig: sdm670: Enable debugfs client for QMP
  ARM: dts: msm: Add QMP debugfs client for sdm670
  sched: remove the unused HMP specific code
  sched: don't use preprocessor directives inside a macro
  fuse: Add support for shortcircuited read/write for files
  drm/msm: fix typo when enabling rsc debug bus
  ARM: dts: msm: add device node for MSM HDCP driver on SDM845
  drivers/misc: add HDCP 2.2 driver
  drm/msm/sde: fix typo in sde QoS settings calculation
  msm: ion: Fix crash when CP flags are none
  drm/msm/sde: disable fast clear bit for ubwc with no alpha
  icnss: Consolidate logging message
  msm: msm_bus: limit max chars read by sscanf
  icnss: Set crash state for PDR
  usb: pd: start USB host mode with DR_SWAP when current_dr is UFP
  diag: Add proper checks to fix possible out-of-bound issue
  diag: Add protection while processing non-hdlc packets
  diag: Fix to check for command length size
  ANDROID: keychord: Fix a slab out-of-bounds read.
  seemp: adjust hypervisor rooting report format
  drm/msm: reduce sde evt32 logs to trace more commits
  clk: qcom: gcc-sdm845: Keep the gcc_aggre_noc_pcie_tbu_clk enabled
  ARM: dts: msm: update panel jitter for command mode panels
  drm/msm/sde: update autorefresh enable/disable support
  power: qpnp-fg-gen3: add DMA support for accessing FG SRAM
  clk: qcom: clk-regmap: Add additional check for devm_clk_register_regmap
  clk: Add additional checking
  msm: vidc: Add support for decoder STOP command
  pinctrl: qcom: Update irq handle for GPIO pins
  mm: process reclaim: skip locked vmas
  mm: avoid taking zone lock in pagetypeinfo_showmixed()
  techpack: add tech package support
  ASoC: sdm660: Initialize codec_reg_done to false
  Asoc: sdm660: Move mbhc_hs_detect to late_probe
  scsi: ufs: Serialise ufs clock gating and ungating
  scsi: ufs: fix unclocked register access during UFS card detection
  msm: ipa4: add HAL support for statistics
  msm: ipa4: make rule_id unique across tables
  ASoC: audio: add APIs to query for AVS version
  security: mark LSM hooks as __ro_after_init
  security: introduce CONFIG_SECURITY_WRITABLE_HOOKS
  msm: vidc: Update input extradata min host buffer count
  clk: qcom: clk-cpu-osm: Move the speedbin logic to after resource init
  arm64: defconfig: enable USB_LINK_LAYER_TEST on sdm845
  thermal: tsens: Update of_thermal registration
  usb: core: Add support to handle multi config audio device
  usb: core: Add support to parse config summary capability descriptors
  ARM: dts: msm: Update glink and smp2p device nodes for ADSP of SDM670
  cfg80211: Define macro for report better BSS in sched scan
  cfg80211: Add support to sched scan to report better BSSs
  cfg80211: Define macro to indicate support for Random TA for PA frames
  cfg80211: Add support for randomizing TA of Public Action frames
  cfg80211: size various nl80211 messages correctly
  cfg80211: Define macro to indicate support for update connect params
  cfg80211: Add support to update connection parameters
  cfg80211: configure multicast to unicast for AP interfaces
  cfg80211: Add KEK/nonces for FILS association frames
  cfg80211: Add Fast Initial Link Setup (FILS) auth algs
  cfg80211: Add feature flag for Fast Initial Link Setup (FILS) as STA
  cfg80211: Rename SAE_DATA to more generic AUTH_DATA
  cfg80211: validate beacon int as part of iface combinations
  cfg80211: fix beacon interval in interface combination iteration
  cfg80211: fix possible memory leak in cfg80211_iter_combinations()
  net: core: neighbour: Change the print format for addresses
  qcom: scm: remove printing input arguments
  ARM: dts: msm: Avoid preparing L3 clock from devfreq for SDM845
  drivers: qcom: rpmh: Cache write_passthru sleep/wake requests
  drivers: mailbox: qti-tcs: various minor fixes
  drm/msm: remove extra 1.6 GBps added to the ab vote
  UPSTREAM: af_key: Fix sadb_x_ipsecrequest parsing
  usb: pd: force disconnect upon unexpected SRC->SNK transition
  ANDROID: lowmemorykiller: Add tgid to kill message
  mmc: sdhci-mmc-ice: Factor out ice_cfg_start from sdhci_msm_ice_cfg
  arm: dma-mapping: add dma mapper for io-pgtable-fast for 32 bit
  arm: dma_mapping: Support for DOMAIN_ATTR_S1_BYPASS attribute
  msm: kgsl: Remove context debugfs nodes when detaching it
  ASoC: msm: add support for MI2S slave mode on SDM845
  drm/msm: add validation for secure transition
  regulator: cpr3-regulator: stop CPRh controller registration if initialized
  Revert "ANDROID: proc: smaps: Allow smaps access for CAP_SYS_RESOURCE"
  drm/msm/sde: unmap buffers when context is detached
  soc: qom: add support to export socinfo id string
  ASoC: msm: qdsp6v2: Initialize variables before use
  4.9.39
  kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS
  kvm: vmx: Check value written to IA32_BNDCFGS
  kvm: x86: Guest BNDCFGS requires guest MPX support
  kvm: vmx: Do not disable intercepts for BNDCFGS
  tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results
  PM / QoS: return -EINVAL for bogus strings
  PM / wakeirq: Convert to SRCU
  sched/topology: Fix overlapping sched_group_mask
  sched/topology: Optimize build_group_mask()
  sched/topology: Fix building of overlapping sched-groups
  sched/fair, cpumask: Export for_each_cpu_wrap()
  Revert "sched/core: Optimize SCHED_SMT"
  crypto: caam - fix signals handling
  crypto: caam - properly set IV after {en,de}crypt
  crypto: sha1-ssse3 - Disable avx2
  crypto: atmel - only treat EBUSY as transient if backlog
  crypto: talitos - Extend max key length for SHA384/512-HMAC and AEAD
  mm: fix overflow check in expand_upwards()
  selftests/capabilities: Fix the test_execve test
  mnt: Make propagate_umount less slow for overlapping mount propagation trees
  mnt: In propgate_umount handle visiting mounts in any order
  mnt: In umount propagation reparent in a separate pass
  nvmem: core: fix leaks on registration errors
  rcu: Add memory barriers for NOCB leader wakeup
  vt: fix unchecked __put_user() in tioclinux ioctls
  ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers
  exec: Limit arg stack to at most 75% of _STK_LIM
  s390: reduce ELF_ET_DYN_BASE
  powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB
  arm64: move ELF_ET_DYN_BASE to 4GB / 4MB
  arm: move ELF_ET_DYN_BASE to 4MB
  binfmt_elf: use ELF_ET_DYN_BASE only for PIE
  checkpatch: silence perl 5.26.0 unescaped left brace warnings
  fs/dcache.c: fix spin lockup issue on nlru->lock
  mm/list_lru.c: fix list_lru_count_node() to be race free
  kernel/extable.c: mark core_kernel_text notrace
  thp, mm: fix crash due race in MADV_FREE handling
  tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth
  parisc/mm: Ensure IRQs are off in switch_mm()
  parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs
  parisc: use compat_sys_keyctl()
  parisc: Report SIGSEGV instead of SIGBUS when running out of stack
  irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity
  cfg80211: Check if NAN service ID is of expected size
  cfg80211: Check if PMKID attribute is of expected size
  cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES
  cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE
  sfc: don't read beyond unicast address list
  brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain
  brcmfmac: Fix a memory leak in error handling path in 'brcmf_cfg80211_attach'
  brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx()
  rds: tcp: use sock_create_lite() to create the accept socket
  vrf: fix bug_on triggered by rx when destroying a vrf
  net: ipv6: Compare lwstate in detecting duplicate nexthops
  net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64
  vxlan: fix hlist corruption
  ipv6: dad: don't remove dynamic addresses if link is down
  net/mlx5e: Fix TX carrier errors report in get stats ndo
  liquidio: fix bug in soft reset failure detection
  net/mlx5: Cancel delayed recovery work when unloading the driver
  net: handle NAPI_GRO_FREE_STOLEN_HEAD case also in napi_frags_finish()
  bpf: prevent leaking pointer via xadd on unpriviledged
  rocker: move dereference before free
  bridge: mdb: fix leak on complete_info ptr on fail path
  net: prevent sign extension in dev_get_stats()
  tcp: reset sk_rx_dst in tcp_disconnect()
  net: dp83640: Avoid NULL pointer dereference.
  ipv6: avoid unregistering inet6_dev for loopback
  net/phy: micrel: configure intterupts after autoneg workaround
  net: sched: Fix one possible panic when no destroy callback
  net_sched: fix error recovery at qdisc creation
  xen-netfront: Rework the fix for Rx stall during OOM and network stress
  defconfig: arm64: Enable debugfs client for QMP
  ANDROID: android-verity: mark dev as rw for linear target
  usb: pd: Add functionality to allow DP client to request DP mode
  ANDROID: sdcardfs: Remove unnecessary lock
  media: dvb-core: dmxdev: Add braces around suspicious indent
  msm: sde: fix unaligned access problem
  msm: sde: fix to handle invalid format in sde rotator
  msm: sde: Remove output fence object after user request completed
  ANDROID: binder: don't check prio permissions on restore.
  ARM: dts: msm: Add display RSC device bindings for sdm670
  msm: kgsl: Trigger preemption from command complete interrupt
  drm/msm/sde: Update log for getting default dither config
  drm/msm: move msm property dirty list to atomic state
  msm:ipa: using rate limit api for ioctl calls
  Add BINDER_GET_NODE_DEBUG_INFO ioctl
  ANDROID: binder: add RT inheritance flag to node.
  ANDROID: binder: improve priority inheritance.
  ANDROID: binder: add min sched_policy to node.
  ANDROID: binder: add support for RT prio inheritance.
  ANDROID: binder: push new transactions to waiting threads.
  ANDROID: binder: remove proc waitqueue
  drivers: edac: Add PM notifier to check ECC during CPU_EXIT_PM
  drm/msm: fix Y420CMDB EDID block parsing
  clk: qcom: mdss: Fix DSI clock divider configuration
  drm/msm/dsi-staging: enable frame MISR on DSI
  drivers: thermal: Add trace events for thermal device update events
  drm/msm/sde: add support to attach/detach context banks
  ARM: dts: msm: add physical dimensions for panels on SDM845
  soc: qcom: glink: Remove magic number logic
  soc: qcom: glink: Add new APIs to toggle RX thread priority
  soc: qcom: glink: Move get reference to valid location
  ARM: dts: msm: Enable GPU DCVS on SDM845
  ASoC: wcd: remove unused audio external clock driver
  msm: kgsl: Make sure regulators are ON before GPU clocks are forced on
  msm: kgsl: Defer issue commands to worker thread
  msm: kgsl: convert some workqueues to use kthreads.
  msm: kgsl: Reset busy data after soft reset
  msm: kgsl: Do not set rate before turning off GMU clock
  msm: kgsl: Fix the mmu pagefault tracepoint
  msm: kgsl: Remove the A6XX ISDB regwrite
  genirq: Use irq_set_affinity_locked to change irq affinity
  msm: kgsl: Ignore stale size when allocating pages

Change-Id: Ib02736f2dc5315b82f9620188bf428dbb006ab3a
Signed-off-by: Abhijit Trivedi <abhijitt@codeaurora.org>
diff --git a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c
index 5f6895c..29de315 100644
--- a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c
+++ b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c
@@ -785,18 +785,6 @@
 	time_left = wait_for_completion_timeout(&cdm_core->reset_complete,
 		msecs_to_jiffies(CAM_CDM_HW_RESET_TIMEOUT));
 
-	/*
-	 * Check for HW error and recover as a workaround
-	 * Sometimes CDM HW triggers irq with invalid status for
-	 * HW reset command, so ignore reset failure and proceed further
-	 * as a workaround.
-	 */
-	if (time_left <= 0) {
-		CAM_ERR(CAM_CDM, "CDM HW reset Wait failed time_left=%ld",
-			time_left);
-		time_left = 1;
-	}
-
 	if (time_left <= 0) {
 		CAM_ERR(CAM_CDM, "CDM HW reset Wait failed rc=%d", rc);
 		goto disable_return;
@@ -869,6 +857,8 @@
 
 	cdm_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
 	cdm_hw->soc_info.pdev = pdev;
+	cdm_hw->soc_info.dev = &pdev->dev;
+	cdm_hw->soc_info.dev_name = pdev->name;
 	cdm_hw_intf->hw_type = CAM_HW_CDM;
 	cdm_hw->open_count = 0;
 	mutex_init(&cdm_hw->hw_mutex);
diff --git a/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c b/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c
index 82035e9..6bf81af 100644
--- a/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c
+++ b/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c
@@ -1338,6 +1338,8 @@
 
 	cpas_hw->hw_state = CAM_HW_STATE_POWER_DOWN;
 	cpas_hw->soc_info.pdev = pdev;
+	cpas_hw->soc_info.dev = &pdev->dev;
+	cpas_hw->soc_info.dev_name = pdev->name;
 	cpas_hw->open_count = 0;
 	mutex_init(&cpas_hw->hw_mutex);
 	spin_lock_init(&cpas_hw->hw_lock);
diff --git a/drivers/media/platform/msm/camera/cam_icp/hfi.c b/drivers/media/platform/msm/camera/cam_icp/hfi.c
index 68ce696f..a315268 100644
--- a/drivers/media/platform/msm/camera/cam_icp/hfi.c
+++ b/drivers/media/platform/msm/camera/cam_icp/hfi.c
@@ -18,6 +18,7 @@
 #include <linux/timer.h>
 #include <media/cam_icp.h>
 #include <linux/iopoll.h>
+#include <soc/qcom/socinfo.h>
 
 #include "cam_io_util.h"
 #include "hfi_reg.h"
@@ -38,6 +39,9 @@
 #define HFI_VERSION_INFO_STEP_BMSK   0xFF
 #define HFI_VERSION_INFO_STEP_SHFT  0
 
+#define SOC_VERSION_HW1             0x10000
+#define SOC_VERSION_HW2             0x20000
+
 static struct hfi_info *g_hfi;
 unsigned int g_icp_mmu_hdl;
 static DEFINE_MUTEX(hfi_cmd_q_mutex);
@@ -350,7 +354,7 @@
 	struct hfi_qtbl *qtbl;
 	struct hfi_qtbl_hdr *qtbl_hdr;
 	struct hfi_q_hdr *cmd_q_hdr, *msg_q_hdr, *dbg_q_hdr;
-	uint32_t hw_version, fw_version, status = 0;
+	uint32_t hw_version, soc_version, fw_version, status = 0;
 
 	mutex_lock(&hfi_cmd_q_mutex);
 	mutex_lock(&hfi_msg_q_mutex);
@@ -370,7 +374,7 @@
 
 	memcpy(&g_hfi->map, hfi_mem, sizeof(g_hfi->map));
 	g_hfi->hfi_state = HFI_DEINIT;
-
+	soc_version = socinfo_get_version();
 	if (debug) {
 		cam_io_w_mb(
 		(uint32_t)(ICP_FLAG_CSR_A5_EN | ICP_FLAG_CSR_WAKE_UP_EN |
@@ -382,7 +386,9 @@
 		icp_base + HFI_REG_A5_CSR_A5_CONTROL);
 	} else {
 		cam_io_w((uint32_t)ICP_FLAG_CSR_A5_EN |
-			ICP_FLAG_CSR_WAKE_UP_EN | ICP_CSR_EN_CLKGATE_WFI,
+			ICP_FLAG_CSR_WAKE_UP_EN |
+			((soc_version == SOC_VERSION_HW1) ?
+			(ICP_CSR_EN_CLKGATE_WFI) : (0x0)),
 			icp_base + HFI_REG_A5_CSR_A5_CONTROL);
 	}
 
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/a5_hw/a5_dev.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/a5_hw/a5_dev.c
index daffae8..99e2e79 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/a5_hw/a5_dev.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/a5_hw/a5_dev.c
@@ -96,6 +96,8 @@
 	}
 
 	a5_dev->soc_info.pdev = pdev;
+	a5_dev->soc_info.dev = &pdev->dev;
+	a5_dev->soc_info.dev_name = pdev->name;
 	a5_dev_intf->hw_priv = a5_dev;
 	a5_dev_intf->hw_ops.init = cam_a5_init_hw;
 	a5_dev_intf->hw_ops.deinit = cam_a5_deinit_hw;
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/bps_hw/bps_dev.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/bps_hw/bps_dev.c
index 419bb52..0e36ec0 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/bps_hw/bps_dev.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/bps_hw/bps_dev.c
@@ -78,6 +78,8 @@
 		return -ENOMEM;
 	}
 	bps_dev->soc_info.pdev = pdev;
+	bps_dev->soc_info.dev = &pdev->dev;
+	bps_dev->soc_info.dev_name = pdev->name;
 	bps_dev_intf->hw_priv = bps_dev;
 	bps_dev_intf->hw_ops.init = cam_bps_init_hw;
 	bps_dev_intf->hw_ops.deinit = cam_bps_deinit_hw;
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
index f878403..5055e8d 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
@@ -652,9 +652,7 @@
 		return -ENOMEM;
 
 	abort_cmd.size =
-		sizeof(struct hfi_cmd_ipebps_async) +
-		sizeof(struct hfi_cmd_abort_destroy) -
-		sizeof(abort_cmd.payload.direct);
+		sizeof(struct hfi_cmd_ipebps_async);
 	abort_cmd.pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
 	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
 		abort_cmd.opcode = HFI_IPEBPS_CMD_OPCODE_BPS_ABORT;
@@ -706,9 +704,7 @@
 		return -ENOMEM;
 
 	destroy_cmd.size =
-		sizeof(struct hfi_cmd_ipebps_async) +
-		sizeof(struct ipe_bps_destroy) -
-		sizeof(destroy_cmd.payload.direct);
+		sizeof(struct hfi_cmd_ipebps_async);
 	destroy_cmd.pkt_type = HFI_CMD_IPEBPS_ASYNC_COMMAND_DIRECT;
 	if (ctx_data->icp_dev_acquire_info->dev_type == CAM_ICP_RES_TYPE_BPS)
 		destroy_cmd.opcode = HFI_IPEBPS_CMD_OPCODE_BPS_DESTROY;
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/ipe_hw/ipe_dev.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/ipe_hw/ipe_dev.c
index d13363e..cbd9d84 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/ipe_hw/ipe_dev.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/ipe_hw/ipe_dev.c
@@ -86,6 +86,8 @@
 		return -ENOMEM;
 	}
 	ipe_dev->soc_info.pdev = pdev;
+	ipe_dev->soc_info.dev = &pdev->dev;
+	ipe_dev->soc_info.dev_name = pdev->name;
 	ipe_dev_intf->hw_priv = ipe_dev;
 	ipe_dev_intf->hw_ops.init = cam_ipe_init_hw;
 	ipe_dev_intf->hw_ops.deinit = cam_ipe_deinit_hw;
diff --git a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
index a6f60f5..6470063 100644
--- a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
+++ b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
@@ -219,7 +219,8 @@
 static int __cam_isp_ctx_notify_sof_in_actived_state(
 	struct cam_isp_context *ctx_isp, void *evt_data)
 {
-	struct cam_req_mgr_sof_notify  notify;
+	int rc = 0;
+	struct cam_req_mgr_trigger_notify  notify;
 	struct cam_context *ctx = ctx_isp->base;
 	struct cam_ctx_request  *req;
 	uint64_t  request_id  = 0;
@@ -231,15 +232,18 @@
 	 * In this case, we need to skip the current notification. This
 	 * helps the state machine to catch up the delay.
 	 */
-	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_sof &&
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger &&
 		ctx_isp->active_req_cnt <= 2) {
-		notify.link_hdl = ctx->link_hdl;
-		notify.dev_hdl = ctx->dev_hdl;
-		notify.frame_id = ctx_isp->frame_id;
+		if (ctx_isp->subscribe_event & CAM_TRIGGER_POINT_SOF) {
+			notify.link_hdl = ctx->link_hdl;
+			notify.dev_hdl = ctx->dev_hdl;
+			notify.frame_id = ctx_isp->frame_id;
+			notify.trigger = CAM_TRIGGER_POINT_SOF;
 
-		ctx->ctx_crm_intf->notify_sof(&notify);
-		CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
-			ctx_isp->frame_id);
+			ctx->ctx_crm_intf->notify_trigger(&notify);
+			CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
+				ctx_isp->frame_id);
+		}
 
 		list_for_each_entry(req, &ctx->active_req_list, list) {
 			if (req->request_id > ctx_isp->reported_req_id) {
@@ -253,11 +257,39 @@
 			CAM_REQ_MGR_SOF_EVENT_SUCCESS);
 	} else {
 		CAM_ERR(CAM_ISP, "Can not notify SOF to CRM");
+		rc = -EFAULT;
 	}
 
 	return 0;
 }
 
+static int __cam_isp_ctx_notify_eof_in_actived_state(
+	struct cam_isp_context *ctx_isp, void *evt_data)
+{
+	int rc = 0;
+	struct cam_req_mgr_trigger_notify  notify;
+	struct cam_context *ctx = ctx_isp->base;
+
+	if (!(ctx_isp->subscribe_event & CAM_TRIGGER_POINT_EOF))
+		return rc;
+
+	/* notify reqmgr with eof signal */
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger) {
+		notify.link_hdl = ctx->link_hdl;
+		notify.dev_hdl = ctx->dev_hdl;
+		notify.frame_id = ctx_isp->frame_id;
+		notify.trigger = CAM_TRIGGER_POINT_EOF;
+
+		ctx->ctx_crm_intf->notify_trigger(&notify);
+		CAM_DBG(CAM_ISP, "Notify CRM EOF frame %lld\n",
+			ctx_isp->frame_id);
+	} else {
+		CAM_ERR(CAM_ISP, "Can not notify EOF to CRM");
+		rc = -EFAULT;
+	}
+
+	return rc;
+}
 
 static int __cam_isp_ctx_sof_in_activated_state(
 	struct cam_isp_context *ctx_isp, void *evt_data)
@@ -581,7 +613,7 @@
 			__cam_isp_ctx_sof_in_activated_state,
 			__cam_isp_ctx_reg_upd_in_sof,
 			__cam_isp_ctx_notify_sof_in_actived_state,
-			NULL,
+			__cam_isp_ctx_notify_eof_in_actived_state,
 			NULL,
 		},
 	},
@@ -592,7 +624,7 @@
 			__cam_isp_ctx_sof_in_activated_state,
 			__cam_isp_ctx_reg_upd_in_activated_state,
 			__cam_isp_ctx_epoch_in_applied,
-			NULL,
+			__cam_isp_ctx_notify_eof_in_actived_state,
 			__cam_isp_ctx_buf_done_in_applied,
 		},
 	},
@@ -603,7 +635,7 @@
 			__cam_isp_ctx_sof_in_epoch,
 			NULL,
 			__cam_isp_ctx_notify_sof_in_actived_state,
-			NULL,
+			__cam_isp_ctx_notify_eof_in_actived_state,
 			__cam_isp_ctx_buf_done_in_epoch,
 		},
 	},
@@ -614,7 +646,7 @@
 			__cam_isp_ctx_sof_in_activated_state,
 			NULL,
 			__cam_isp_ctx_notify_sof_in_actived_state,
-			NULL,
+			__cam_isp_ctx_notify_eof_in_actived_state,
 			__cam_isp_ctx_buf_done_in_bubble,
 		},
 	},
@@ -890,7 +922,7 @@
 {
 	int rc = 0;
 	struct cam_context                    *ctx = ctx_isp->base;
-	struct cam_req_mgr_sof_notify          notify;
+	struct cam_req_mgr_trigger_notify      notify;
 	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
 	uint64_t                               request_id  = 0;
 
@@ -911,13 +943,14 @@
 	 * In this case, we need to skip the current notification. This
 	 * helps the state machine to catch up the delay.
 	 */
-	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_sof &&
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger &&
 		ctx_isp->active_req_cnt <= 2) {
 		notify.link_hdl = ctx->link_hdl;
 		notify.dev_hdl = ctx->dev_hdl;
 		notify.frame_id = ctx_isp->frame_id;
+		notify.trigger = CAM_TRIGGER_POINT_SOF;
 
-		ctx->ctx_crm_intf->notify_sof(&notify);
+		ctx->ctx_crm_intf->notify_trigger(&notify);
 		CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
 			ctx_isp->frame_id);
 
@@ -1037,7 +1070,7 @@
 	uint32_t i;
 	struct cam_ctx_request                *req;
 	struct cam_context                    *ctx = ctx_isp->base;
-	struct cam_req_mgr_sof_notify          notify;
+	struct cam_req_mgr_trigger_notify      notify;
 	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
 	struct cam_isp_ctx_req                *req_isp;
 	uint64_t                               request_id  = 0;
@@ -1072,12 +1105,13 @@
 	}
 
 	/* notify reqmgr with sof signal */
-	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_sof) {
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger) {
 		notify.link_hdl = ctx->link_hdl;
 		notify.dev_hdl = ctx->dev_hdl;
 		notify.frame_id = ctx_isp->frame_id;
+		notify.trigger = CAM_TRIGGER_POINT_SOF;
 
-		ctx->ctx_crm_intf->notify_sof(&notify);
+		ctx->ctx_crm_intf->notify_trigger(&notify);
 		CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
 			ctx_isp->frame_id);
 
@@ -1106,11 +1140,11 @@
 	struct cam_ctx_request  *req;
 	struct cam_context      *ctx = ctx_isp->base;
 	struct cam_isp_ctx_req  *req_isp;
-	struct cam_req_mgr_sof_notify  notify;
+	struct cam_req_mgr_trigger_notify  notify;
 	uint64_t  request_id  = 0;
 
 	/* notify reqmgr with sof signal*/
-	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_sof) {
+	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger) {
 		if (list_empty(&ctx->pending_req_list)) {
 			CAM_ERR(CAM_ISP, "Reg upd ack with no pending request");
 			goto error;
@@ -1138,8 +1172,9 @@
 		notify.link_hdl = ctx->link_hdl;
 		notify.dev_hdl = ctx->dev_hdl;
 		notify.frame_id = ctx_isp->frame_id;
+		notify.trigger = CAM_TRIGGER_POINT_SOF;
 
-		ctx->ctx_crm_intf->notify_sof(&notify);
+		ctx->ctx_crm_intf->notify_trigger(&notify);
 		CAM_DBG(CAM_ISP, "Notify CRM  SOF frame %lld",
 			ctx_isp->frame_id);
 	} else {
@@ -1608,11 +1643,14 @@
 	struct cam_req_mgr_core_dev_link_setup *link)
 {
 	int rc = 0;
+	struct cam_isp_context *ctx_isp =
+		(struct cam_isp_context *) ctx->ctx_priv;
 
 	CAM_DBG(CAM_ISP, "Enter.........");
 
 	ctx->link_hdl = link->link_hdl;
 	ctx->ctx_crm_intf = link->crm_cb;
+	ctx_isp->subscribe_event = link->subscribe_event;
 
 	/* change state only if we had the init config */
 	if (!list_empty(&ctx->pending_req_list)) {
@@ -1645,6 +1683,7 @@
 	strlcpy(dev_info->name, CAM_ISP_DEV_NAME, sizeof(dev_info->name));
 	dev_info->dev_id = CAM_REQ_MGR_DEVICE_IFE;
 	dev_info->p_delay = 1;
+	dev_info->trigger = CAM_TRIGGER_POINT_SOF;
 
 	return rc;
 }
diff --git a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h
index b0b883c..621d652 100644
--- a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h
+++ b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h
@@ -109,6 +109,9 @@
  * @sof_timestamp_val:     Captured time stamp value at sof hw event
  * @active_req_cnt:        Counter for the active request
  * @reported_req_id:       Last reported request id
+ * @subscribe_event:       The irq event mask that CRM subscribes to, IFE will
+ *                         invoke CRM cb at those event.
+ *
  */
 struct cam_isp_context {
 	struct cam_context              *base;
@@ -125,6 +128,7 @@
 	uint64_t                         sof_timestamp_val;
 	int32_t                          active_req_cnt;
 	int64_t                          reported_req_id;
+	uint32_t                         subscribe_event;
 };
 
 /**
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
index 4893960..27b9f4a 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.c
@@ -1898,6 +1898,7 @@
 	struct cam_kmd_buf_info           kmd_buf;
 	uint32_t                          i;
 	bool                              fill_fence = true;
+	struct cam_isp_generic_blob_info  blob_info;
 
 	if (!hw_mgr_priv || !prepare_hw_update_args) {
 		CAM_ERR(CAM_ISP, "Invalid args");
@@ -1926,6 +1927,14 @@
 		return rc;
 	}
 
+	memset(&blob_info, 0x0, sizeof(struct cam_isp_generic_blob_info));
+	rc = cam_isp_process_generic_cmd_buffer(prepare, &blob_info);
+	if (rc) {
+		CAM_ERR(CAM_ISP, "Failed in generic blob cmd buffer, rc=%d",
+			rc);
+		goto end;
+	}
+
 	prepare->num_hw_update_entries = 0;
 	prepare->num_in_map_entries = 0;
 	prepare->num_out_map_entries = 0;
@@ -1936,25 +1945,51 @@
 		/* Add change base */
 		rc = cam_isp_add_change_base(prepare, &ctx->res_list_ife_src,
 			ctx->base[i].idx, &kmd_buf);
-		if (rc)
-			return rc;
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in change base i=%d, idx=%d, rc=%d",
+				i, ctx->base[i].idx, rc);
+			goto end;
+		}
+
 
 		/* get command buffers */
 		if (ctx->base[i].split_id != CAM_ISP_HW_SPLIT_MAX) {
 			rc = cam_isp_add_command_buffers(prepare,
 				ctx->base[i].split_id);
-			if (rc)
-				return rc;
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in add cmdbuf, i=%d, split_id=%d, rc=%d",
+					i, ctx->base[i].split_id, rc);
+				goto end;
+			}
+		}
+
+		if (blob_info.hfr_config) {
+			rc = cam_isp_add_hfr_config_hw_update(
+				blob_info.hfr_config, prepare,
+				ctx->base[i].idx, &kmd_buf,
+				ctx->res_list_ife_out, CAM_IFE_HW_OUT_RES_MAX);
+			if (rc) {
+				CAM_ERR(CAM_ISP,
+					"Failed in hfr config, i=%d, rc=%d",
+					i, rc);
+				goto end;
+			}
 		}
 
 		/* get IO buffers */
 		rc = cam_isp_add_io_buffers(hw_mgr->mgr_common.img_iommu_hdl,
-				prepare, ctx->base[i].idx,
+			prepare, ctx->base[i].idx,
 			&kmd_buf, ctx->res_list_ife_out,
 			CAM_IFE_HW_OUT_RES_MAX, fill_fence);
 
-		if (rc)
-			return rc;
+		if (rc) {
+			CAM_ERR(CAM_ISP,
+				"Failed in io buffers, i=%d, rc=%d",
+				i, rc);
+			goto end;
+		}
 
 		/* fence map table entries need to fill only once in the loop */
 		if (fill_fence)
@@ -1969,7 +2004,7 @@
 	 */
 	if (((prepare->packet->header.op_code + 1) & 0xF) ==
 					CAM_ISP_PACKET_INIT_DEV)
-		return rc;
+		goto end;
 
 	/* add reg update commands */
 	for (i = 0; i < ctx->num_base; i++) {
@@ -1977,15 +2012,17 @@
 		rc = cam_isp_add_change_base(prepare, &ctx->res_list_ife_src,
 			ctx->base[i].idx, &kmd_buf);
 		if (rc)
-			return rc;
+			goto end;
 
 		/*Add reg update */
 		rc = cam_isp_add_reg_update(prepare, &ctx->res_list_ife_src,
 			ctx->base[i].idx, &kmd_buf);
 		if (rc)
-			return rc;
+			goto end;
 	}
 
+end:
+	kfree(blob_info.hfr_config);
 	return rc;
 }
 
@@ -2444,34 +2481,51 @@
 	return 0;
 }
 
-static int cam_ife_hw_mgr_check_epoch_for_dual_vfe(
+static int cam_ife_hw_mgr_check_irq_for_dual_vfe(
 	struct cam_ife_hw_mgr_ctx   *ife_hw_mgr_ctx,
 	uint32_t                     core_idx0,
-	uint32_t                     core_idx1)
+	uint32_t                     core_idx1,
+	uint32_t                     hw_event_type)
 {
 	int32_t rc = -1;
-	uint32_t *epoch_cnt = ife_hw_mgr_ctx->epoch_cnt;
+	uint32_t *event_cnt = NULL;
 
-	if (epoch_cnt[core_idx0] ==
-			epoch_cnt[core_idx1]) {
+	switch (hw_event_type) {
+	case CAM_ISP_HW_EVENT_SOF:
+		event_cnt = ife_hw_mgr_ctx->sof_cnt;
+		break;
+	case CAM_ISP_HW_EVENT_REG_UPDATE:
+		event_cnt = ife_hw_mgr_ctx->epoch_cnt;
+		break;
+	case CAM_ISP_HW_EVENT_EOF:
+		event_cnt = ife_hw_mgr_ctx->eof_cnt;
+		break;
+	default:
+		return 0;
+	}
 
-		epoch_cnt[core_idx0] = 0;
-		epoch_cnt[core_idx1] = 0;
+	if (event_cnt[core_idx0] ==
+			event_cnt[core_idx1]) {
+
+		event_cnt[core_idx0] = 0;
+		event_cnt[core_idx1] = 0;
 
 		rc = 0;
 		return rc;
 	}
 
-	if ((epoch_cnt[core_idx0] - epoch_cnt[core_idx1] > 1) ||
-		(epoch_cnt[core_idx1] - epoch_cnt[core_idx0] > 1)) {
+	if ((event_cnt[core_idx0] - event_cnt[core_idx1] > 1) ||
+		(event_cnt[core_idx1] - event_cnt[core_idx0] > 1)) {
 
 		CAM_WARN(CAM_ISP,
-			"One of the VFE of dual VFE cound not generate error");
+			"One of the VFE cound not generate hw event %d",
+			hw_event_type);
 		rc = -1;
 		return rc;
 	}
 
-	CAM_DBG(CAM_ISP, "Only one core_index has given EPOCH");
+	CAM_DBG(CAM_ISP, "Only one core_index has given hw event %d",
+			hw_event_type);
 
 	return rc;
 }
@@ -2562,10 +2616,11 @@
 			core_index0 = hw_res_l->hw_intf->hw_idx;
 			core_index1 = hw_res_r->hw_intf->hw_idx;
 
-			rc = cam_ife_hw_mgr_check_epoch_for_dual_vfe(
+			rc = cam_ife_hw_mgr_check_irq_for_dual_vfe(
 					ife_hwr_mgr_ctx,
 					core_index0,
-					core_index1);
+					core_index1,
+					evt_payload->evt_id);
 
 			if (!rc)
 				ife_hwr_irq_epoch_cb(
@@ -2588,37 +2643,6 @@
 	return 0;
 }
 
-static int cam_ife_hw_mgr_check_sof_for_dual_vfe(
-	struct cam_ife_hw_mgr_ctx   *ife_hwr_mgr_ctx,
-	uint32_t                     core_idx0,
-	uint32_t                     core_idx1)
-{
-	uint32_t *sof_cnt = ife_hwr_mgr_ctx->sof_cnt;
-	int32_t rc = -1;
-
-	if (sof_cnt[core_idx0] ==
-			sof_cnt[core_idx1]) {
-
-		sof_cnt[core_idx0] = 0;
-		sof_cnt[core_idx1] = 0;
-
-		rc = 0;
-		return rc;
-	}
-
-	if ((sof_cnt[core_idx0] - sof_cnt[core_idx1] > 1) ||
-		(sof_cnt[core_idx1] - sof_cnt[core_idx0] > 1)) {
-
-		CAM_ERR(CAM_ISP, "One VFE of dual VFE cound not generate SOF");
-		rc = -1;
-		return rc;
-	}
-
-	CAM_INFO(CAM_ISP, "Only one core_index has given SOF");
-
-	return rc;
-}
-
 static int cam_ife_hw_mgr_process_camif_sof(
 	struct cam_ife_hw_mgr_res            *isp_ife_camif_res,
 	struct cam_ife_hw_mgr_ctx            *ife_hwr_mgr_ctx,
@@ -2709,8 +2733,8 @@
 		core_index0 = hw_res_l->hw_intf->hw_idx;
 		core_index1 = hw_res_r->hw_intf->hw_idx;
 
-		rc = cam_ife_hw_mgr_check_sof_for_dual_vfe(ife_hwr_mgr_ctx,
-			core_index0, core_index1);
+		rc = cam_ife_hw_mgr_check_irq_for_dual_vfe(ife_hwr_mgr_ctx,
+			core_index0, core_index1, evt_payload->evt_id);
 
 		if (!rc)
 			ife_hwr_irq_sof_cb(ife_hwr_mgr_ctx->common.cb_priv,
@@ -2803,6 +2827,124 @@
 	return 0;
 }
 
+static int cam_ife_hw_mgr_handle_eof_for_camif_hw_res(
+	void                              *handler_priv,
+	void                              *payload)
+{
+	int32_t rc = -EINVAL;
+	struct cam_isp_resource_node         *hw_res_l = NULL;
+	struct cam_isp_resource_node         *hw_res_r = NULL;
+	struct cam_ife_hw_mgr_ctx            *ife_hwr_mgr_ctx;
+	struct cam_vfe_top_irq_evt_payload   *evt_payload;
+	struct cam_ife_hw_mgr_res            *isp_ife_camif_res = NULL;
+	cam_hw_event_cb_func                  ife_hwr_irq_eof_cb;
+	struct cam_isp_hw_eof_event_data      eof_done_event_data;
+	uint32_t  core_idx;
+	uint32_t  eof_status = 0;
+	uint32_t  core_index0;
+	uint32_t  core_index1;
+
+	CAM_DBG(CAM_ISP, "Enter");
+
+	ife_hwr_mgr_ctx = handler_priv;
+	evt_payload = payload;
+	if (!evt_payload) {
+		pr_err("%s: no payload\n", __func__);
+		return IRQ_HANDLED;
+	}
+	core_idx = evt_payload->core_index;
+	ife_hwr_irq_eof_cb =
+		ife_hwr_mgr_ctx->common.event_cb[CAM_ISP_HW_EVENT_EOF];
+
+	evt_payload->evt_id = CAM_ISP_HW_EVENT_EOF;
+
+	list_for_each_entry(isp_ife_camif_res,
+		&ife_hwr_mgr_ctx->res_list_ife_src, list) {
+
+		if ((isp_ife_camif_res->res_type ==
+			CAM_IFE_HW_MGR_RES_UNINIT) ||
+			(isp_ife_camif_res->res_id != CAM_ISP_HW_VFE_IN_CAMIF))
+			continue;
+
+		hw_res_l = isp_ife_camif_res->hw_res[0];
+		hw_res_r = isp_ife_camif_res->hw_res[1];
+
+		CAM_DBG(CAM_ISP, "is_dual_vfe ? = %d",
+				isp_ife_camif_res->is_dual_vfe);
+		switch (isp_ife_camif_res->is_dual_vfe) {
+		/* Handling Single VFE Scenario */
+		case 0:
+			/* EOF check for Left side VFE */
+			if (!hw_res_l) {
+				pr_err("%s: VFE Device is NULL\n",
+					__func__);
+				break;
+			}
+			CAM_DBG(CAM_ISP, "curr_core_idx = %d, core idx hw = %d",
+					core_idx, hw_res_l->hw_intf->hw_idx);
+
+			if (core_idx == hw_res_l->hw_intf->hw_idx) {
+				eof_status = hw_res_l->bottom_half_handler(
+					hw_res_l, evt_payload);
+				if (!eof_status)
+					ife_hwr_irq_eof_cb(
+						ife_hwr_mgr_ctx->common.cb_priv,
+						CAM_ISP_HW_EVENT_EOF,
+						&eof_done_event_data);
+			}
+
+			break;
+		/* Handling dual VFE Scenario */
+		case 1:
+			if ((!hw_res_l) || (!hw_res_r)) {
+				CAM_ERR(CAM_ISP, "Dual VFE Device is NULL");
+				break;
+			}
+			if (core_idx == hw_res_l->hw_intf->hw_idx) {
+				eof_status = hw_res_l->bottom_half_handler(
+					hw_res_l, evt_payload);
+
+				if (!eof_status)
+					ife_hwr_mgr_ctx->eof_cnt[core_idx]++;
+			}
+
+			/* EOF check for Right side VFE */
+			if (core_idx == hw_res_r->hw_intf->hw_idx) {
+				eof_status = hw_res_r->bottom_half_handler(
+					hw_res_r, evt_payload);
+
+				if (!eof_status)
+					ife_hwr_mgr_ctx->eof_cnt[core_idx]++;
+			}
+
+			core_index0 = hw_res_l->hw_intf->hw_idx;
+			core_index1 = hw_res_r->hw_intf->hw_idx;
+
+			rc = cam_ife_hw_mgr_check_irq_for_dual_vfe(
+					ife_hwr_mgr_ctx,
+					core_index0,
+					core_index1,
+					evt_payload->evt_id);
+
+			if (!rc)
+				ife_hwr_irq_eof_cb(
+					ife_hwr_mgr_ctx->common.cb_priv,
+					CAM_ISP_HW_EVENT_EPOCH,
+					&eof_done_event_data);
+
+			break;
+
+		default:
+			CAM_ERR(CAM_ISP, "error with hw_res");
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "Exit (eof_status = %d)!", eof_status);
+
+	return 0;
+}
+
+
 static int cam_ife_hw_mgr_handle_buf_done_for_hw_res(
 	void                              *handler_priv,
 	void                              *payload)
@@ -3009,6 +3151,8 @@
 	/* EPOCH IRQ */
 	cam_ife_hw_mgr_handle_epoch_for_camif_hw_res(ife_hwr_mgr_ctx,
 		evt_payload_priv);
+	cam_ife_hw_mgr_handle_eof_for_camif_hw_res(ife_hwr_mgr_ctx,
+		evt_payload_priv);
 
 	return IRQ_HANDLED;
 }
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.h
index 6dfdb21..750b43e 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/cam_ife_hw_mgr.h
@@ -106,6 +106,7 @@
  * @cdm_cmd                 cdm base and length request pointer
  * @sof_cnt                 sof count value per core, used for dual VFE
  * @epoch_cnt               epoch count value per core, used for dual VFE
+ * @eof_cnt                 eof count value per core, used for dual VFE
  * @overflow_pending        flat to specify the overflow is pending for the
  *                          context
  * @is_rdi_only_context     flag to specify the context has only rdi resource
@@ -138,6 +139,7 @@
 
 	uint32_t                        sof_cnt[CAM_IFE_HW_NUM_MAX];
 	uint32_t                        epoch_cnt[CAM_IFE_HW_NUM_MAX];
+	uint32_t                        eof_cnt[CAM_IFE_HW_NUM_MAX];
 	atomic_t                        overflow_pending;
 	uint32_t                        is_rdi_only_context;
 
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
index 0a0eecb..3ef96db 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
@@ -168,6 +168,8 @@
 
 			num_ent++;
 			break;
+		case CAM_ISP_PACKET_META_GENERIC_BLOB:
+			break;
 		default:
 			CAM_ERR(CAM_ISP, "invalid cdm command meta data %d",
 				cmd_meta_data);
@@ -180,6 +182,229 @@
 	return rc;
 }
 
+static int cam_isp_handle_hfr_config(
+	struct cam_isp_generic_blob_info *blob_info,
+	struct cam_isp_resource_hfr_config *hfr_config, uint32_t blob_size)
+{
+	uint32_t cal_blob_size =
+		sizeof(struct cam_isp_resource_hfr_config) +
+		(sizeof(struct cam_isp_port_hfr_config) *
+		(hfr_config->num_io_configs - 1));
+
+	if (cal_blob_size != blob_size) {
+		CAM_ERR(CAM_ISP, "Invalid blob size %d %d",
+			cal_blob_size, blob_size);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "HFR num_io_config = %d", hfr_config->num_io_configs);
+
+	if (blob_info->hfr_config) {
+		CAM_WARN(CAM_ISP,
+			"Ignoring previous hfr_config, prev=%d, curr=%d",
+			blob_info->hfr_config->num_io_configs,
+			hfr_config->num_io_configs);
+		kfree(blob_info->hfr_config);
+	}
+
+	blob_info->hfr_config = kzalloc(blob_size, GFP_ATOMIC);
+	if (!blob_info->hfr_config)
+		return -ENOMEM;
+
+	memcpy(blob_info->hfr_config, hfr_config, blob_size);
+
+	return 0;
+}
+
+static int cam_isp_packet_generic_blob_handler(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data)
+{
+	int rc = 0;
+
+	if (!blob_data || (blob_size == 0)) {
+		CAM_ERR(CAM_ISP, "Invalid blob info %pK %d", blob_data,
+			blob_size);
+		return -EINVAL;
+	}
+
+	switch (blob_type) {
+	case CAM_ISP_GENERIC_BLOB_TYPE_HFR_CONFIG:
+		rc = cam_isp_handle_hfr_config(user_data,
+			(struct cam_isp_resource_hfr_config *)blob_data,
+			blob_size);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed in handling hfr config %d",
+				rc);
+
+		break;
+	default:
+		CAM_WARN(CAM_ISP, "Invalid blob type %d", blob_type);
+		break;
+	}
+
+	return rc;
+}
+
+int cam_isp_process_generic_cmd_buffer(
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_isp_generic_blob_info  *blob_info)
+{
+	int i, rc = 0;
+	struct cam_cmd_buf_desc *cmd_desc = NULL;
+
+	/*
+	 * set the cmd_desc to point the first command descriptor in the
+	 * packet
+	 */
+	cmd_desc = (struct cam_cmd_buf_desc *)
+			((uint8_t *)&prepare->packet->payload +
+			prepare->packet->cmd_buf_offset);
+
+	for (i = 0; i < prepare->packet->num_cmd_buf; i++) {
+		if (!cmd_desc[i].length)
+			continue;
+
+		if (cmd_desc[i].meta_data != CAM_ISP_PACKET_META_GENERIC_BLOB)
+			continue;
+
+		rc = cam_packet_util_validate_cmd_desc(&cmd_desc[i]);
+		if (rc)
+			return rc;
+
+		rc = cam_packet_util_process_generic_cmd_buffer(&cmd_desc[i],
+			cam_isp_packet_generic_blob_handler, blob_info);
+		if (rc)
+			CAM_ERR(CAM_ISP, "Failed in processing blobs %d", rc);
+
+		break;
+	}
+
+	return rc;
+}
+
+int cam_isp_add_hfr_config_hw_update(
+	struct cam_isp_resource_hfr_config   *hfr_config,
+	struct cam_hw_prepare_update_args    *prepare,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	struct cam_ife_hw_mgr_res            *res_list_isp_out,
+	uint32_t                              size_isp_out)
+{
+	int rc = 0;
+	struct cam_isp_resource_node       *res;
+	struct cam_ife_hw_mgr_res          *hw_mgr_res;
+	struct cam_isp_hw_get_hfr_update    update_hfr;
+	struct cam_isp_port_hfr_config     *io_hfr_config;
+	uint32_t                            kmd_buf_remain_size;
+	uint32_t                            i, j;
+	uint32_t                            res_id_out;
+	uint32_t                            hfr_cfg_used_bytes, num_ent;
+
+	hfr_cfg_used_bytes = 0;
+
+	/* Max one hw entries required for hfr config update */
+	if (prepare->num_hw_update_entries + 1 >=
+			prepare->max_hw_update_entries) {
+		CAM_ERR(CAM_ISP, "Insufficient  HW entries :%d %d",
+			prepare->num_hw_update_entries,
+			prepare->max_hw_update_entries);
+		return -EINVAL;
+	}
+
+	CAM_DBG(CAM_ISP, "num_io_configs= %d", hfr_config->num_io_configs);
+
+	for (i = 0; i < hfr_config->num_io_configs; i++) {
+		io_hfr_config = &hfr_config->io_hfr_config[i];
+		res_id_out = io_hfr_config->resource_type & 0xFF;
+
+		CAM_DBG(CAM_ISP, "hfr config idx %d, type=%d", i, res_id_out);
+
+		if (res_id_out >= size_isp_out) {
+			CAM_ERR(CAM_ISP, "invalid out restype:%x",
+				io_hfr_config->resource_type);
+			return -EINVAL;
+		}
+
+		hw_mgr_res = &res_list_isp_out[res_id_out];
+		if (hw_mgr_res->res_type == CAM_IFE_HW_MGR_RES_UNINIT) {
+			CAM_ERR(CAM_ISP, "io res id:%d not valid",
+				io_hfr_config->resource_type);
+			return -EINVAL;
+		}
+
+		for (j = 0; j < CAM_ISP_HW_SPLIT_MAX; j++) {
+			if (!hw_mgr_res->hw_res[j])
+				continue;
+
+			if (hw_mgr_res->hw_res[j]->hw_intf->hw_idx != base_idx)
+				continue;
+
+			res = hw_mgr_res->hw_res[j];
+			if (res->res_id !=
+				io_hfr_config->resource_type) {
+				CAM_ERR(CAM_ISP,
+					"wm err res id:%d io res id:%d",
+					res->res_id,
+					io_hfr_config->resource_type);
+				return -EINVAL;
+			}
+
+			if ((kmd_buf_info->used_bytes + hfr_cfg_used_bytes) <
+				kmd_buf_info->size) {
+				kmd_buf_remain_size = kmd_buf_info->size -
+					(kmd_buf_info->used_bytes +
+					hfr_cfg_used_bytes);
+			} else {
+				CAM_ERR(CAM_ISP,
+					"no free kmd memory for base %d",
+					base_idx);
+				rc = -ENOMEM;
+				return rc;
+			}
+
+			update_hfr.cdm.res = res;
+			update_hfr.cdm.cmd_buf_addr = kmd_buf_info->cpu_addr +
+				kmd_buf_info->used_bytes/4 +
+					hfr_cfg_used_bytes/4;
+			update_hfr.cdm.size = kmd_buf_remain_size;
+			update_hfr.io_hfr_cfg    = io_hfr_config;
+
+			CAM_DBG(CAM_ISP, "cmd buffer 0x%pK, size %d",
+				update_hfr.cdm.cmd_buf_addr,
+				update_hfr.cdm.size);
+			rc = res->hw_intf->hw_ops.process_cmd(
+				res->hw_intf->hw_priv,
+				CAM_VFE_HW_CMD_GET_HFR_UPDATE, &update_hfr,
+				sizeof(struct cam_isp_hw_get_hfr_update));
+
+			if (rc) {
+				CAM_ERR(CAM_ISP, "get buf cmd error:%d",
+					res->res_id);
+				rc = -ENOMEM;
+				return rc;
+			}
+			hfr_cfg_used_bytes += update_hfr.cdm.used_bytes;
+		}
+	}
+
+	CAM_DBG(CAM_ISP, "hfr_cfg_used_bytes %d", hfr_cfg_used_bytes);
+	if (hfr_cfg_used_bytes) {
+		/* Update the HW entries */
+		num_ent = prepare->num_hw_update_entries;
+		prepare->hw_update_entries[num_ent].handle =
+					kmd_buf_info->handle;
+		prepare->hw_update_entries[num_ent].len = hfr_cfg_used_bytes;
+		prepare->hw_update_entries[num_ent].offset =
+			kmd_buf_info->offset;
+		num_ent++;
+
+		kmd_buf_info->used_bytes += hfr_cfg_used_bytes;
+		kmd_buf_info->offset     += hfr_cfg_used_bytes;
+		prepare->num_hw_update_entries = num_ent;
+	}
+
+	return rc;
+}
 
 int cam_isp_add_io_buffers(
 	int                                   iommu_hdl,
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/include/cam_isp_packet_parser.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/include/cam_isp_packet_parser.h
index 7ac729f..187e5bc 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/include/cam_isp_packet_parser.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/include/cam_isp_packet_parser.h
@@ -21,6 +21,16 @@
 #include "cam_packet_util.h"
 
 /**
+ * struct cam_isp_generic_blob_info  Generic blob information
+ *
+ * @hfr_config             Initial configuration required to enable HFR
+ *
+ */
+struct cam_isp_generic_blob_info {
+	struct cam_isp_resource_hfr_config *hfr_config;
+};
+
+/**
  * @brief                  Add change base in the hw entries list
  *                         processe the isp source list get the change base from
  *                         ISP HW instance
@@ -96,5 +106,40 @@
 	uint32_t                              base_idx,
 	struct cam_kmd_buf_info              *kmd_buf_info);
 
+/**
+ * @brief                  Add HFR configurations in the HW entries list
+ *                         processe the hfr configurations based on the base
+ *                         index and update the HW entries list
+ *
+ * @hfr_config:            HFR resource configuration info
+ * @prepare:               Contain the  packet and HW update variables
+ * @base_idx:              Base or dev index of the IFE/VFE HW instance
+ * @kmd_buf_info:          Kmd buffer to store the change base command
+ * @res_list_isp_out:      IFE /VFE out resource list
+ * @size_isp_out:          Size of the res_list_isp_out array
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_add_hfr_config_hw_update(
+	struct cam_isp_resource_hfr_config   *hfr_config,
+	struct cam_hw_prepare_update_args    *prepare,
+	uint32_t                              base_idx,
+	struct cam_kmd_buf_info              *kmd_buf_info,
+	struct cam_ife_hw_mgr_res            *res_list_isp_out,
+	uint32_t                              size_isp_out);
+
+/**
+ * @brief                  Processing Generic command buffer.
+ *
+ * @prepare:               Contain the  packet and HW update variables
+ * @blob_info:             Information from generic blob command buffer
+ *
+ * @return:                0 for success
+ *                         -EINVAL for Fail
+ */
+int cam_isp_process_generic_cmd_buffer(
+	struct cam_hw_prepare_update_args *prepare,
+	struct cam_isp_generic_blob_info  *blob_info);
 
 #endif /*_CAM_ISP_HW_PARSER_H */
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.c
index 5a57046..128c050 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_dev.c
@@ -69,6 +69,8 @@
 
 	csid_hw_info->core_info = csid_dev;
 	csid_hw_info->soc_info.pdev = pdev;
+	csid_hw_info->soc_info.dev = &pdev->dev;
+	csid_hw_info->soc_info.dev_name = pdev->name;
 	csid_hw_info->soc_info.index = csid_dev_idx;
 
 	csid_hw_data = (struct cam_ife_csid_hw_info  *)match_dev->data;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.c
index 72050aa..22c11d3 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_soc.c
@@ -76,7 +76,7 @@
 	strlcpy(cpas_register_param.identifier, "csid",
 		CAM_HW_IDENTIFIER_LENGTH);
 	cpas_register_param.cell_index = soc_info->index;
-	cpas_register_param.dev = &soc_info->pdev->dev;
+	cpas_register_param.dev = soc_info->dev;
 	rc = cam_cpas_register_client(&cpas_register_param);
 	if (rc) {
 		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
index 6c6f38b..60f1c8b 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
@@ -161,4 +161,18 @@
 	struct cam_buf_io_cfg          *io_cfg;
 };
 
+/*
+ * struct cam_isp_hw_get_hfr_update:
+ *
+ * @Brief:         Get cdm commands for HFR updates.
+ *
+ * @ cdm:          Command buffer information
+ * @ io_hfr_cfg:   IO buffer config information sent from UMD
+ *
+ */
+struct cam_isp_hw_get_hfr_update {
+	struct cam_isp_hw_get_cdm_args  cdm;
+	struct cam_isp_port_hfr_config *io_hfr_cfg;
+};
+
 #endif /* _CAM_ISP_HW_H_ */
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
index 418280a..a08248d 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
@@ -48,6 +48,7 @@
 	CAM_VFE_HW_CMD_GET_CHANGE_BASE,
 	CAM_VFE_HW_CMD_GET_BUF_UPDATE,
 	CAM_VFE_HW_CMD_GET_REG_UPDATE,
+	CAM_VFE_HW_CMD_GET_HFR_UPDATE,
 	CAM_VFE_HW_CMD_MAX,
 };
 
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.c
index e330c84..b7db7b3 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_core.c
@@ -556,6 +556,7 @@
 
 		break;
 	case CAM_VFE_HW_CMD_GET_BUF_UPDATE:
+	case CAM_VFE_HW_CMD_GET_HFR_UPDATE:
 		rc = core_info->vfe_bus->hw_ops.process_cmd(
 			core_info->vfe_bus->bus_priv, cmd_type, cmd_args,
 			arg_size);
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.c
index 3e2307c..74627b8 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_dev.c
@@ -45,6 +45,8 @@
 		goto free_vfe_hw_intf;
 	}
 	vfe_hw->soc_info.pdev = pdev;
+	vfe_hw->soc_info.dev = &pdev->dev;
+	vfe_hw->soc_info.dev_name = pdev->name;
 	vfe_hw_intf->hw_priv = vfe_hw;
 	vfe_hw_intf->hw_ops.get_hw_caps = cam_vfe_get_hw_caps;
 	vfe_hw_intf->hw_ops.init = cam_vfe_init_hw;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.c
index 3b2ead2..b5ca432 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/cam_vfe_soc.c
@@ -88,7 +88,7 @@
 	strlcpy(cpas_register_param.identifier, "ife",
 		CAM_HW_IDENTIFIER_LENGTH);
 	cpas_register_param.cell_index = soc_info->index;
-	cpas_register_param.dev = &soc_info->pdev->dev;
+	cpas_register_param.dev = soc_info->dev;
 	rc = cam_cpas_register_client(&cpas_register_param);
 	if (rc) {
 		CAM_ERR(CAM_ISP, "CPAS registration failed rc=%d", rc);
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe170/cam_vfe170.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe170/cam_vfe170.h
index 275c7b5..da96cac 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe170/cam_vfe170.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe170/cam_vfe170.h
@@ -70,6 +70,7 @@
 	.sof_irq_mask                    = 0x00000001,
 	.epoch0_irq_mask                 = 0x00000004,
 	.reg_update_irq_mask             = 0x00000010,
+	.eof_irq_mask                    = 0x00000002,
 };
 
 struct cam_vfe_top_ver2_reg_offset_module_ctrl lens_170_reg = {
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
index 5d7a1b9..b1aaafb 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
@@ -36,6 +36,9 @@
 #define CAM_VFE_RDI_BUS_DEFAULT_WIDTH           0xFF01
 #define CAM_VFE_RDI_BUS_DEFAULT_STRIDE          0xFF01
 
+#define ALIGNUP(value, alignment) \
+	((value + alignment - 1) / alignment * alignment)
+
 #define MAX_BUF_UPDATE_REG_NUM   \
 	(sizeof(struct cam_vfe_bus_ver2_reg_offset_bus_client)/4)
 #define MAX_REG_VAL_PAIR_SIZE    \
@@ -89,7 +92,8 @@
 	void                                *ctx;
 
 	uint32_t             irq_enabled;
-	uint32_t             init_cfg_done;
+	bool                 init_cfg_done;
+	bool                 hfr_cfg_done;
 
 	uint32_t             offset;
 	uint32_t             width;
@@ -732,9 +736,22 @@
 		rsrc_data->index == 7 || rsrc_data->index == 8) {
 		/* Write master 3, 4 - for Full OUT , 7-8  FD OUT */
 		switch (rsrc_data->format) {
-		case CAM_FORMAT_UBWC_NV12:
 		case CAM_FORMAT_UBWC_NV12_4R:
 			rsrc_data->en_ubwc = 1;
+			rsrc_data->width = ALIGNUP(rsrc_data->width, 64);
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d\n", plane);
+				return -EINVAL;
+			}
+			break;
+		case CAM_FORMAT_UBWC_NV12:
+			rsrc_data->en_ubwc = 1;
 			/* Fall through for NV12 */
 		case CAM_FORMAT_NV21:
 		case CAM_FORMAT_NV12:
@@ -751,9 +768,22 @@
 			break;
 		case CAM_FORMAT_UBWC_TP10:
 			rsrc_data->en_ubwc = 1;
-			/* Fall through for LINEAR TP10 */
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width, 48) * 4 / 3;
+			switch (plane) {
+			case PLANE_C:
+				rsrc_data->height /= 2;
+				break;
+			case PLANE_Y:
+				break;
+			default:
+				CAM_ERR(CAM_ISP, "Invalid plane %d\n", plane);
+				return -EINVAL;
+			}
+			break;
 		case CAM_FORMAT_TP10:
-			rsrc_data->width = rsrc_data->width * 4 / 3;
+			rsrc_data->width =
+				ALIGNUP(rsrc_data->width, 3) * 4 / 3;
 			switch (plane) {
 			case PLANE_C:
 				rsrc_data->height /= 2;
@@ -820,7 +850,8 @@
 	rsrc_data->ubwc_meta_stride = 0;
 	rsrc_data->ubwc_mode_cfg = 0;
 	rsrc_data->ubwc_meta_offset = 0;
-	rsrc_data->init_cfg_done = 0;
+	rsrc_data->init_cfg_done = false;
+	rsrc_data->hfr_cfg_done = false;
 	rsrc_data->en_cfg = 0;
 
 	wm_res->tasklet_info = NULL;
@@ -1930,7 +1961,7 @@
 		CAM_DBG(CAM_ISP, "image stride 0x%x", wm_data->stride);
 
 		if (wm_data->framedrop_pattern != io_cfg->framedrop_pattern ||
-			!wm_data->init_cfg_done) {
+			!wm_data->hfr_cfg_done) {
 			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
 				wm_data->hw_regs->framedrop_pattern,
 				io_cfg->framedrop_pattern);
@@ -1940,7 +1971,7 @@
 			wm_data->framedrop_pattern);
 
 		if (wm_data->framedrop_period != io_cfg->framedrop_period ||
-			!wm_data->init_cfg_done) {
+			!wm_data->hfr_cfg_done) {
 			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
 				wm_data->hw_regs->framedrop_period,
 				io_cfg->framedrop_period);
@@ -1950,7 +1981,7 @@
 			wm_data->framedrop_period);
 
 		if (wm_data->irq_subsample_period != io_cfg->subsample_period
-			|| !wm_data->init_cfg_done) {
+			|| !wm_data->hfr_cfg_done) {
 			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
 				wm_data->hw_regs->irq_subsample_period,
 				io_cfg->subsample_period);
@@ -1961,7 +1992,7 @@
 			wm_data->irq_subsample_period);
 
 		if (wm_data->irq_subsample_pattern != io_cfg->subsample_pattern
-			|| !wm_data->init_cfg_done) {
+			|| !wm_data->hfr_cfg_done) {
 			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
 				wm_data->hw_regs->irq_subsample_pattern,
 				io_cfg->subsample_pattern);
@@ -2088,7 +2119,7 @@
 
 		/* set initial configuration done */
 		if (!wm_data->init_cfg_done)
-			wm_data->init_cfg_done = 1;
+			wm_data->init_cfg_done = true;
 	}
 
 	size = vfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
@@ -2110,6 +2141,108 @@
 	return 0;
 }
 
+static int cam_vfe_bus_update_hfr(void *priv, void *cmd_args,
+	uint32_t arg_size)
+{
+	struct cam_vfe_bus_ver2_priv             *bus_priv;
+	struct cam_isp_hw_get_hfr_update         *update_hfr;
+	struct cam_vfe_bus_ver2_vfe_out_data     *vfe_out_data = NULL;
+	struct cam_vfe_bus_ver2_wm_resource_data *wm_data = NULL;
+	struct cam_isp_port_hfr_config           *hfr_cfg = NULL;
+	uint32_t *reg_val_pair;
+	uint32_t  i, j, size = 0;
+
+	bus_priv = (struct cam_vfe_bus_ver2_priv  *) priv;
+	update_hfr =  (struct cam_isp_hw_get_hfr_update *) cmd_args;
+
+	vfe_out_data = (struct cam_vfe_bus_ver2_vfe_out_data *)
+		update_hfr->cdm.res->res_priv;
+
+	if (!vfe_out_data || !vfe_out_data->cdm_util_ops) {
+		CAM_ERR(CAM_ISP, "Failed! Invalid data");
+		return -EINVAL;
+	}
+
+	reg_val_pair = &vfe_out_data->common_data->io_buf_update[0];
+	hfr_cfg = update_hfr->io_hfr_cfg;
+
+	for (i = 0, j = 0; i < vfe_out_data->num_wm; i++) {
+		if (j >= (MAX_REG_VAL_PAIR_SIZE - MAX_BUF_UPDATE_REG_NUM * 2)) {
+			CAM_ERR(CAM_ISP,
+				"reg_val_pair %d exceeds the array limit %lu",
+				j, MAX_REG_VAL_PAIR_SIZE);
+			return -ENOMEM;
+		}
+
+		wm_data = vfe_out_data->wm_res[i]->res_priv;
+
+		if ((wm_data->framedrop_pattern !=
+			hfr_cfg->framedrop_pattern) ||
+			!wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_pattern,
+				hfr_cfg->framedrop_pattern);
+			wm_data->framedrop_pattern = hfr_cfg->framedrop_pattern;
+		}
+		CAM_DBG(CAM_ISP, "framedrop pattern 0x%x",
+			wm_data->framedrop_pattern);
+
+		if (wm_data->framedrop_period != hfr_cfg->framedrop_period ||
+			!wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->framedrop_period,
+				hfr_cfg->framedrop_period);
+			wm_data->framedrop_period = hfr_cfg->framedrop_period;
+		}
+		CAM_DBG(CAM_ISP, "framedrop period 0x%x",
+			wm_data->framedrop_period);
+
+		if (wm_data->irq_subsample_period != hfr_cfg->subsample_period
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_period,
+				hfr_cfg->subsample_period);
+			wm_data->irq_subsample_period =
+				hfr_cfg->subsample_period;
+		}
+		CAM_DBG(CAM_ISP, "irq subsample period 0x%x",
+			wm_data->irq_subsample_period);
+
+		if (wm_data->irq_subsample_pattern != hfr_cfg->subsample_pattern
+			|| !wm_data->hfr_cfg_done) {
+			CAM_VFE_ADD_REG_VAL_PAIR(reg_val_pair, j,
+				wm_data->hw_regs->irq_subsample_pattern,
+				hfr_cfg->subsample_pattern);
+			wm_data->irq_subsample_pattern =
+				hfr_cfg->subsample_pattern;
+		}
+		CAM_DBG(CAM_ISP, "irq subsample pattern 0x%x",
+			wm_data->irq_subsample_pattern);
+
+		/* set initial configuration done */
+		if (!wm_data->hfr_cfg_done)
+			wm_data->hfr_cfg_done = true;
+	}
+
+	size = vfe_out_data->cdm_util_ops->cdm_required_size_reg_random(j/2);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	if ((size * 4) > update_hfr->cdm.size) {
+		CAM_ERR(CAM_ISP,
+			"Failed! Buf size:%d insufficient, expected size:%d",
+			update_hfr->cdm.size, size);
+		return -ENOMEM;
+	}
+
+	vfe_out_data->cdm_util_ops->cdm_write_regrandom(
+		update_hfr->cdm.cmd_buf_addr, j/2, reg_val_pair);
+
+	/* cdm util returns dwords, need to convert to bytes */
+	update_hfr->cdm.used_bytes = size * 4;
+
+	return 0;
+}
+
 static int cam_vfe_bus_start_hw(void *hw_priv,
 	void *start_hw_args, uint32_t arg_size)
 {
@@ -2187,6 +2320,9 @@
 	case CAM_VFE_HW_CMD_GET_BUF_UPDATE:
 		rc = cam_vfe_bus_update_buf(priv, cmd_args, arg_size);
 		break;
+	case CAM_VFE_HW_CMD_GET_HFR_UPDATE:
+		rc = cam_vfe_bus_update_hfr(priv, cmd_args, arg_size);
+		break;
 	default:
 		CAM_ERR_RATE_LIMIT(CAM_ISP, "Inval camif process command:%d\n",
 			cmd_type);
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
index e70ecc5..1d15b5b 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
@@ -10,7 +10,7 @@
  * GNU General Public License for more details.
  */
 
- #include <linux/slab.h>
+#include <linux/slab.h>
 #include <uapi/media/cam_isp.h>
 #include "cam_io_util.h"
 #include "cam_isp_hw_mgr_intf.h"
@@ -207,6 +207,12 @@
 			ret = CAM_VFE_IRQ_STATUS_SUCCESS;
 		}
 		break;
+	case CAM_ISP_HW_EVENT_EOF:
+		if (irq_status0 & camif_priv->reg_data->eof_irq_mask) {
+			CAM_DBG(CAM_ISP, "Received EOF\n");
+			ret = CAM_VFE_IRQ_STATUS_SUCCESS;
+		}
+		break;
 	default:
 		break;
 	}
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.h
index 553abf2..485389a 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.h
@@ -54,6 +54,7 @@
 	uint32_t     sof_irq_mask;
 	uint32_t     epoch0_irq_mask;
 	uint32_t     reg_update_irq_mask;
+	uint32_t     eof_irq_mask;
 };
 
 struct cam_vfe_camif_ver2_hw_info {
diff --git a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.c b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.c
index 829bb51..55a344d 100644
--- a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.c
+++ b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/jpeg_dma_hw/jpeg_dma_dev.c
@@ -38,7 +38,7 @@
 	struct cam_cpas_register_params cpas_register_params;
 	int rc;
 
-	cpas_register_params.dev = &soc_info->pdev->dev;
+	cpas_register_params.dev = soc_info->dev;
 	memcpy(cpas_register_params.identifier, "jpeg-dma",
 		sizeof("jpeg-dma"));
 	cpas_register_params.cam_cpas_client_cb = NULL;
@@ -136,6 +136,8 @@
 		goto error_alloc_dev;
 	}
 	jpeg_dma_dev->soc_info.pdev = pdev;
+	jpeg_dma_dev->soc_info.dev = &pdev->dev;
+	jpeg_dma_dev->soc_info.dev_name = pdev->name;
 	jpeg_dma_dev_intf->hw_priv = jpeg_dma_dev;
 	jpeg_dma_dev_intf->hw_ops.init = cam_jpeg_dma_init_hw;
 	jpeg_dma_dev_intf->hw_ops.deinit = cam_jpeg_dma_deinit_hw;
diff --git a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.c b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.c
index 5dd1e1f..a8f309a 100644
--- a/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.c
+++ b/drivers/media/platform/msm/camera/cam_jpeg/jpeg_hw/jpeg_enc_hw/jpeg_enc_dev.c
@@ -42,7 +42,7 @@
 	struct cam_cpas_register_params cpas_register_params;
 	int rc;
 
-	cpas_register_params.dev = &soc_info->pdev->dev;
+	cpas_register_params.dev = soc_info->dev;
 	memcpy(cpas_register_params.identifier, "jpeg-enc",
 		sizeof("jpeg-enc"));
 	cpas_register_params.cam_cpas_client_cb = NULL;
@@ -140,6 +140,8 @@
 		goto error_alloc_dev;
 	}
 	jpeg_enc_dev->soc_info.pdev = pdev;
+	jpeg_enc_dev->soc_info.dev = &pdev->dev;
+	jpeg_enc_dev->soc_info.dev_name = pdev->name;
 	jpeg_enc_dev_intf->hw_priv = jpeg_enc_dev;
 	jpeg_enc_dev_intf->hw_ops.init = cam_jpeg_enc_init_hw;
 	jpeg_enc_dev_intf->hw_ops.deinit = cam_jpeg_enc_deinit_hw;
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
index efdda4f..6a148ca 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
@@ -365,7 +365,7 @@
  *
  */
 static int __cam_req_mgr_send_req(struct cam_req_mgr_core_link *link,
-	struct cam_req_mgr_req_queue *in_q)
+	struct cam_req_mgr_req_queue *in_q, uint32_t trigger)
 {
 	int                                  rc = 0, pd, i, idx;
 	struct cam_req_mgr_connected_device *dev = NULL;
@@ -391,6 +391,9 @@
 					link->req.apply_data[pd].req_id);
 				continue;
 			}
+			if (!(dev->dev_info.trigger & trigger))
+				continue;
+
 			apply_req.dev_hdl = dev->dev_hdl;
 			apply_req.request_id =
 				link->req.apply_data[pd].req_id;
@@ -400,6 +403,7 @@
 
 			trace_cam_req_mgr_apply_request(link, &apply_req, dev);
 
+			apply_req.trigger_point = trigger;
 			CAM_DBG(CAM_CRM, "SEND: pd %d req_id %lld",
 				pd, apply_req.request_id);
 			if (dev->ops && dev->ops->apply_req) {
@@ -488,7 +492,8 @@
  * @return   : 0 for success, negative for failure
  *
  */
-static int __cam_req_mgr_process_req(struct cam_req_mgr_core_link *link)
+static int __cam_req_mgr_process_req(struct cam_req_mgr_core_link *link,
+	uint32_t trigger)
 {
 	int                                  rc = 0, idx;
 	struct cam_req_mgr_slot             *slot = NULL;
@@ -499,7 +504,7 @@
 	session = (struct cam_req_mgr_core_session *)link->parent;
 
 	/*
-	 * 1. Check if new read index,
+	 * Check if new read index,
 	 * - if in pending  state, traverse again to complete
 	 *    transaction of this read index.
 	 * - if in applied_state, somthign wrong.
@@ -514,58 +519,70 @@
 		return 0;
 	}
 
-	rc = __cam_req_mgr_check_link_is_ready(link, slot->idx);
-	if (rc >= 0) {
-		rc = __cam_req_mgr_send_req(link, link->req.in_q);
-		if (rc < 0) {
-			/* Apply req failed retry at next sof */
-			slot->status = CRM_SLOT_STATUS_REQ_PENDING;
-		} else {
-			slot->status = CRM_SLOT_STATUS_REQ_APPLIED;
+	if (trigger != CAM_TRIGGER_POINT_SOF &&
+			trigger != CAM_TRIGGER_POINT_EOF)
+		return rc;
 
+	if (trigger == CAM_TRIGGER_POINT_SOF) {
+		if (link->trigger_mask) {
+			CAM_ERR(CAM_CRM, "Applying for last EOF fails");
+			return -EINVAL;
+		}
+		rc = __cam_req_mgr_check_link_is_ready(link, slot->idx);
+		if (rc < 0) {
+
+			 /* If traverse result is not success, then some devices
+			  * are not ready with packet for the asked request id,
+			  * hence try again in next sof
+			  */
+			slot->status = CRM_SLOT_STATUS_REQ_PENDING;
 			if (link->state == CAM_CRM_LINK_STATE_ERR) {
-				CAM_WARN(CAM_CRM,
-					"Err recovery done idx %d status %d",
+				/*
+				 * During error recovery all tables should be
+				 * ready, don't expect to enter here.
+				 * @TODO: gracefully handle if recovery fails.
+				 */
+				CAM_ERR(CAM_CRM,
+					"FATAL recovery cant finish idx %d status %d",
 					in_q->rd_idx,
 					in_q->slot[in_q->rd_idx].status);
-				mutex_lock(&link->lock);
-				link->state = CAM_CRM_LINK_STATE_READY;
-				mutex_unlock(&link->lock);
+				rc = -EPERM;
 			}
+			return rc;
+		}
+	}
+	if (trigger == CAM_TRIGGER_POINT_EOF &&
+			(!(link->trigger_mask & CAM_TRIGGER_POINT_SOF))) {
+		CAM_ERR(CAM_CRM, "Applying for last SOF fails");
+		return -EINVAL;
+	}
 
-			/*
-			 * 2. Check if any new req is pending in input queue,
-			 *    if not finish the lower pipeline delay device with
-			 *    available req ids.
-			 */
+	rc = __cam_req_mgr_send_req(link, link->req.in_q, trigger);
+	if (rc < 0) {
+		/* Apply req failed retry at next sof */
+		slot->status = CRM_SLOT_STATUS_REQ_PENDING;
+	} else {
+		link->trigger_mask |= trigger;
+
+		if (link->state == CAM_CRM_LINK_STATE_ERR) {
+			CAM_WARN(CAM_CRM, "Err recovery done idx %d",
+				in_q->rd_idx);
+			mutex_lock(&link->lock);
+			link->state = CAM_CRM_LINK_STATE_READY;
+			mutex_unlock(&link->lock);
+		}
+		if (link->trigger_mask == link->subscribe_event) {
+			slot->status = CRM_SLOT_STATUS_REQ_APPLIED;
+			link->trigger_mask = 0;
+			CAM_DBG(CAM_CRM, "req is applied\n");
 			__cam_req_mgr_check_next_req_slot(in_q);
 
-			/*
-			 * 3. Older req slots can be safely reset as no err ack.
-			 */
 			idx = in_q->rd_idx;
-			__cam_req_mgr_dec_idx(&idx, link->max_delay + 1,
+			__cam_req_mgr_dec_idx(
+				&idx, link->max_delay + 1,
 				in_q->num_slots);
 			__cam_req_mgr_reset_req_slot(link, idx);
 		}
-	} else {
-		/*
-		 * 4.If traverse result is not success, then some devices are
-		 *   not ready with packet for the asked request id,
-		 *   hence try again in next sof
-		 */
-		slot->status = CRM_SLOT_STATUS_REQ_PENDING;
-		if (link->state == CAM_CRM_LINK_STATE_ERR) {
-			/*
-			 * During error recovery all tables should be ready
-			 *   don't expect to enter here.
-			 * @TODO: gracefully handle if recovery fails.
-			 */
-			CAM_ERR(CAM_CRM,
-				"FATAL recovery cant finish idx %d status %d",
-				in_q->rd_idx, in_q->slot[in_q->rd_idx].status);
-			rc = -EPERM;
-		}
 	}
 
 	return rc;
@@ -576,7 +593,7 @@
  *
  * @brief    : Add table to list under link sorted by pd decremeting order
  * @l_tbl    : list of pipeline delay tables.
- * @new_tbl : new tbl which will be appended to above list as per its pd value
+ * @new_tbl  : new tbl which will be appended to above list as per its pd value
  *
  */
 static void __cam_req_mgr_add_tbl_to_link(struct cam_req_mgr_req_tbl **l_tbl,
@@ -828,6 +845,7 @@
 	link_data.link_enable = 0;
 	link_data.link_hdl = link->link_hdl;
 	link_data.crm_cb = NULL;
+	link_data.subscribe_event = 0;
 
 	/* Using device ops unlink devices */
 	for (i = 0; i < link->num_devs; i++) {
@@ -977,7 +995,7 @@
 	send_req = (struct cam_req_mgr_send_request *)data;
 	in_q = send_req->in_q;
 
-	rc = __cam_req_mgr_send_req(link, in_q);
+	rc = __cam_req_mgr_send_req(link, in_q, CAM_TRIGGER_POINT_SOF);
 end:
 	return rc;
 }
@@ -1302,7 +1320,7 @@
 }
 
 /**
- * cam_req_mgr_process_sof()
+ * cam_req_mgr_process_trigger()
  *
  * @brief: This runs in workque thread context. Call core funcs to check
  *         which peding requests can be processed.
@@ -1311,10 +1329,10 @@
  *
  * @return: 0 on success.
  */
-static int cam_req_mgr_process_sof(void *priv, void *data)
+static int cam_req_mgr_process_trigger(void *priv, void *data)
 {
 	int                                  rc = 0;
-	struct cam_req_mgr_sof_notify       *sof_data = NULL;
+	struct cam_req_mgr_trigger_notify   *trigger_data = NULL;
 	struct cam_req_mgr_core_link        *link = NULL;
 	struct cam_req_mgr_req_queue        *in_q = NULL;
 	struct crm_task_payload             *task_data = NULL;
@@ -1326,11 +1344,12 @@
 	}
 	link = (struct cam_req_mgr_core_link *)priv;
 	task_data = (struct crm_task_payload *)data;
-	sof_data = (struct cam_req_mgr_sof_notify *)&task_data->u;
+	trigger_data = (struct cam_req_mgr_trigger_notify *)&task_data->u;
 
-	CAM_DBG(CAM_CRM, "link_hdl %x frame_id %lld",
-		sof_data->link_hdl,
-		sof_data->frame_id);
+	CAM_DBG(CAM_CRM, "link_hdl %x frame_id %lld, trigger %x\n",
+		trigger_data->link_hdl,
+		trigger_data->frame_id,
+		trigger_data->trigger);
 
 	in_q = link->req.in_q;
 
@@ -1354,7 +1373,7 @@
 		 */
 		__cam_req_mgr_inc_idx(&in_q->rd_idx, 1, in_q->num_slots);
 	}
-	rc = __cam_req_mgr_process_req(link);
+	rc = __cam_req_mgr_process_req(link, trigger_data->trigger);
 	mutex_unlock(&link->req.lock);
 
 end:
@@ -1484,7 +1503,7 @@
 }
 
 /**
- * cam_req_mgr_cb_notify_sof()
+ * cam_req_mgr_cb_notify_trigger()
  *
  * @brief   : SOF received from device, sends trigger through workqueue
  * @sof_data: contains information about frame_id, link etc.
@@ -1492,25 +1511,25 @@
  * @return  : 0 on success
  *
  */
-static int cam_req_mgr_cb_notify_sof(
-	struct cam_req_mgr_sof_notify *sof_data)
+static int cam_req_mgr_cb_notify_trigger(
+	struct cam_req_mgr_trigger_notify *trigger_data)
 {
 	int                              rc = 0;
 	struct crm_workq_task           *task = NULL;
 	struct cam_req_mgr_core_link    *link = NULL;
-	struct cam_req_mgr_sof_notify   *notify_sof;
+	struct cam_req_mgr_trigger_notify   *notify_trigger;
 	struct crm_task_payload         *task_data;
 
-	if (!sof_data) {
+	if (!trigger_data) {
 		CAM_ERR(CAM_CRM, "sof_data is NULL");
 		rc = -EINVAL;
 		goto end;
 	}
 
 	link = (struct cam_req_mgr_core_link *)
-		cam_get_device_priv(sof_data->link_hdl);
+		cam_get_device_priv(trigger_data->link_hdl);
 	if (!link) {
-		CAM_DBG(CAM_CRM, "link ptr NULL %x", sof_data->link_hdl);
+		CAM_DBG(CAM_CRM, "link ptr NULL %x", trigger_data->link_hdl);
 		rc = -EINVAL;
 		goto end;
 	}
@@ -1519,17 +1538,18 @@
 	task = cam_req_mgr_workq_get_task(link->workq);
 	if (!task) {
 		CAM_ERR(CAM_CRM, "no empty task frame %lld",
-			sof_data->frame_id);
+			trigger_data->frame_id);
 		rc = -EBUSY;
 		goto end;
 	}
 	task_data = (struct crm_task_payload *)task->payload;
 	task_data->type = CRM_WORKQ_TASK_NOTIFY_SOF;
-	notify_sof = (struct cam_req_mgr_sof_notify *)&task_data->u;
-	notify_sof->frame_id = sof_data->frame_id;
-	notify_sof->link_hdl = sof_data->link_hdl;
-	notify_sof->dev_hdl = sof_data->dev_hdl;
-	task->process_cb = &cam_req_mgr_process_sof;
+	notify_trigger = (struct cam_req_mgr_trigger_notify *)&task_data->u;
+	notify_trigger->frame_id = trigger_data->frame_id;
+	notify_trigger->link_hdl = trigger_data->link_hdl;
+	notify_trigger->dev_hdl = trigger_data->dev_hdl;
+	notify_trigger->trigger = trigger_data->trigger;
+	task->process_cb = &cam_req_mgr_process_trigger;
 	rc = cam_req_mgr_workq_enqueue_task(task, link, CRM_TASK_PRIORITY_0);
 
 end:
@@ -1537,9 +1557,9 @@
 }
 
 static struct cam_req_mgr_crm_cb cam_req_mgr_ops = {
-	.notify_sof = cam_req_mgr_cb_notify_sof,
-	.notify_err = cam_req_mgr_cb_notify_err,
-	.add_req    = cam_req_mgr_cb_add_req,
+	.notify_trigger = cam_req_mgr_cb_notify_trigger,
+	.notify_err     = cam_req_mgr_cb_notify_err,
+	.add_req        = cam_req_mgr_cb_add_req,
 };
 
 /**
@@ -1561,6 +1581,7 @@
 	struct cam_req_mgr_connected_device    *dev;
 	struct cam_req_mgr_req_tbl             *pd_tbl;
 	enum cam_pipeline_delay                 max_delay;
+	uint32_t                                subscribe_event = 0;
 
 	if (link_info->num_devices > CAM_REQ_MGR_MAX_HANDLES)
 		return -EPERM;
@@ -1594,9 +1615,11 @@
 
 		trace_cam_req_mgr_connect_device(link, &dev->dev_info);
 
-		CAM_DBG(CAM_CRM, "%x: connected: %s, id %d, delay %d",
+		CAM_DBG(CAM_CRM,
+			"%x: connected: %s, id %d, delay %d, trigger %x",
 			link_info->session_hdl, dev->dev_info.name,
-			dev->dev_info.dev_id, dev->dev_info.p_delay);
+			dev->dev_info.dev_id, dev->dev_info.p_delay,
+			dev->dev_info.trigger);
 		if (rc < 0 ||
 			dev->dev_info.p_delay >=
 			CAM_PIPELINE_DELAY_MAX ||
@@ -1609,18 +1632,19 @@
 				link_info->session_hdl,
 				dev->dev_info.name,
 				dev->dev_info.p_delay);
-			if (dev->dev_info.p_delay >
-				max_delay)
-			max_delay =
-				dev->dev_info.p_delay;
+			if (dev->dev_info.p_delay > max_delay)
+				max_delay = dev->dev_info.p_delay;
+
+			subscribe_event |= (uint32_t)dev->dev_info.trigger;
 		}
 	}
 
-
+	link->subscribe_event = subscribe_event;
 	link_data.link_enable = 1;
 	link_data.link_hdl = link->link_hdl;
 	link_data.crm_cb = &cam_req_mgr_ops;
 	link_data.max_delay = max_delay;
+	link_data.subscribe_event = subscribe_event;
 
 	for (i = 0; i < link_info->num_devices; i++) {
 		dev = &link->l_dev[i];
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.h b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.h
index 3ee0e2f..98a2a4f 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.h
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.h
@@ -47,15 +47,15 @@
 
 /**
  * struct crm_task_payload
- * @type       : to identify which type of task is present
- * @u          : union of payload of all types of tasks supported
- * @sched_req  : contains info of  incoming reqest from CSL to CRM
- * @flush_info : contains info of cancelled reqest
- * @dev_req    : contains tracking info of available req id at device
- * @send_req   : contains info of apply settings to be sent to devs in link
- * @apply_req  : contains info of which request is applied at device
- * @notify_sof : contains notification from IFE to CRM about SOF trigger
- * @notify_err : contains error info happened while processing request
+ * @type           : to identify which type of task is present
+ * @u              : union of payload of all types of tasks supported
+ * @sched_req      : contains info of  incoming reqest from CSL to CRM
+ * @flush_info     : contains info of cancelled reqest
+ * @dev_req        : contains tracking info of available req id at device
+ * @send_req       : contains info of apply settings to be sent to devs in link
+ * @apply_req      : contains info of which request is applied at device
+ * @notify_trigger : contains notification from IFE to CRM about trigger
+ * @notify_err     : contains error info happened while processing request
  * -
  */
 struct crm_task_payload {
@@ -65,7 +65,7 @@
 		struct cam_req_mgr_flush_info           flush_info;
 		struct cam_req_mgr_add_request          dev_req;
 		struct cam_req_mgr_send_request         send_req;
-		struct cam_req_mgr_sof_notify           notify_sof;
+		struct cam_req_mgr_trigger_notify       notify_trigger;
 		struct cam_req_mgr_error_notify         notify_err;
 	} u;
 };
@@ -90,8 +90,8 @@
  * State machine for life cycle of request in input queue
  * NO_REQ     : empty slot
  * REQ_ADDED  : new entry in slot
- * INCOMPLETE : waiting for
- * APPLIED    : req is sent to devices
+ * PENDING    : waiting for next trigger to apply
+ * APPLIED    : req is sent to all devices
  * INVALID    : invalid state
  */
 enum crm_slot_status {
@@ -108,7 +108,7 @@
  * AVAILABLE  : link available
  * IDLE       : link initialized but not ready yet
  * READY      : link is ready for use
- * ERR	      : link has encountered error
+ * ERR        : link has encountered error
  * MAX        : invalid state
  */
 enum cam_req_mgr_link_state {
@@ -189,12 +189,12 @@
 /**
  * struct cam_req_mgr_slot
  * - Internal Book keeping
- * @idx      : slot index
- * @skip_idx : if req id in this slot needs to be skipped/not applied
- * @status   : state machine for life cycle of a slot
+ * @idx          : slot index
+ * @skip_idx     : if req id in this slot needs to be skipped/not applied
+ * @status       : state machine for life cycle of a slot
  * - members updated due to external events
- * @recover  : if user enabled recovery for this request.
- * @req_id   : mask tracking which all devices have request ready
+ * @recover      : if user enabled recovery for this request.
+ * @req_id       : mask tracking which all devices have request ready
  */
 struct cam_req_mgr_slot {
 	int32_t               idx;
@@ -275,6 +275,9 @@
  * @state          : link state machine
  * @parent         : pvt data - link's parent is session
  * @lock           : mutex lock to guard link data operations
+ * @subscribe_event: irqs that link subscribes, IFE should send notification
+ * to CRM at those hw events.
+ * @trigger_mask   : mask on which irq the req is already applied
  */
 struct cam_req_mgr_core_link {
 	int32_t                              link_hdl;
@@ -289,6 +292,8 @@
 	enum cam_req_mgr_link_state          state;
 	void                                *parent;
 	struct mutex                         lock;
+	uint32_t                             subscribe_event;
+	uint32_t                             trigger_mask;
 };
 
 /**
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_interface.h b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_interface.h
index 8faf35a..6195b59 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_interface.h
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_interface.h
@@ -18,7 +18,7 @@
 #include "cam_req_mgr_core_defs.h"
 #include "cam_req_mgr_util.h"
 
-struct cam_req_mgr_sof_notify;
+struct cam_req_mgr_trigger_notify;
 struct cam_req_mgr_error_notify;
 struct cam_req_mgr_add_request;
 struct cam_req_mgr_device_info;
@@ -29,13 +29,15 @@
 
 /* Request Manager -- camera device driver interface */
 /**
- * @brief: camera kernel drivers  to cam req mgr communication
+ * @brief: camera kernel drivers to cam req mgr communication
  *
- * @cam_req_mgr_notify_sof: for device which generates sof to inform CRM
- * @cam_req_mgr_notify_err: device use this to inform about different errors.
- * @cam_req_mgr_add_req: to info CRm about new rqeuest received from userspace
+ * @cam_req_mgr_notify_trigger: for device which generates trigger to inform CRM
+ * @cam_req_mgr_notify_err    : device use this to inform about different errors
+ * @cam_req_mgr_add_req       : to info CRm about new rqeuest received from
+ *                              userspace
  */
-typedef int (*cam_req_mgr_notify_sof)(struct cam_req_mgr_sof_notify *);
+typedef int (*cam_req_mgr_notify_trigger)(
+	struct cam_req_mgr_trigger_notify *);
 typedef int (*cam_req_mgr_notify_err)(struct cam_req_mgr_error_notify *);
 typedef int (*cam_req_mgr_add_req)(struct cam_req_mgr_add_request *);
 
@@ -57,16 +59,16 @@
 typedef int (*cam_req_mgr_process_evt)(struct cam_req_mgr_link_evt_data *);
 
 /**
- * @brief      : cam_req_mgr_crm_cb - func table
+ * @brief          : cam_req_mgr_crm_cb - func table
  *
- * @notify_sof : payload for sof indication event
- * @notify_err : payload for different error occurred at device
- * @add_req    : payload to inform which device and what request is received
+ * @notify_trigger : payload for trigger indication event
+ * @notify_err     : payload for different error occurred at device
+ * @add_req        : payload to inform which device and what request is received
  */
 struct cam_req_mgr_crm_cb {
-	cam_req_mgr_notify_sof  notify_sof;
-	cam_req_mgr_notify_err  notify_err;
-	cam_req_mgr_add_req     add_req;
+	cam_req_mgr_notify_trigger  notify_trigger;
+	cam_req_mgr_notify_err      notify_err;
+	cam_req_mgr_add_req         add_req;
 };
 
 /**
@@ -103,6 +105,13 @@
 };
 
 /**
+ * @CAM_TRIGGER_POINT_SOF   : Trigger point for SOF
+ * @CAM_TRIGGER_POINT_EOF   : Trigger point for EOF
+ */
+#define CAM_TRIGGER_POINT_SOF     (1 << 0)
+#define CAM_TRIGGER_POINT_EOF     (1 << 1)
+
+/**
  * enum cam_req_status
  * @brief   : enumerator for request status
  *
@@ -177,15 +186,18 @@
 };
 
 /**
- * struct cam_req_mgr_sof_notify
+ * struct cam_req_mgr_trigger_notify
  * @link_hdl : link identifier
  * @dev_hdl  : device handle which has sent this req id
  * @frame_id : frame id for internal tracking
+ * @trigger  : trigger point of this notification, CRM will send apply
+ * only to the devices which subscribe to this point.
  */
-struct cam_req_mgr_sof_notify {
-	int32_t link_hdl;
-	int32_t dev_hdl;
-	int64_t frame_id;
+struct cam_req_mgr_trigger_notify {
+	int32_t  link_hdl;
+	int32_t  dev_hdl;
+	int64_t  frame_id;
+	uint32_t trigger;
 };
 
 /**
@@ -223,6 +235,7 @@
  * @name    : link link or unlink
  * @dev_id  : device id info
  * @p_delay : delay between time settings applied and take effect
+ * @trigger : Trigger point for the client
  *
  */
 struct cam_req_mgr_device_info {
@@ -230,15 +243,17 @@
 	char                        name[256];
 	enum cam_req_mgr_device_id  dev_id;
 	enum cam_pipeline_delay     p_delay;
+	uint32_t                    trigger;
 };
 
 /**
  * struct cam_req_mgr_core_dev_link_setup
- * @link_enable : link link or unlink
- * @link_hdl    : link identifier
- * @dev_hdl     : device handle for reference
- * @max_delay   : max pipeline delay on this link
- * @crm_cb      : callback funcs to communicate with req mgr
+ * @link_enable     : link link or unlink
+ * @link_hdl        : link identifier
+ * @dev_hdl         : device handle for reference
+ * @max_delay       : max pipeline delay on this link
+ * @crm_cb          : callback funcs to communicate with req mgr
+ * @subscribe_event : the mask of trigger points this link subscribes
  *
  */
 struct cam_req_mgr_core_dev_link_setup {
@@ -247,6 +262,7 @@
 	int32_t                    dev_hdl;
 	enum cam_pipeline_delay    max_delay;
 	struct cam_req_mgr_crm_cb *crm_cb;
+	uint32_t                   subscribe_event;
 };
 
 /**
@@ -255,6 +271,7 @@
  * @dev_hdl          : device handle for cross check
  * @request_id       : request id settings to apply
  * @report_if_bubble : report to crm if failure in applying
+ * @trigger_point    : the trigger point of this apply
  *
  */
 struct cam_req_mgr_apply_request {
@@ -262,6 +279,7 @@
 	int32_t    dev_hdl;
 	uint64_t   request_id;
 	int32_t    report_if_bubble;
+	uint32_t   trigger_point;
 };
 
 /**
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c
index 18097b0..b36fc68 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_core.c
@@ -28,12 +28,21 @@
 	}
 
 	i2c_info = (struct cam_cmd_i2c_info *)cmd_buf;
-	a_ctrl->io_master_info.cci_client->i2c_freq_mode =
-		i2c_info->i2c_freq_mode;
-	a_ctrl->io_master_info.cci_client->sid =
-		i2c_info->slave_addr >> 1;
-	CAM_DBG(CAM_ACTUATOR, "Slave addr: 0x%x Freq Mode: %d",
-		i2c_info->slave_addr, i2c_info->i2c_freq_mode);
+	if (a_ctrl->io_master_info.master_type == CCI_MASTER) {
+		a_ctrl->io_master_info.cci_client->i2c_freq_mode =
+			i2c_info->i2c_freq_mode;
+		a_ctrl->io_master_info.cci_client->sid =
+			i2c_info->slave_addr >> 1;
+		CAM_DBG(CAM_ACTUATOR, "Slave addr: 0x%x Freq Mode: %d",
+			i2c_info->slave_addr, i2c_info->i2c_freq_mode);
+	} else if (a_ctrl->io_master_info.master_type == I2C_MASTER) {
+		a_ctrl->io_master_info.client->addr = i2c_info->slave_addr;
+		CAM_DBG(CAM_ACTUATOR, "Slave addr: 0x%x", i2c_info->slave_addr);
+	} else {
+		CAM_ERR(CAM_ACTUATOR, "Invalid Master type: %d",
+			a_ctrl->io_master_info.master_type);
+		 rc = -EINVAL;
+	}
 
 	return rc;
 }
@@ -185,6 +194,7 @@
 	info->dev_id = CAM_REQ_MGR_DEVICE_ACTUATOR;
 	strlcpy(info->name, CAM_ACTUATOR_NAME, sizeof(info->name));
 	info->p_delay = 0;
+	info->trigger = CAM_TRIGGER_POINT_SOF;
 
 	return 0;
 }
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_dev.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_dev.c
index 7eba9d1..e58f737 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_dev.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_dev.c
@@ -35,11 +35,94 @@
 	return rc;
 }
 
+#ifdef CONFIG_COMPAT
+static long cam_actuator_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_ACTUATOR,
+			"Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		cmd = VIDIOC_CAM_CONTROL;
+		rc = cam_actuator_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed in actuator subdev handling rc: %d",
+				rc);
+			return rc;
+		}
+	break;
+	default:
+		CAM_ERR(CAM_ACTUATOR, "Invalid compat ioctl: %d", cmd);
+		rc = -EINVAL;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_ACTUATOR,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+	return rc;
+}
+#endif
+
+static struct v4l2_subdev_core_ops cam_actuator_subdev_core_ops = {
+	.ioctl = cam_actuator_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_actuator_init_subdev_do_ioctl,
+#endif
+};
+
+static struct v4l2_subdev_ops cam_actuator_subdev_ops = {
+	.core = &cam_actuator_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cam_actuator_internal_ops;
+
+static int cam_actuator_init_subdev(struct cam_actuator_ctrl_t *a_ctrl)
+{
+	int rc = 0;
+
+	a_ctrl->v4l2_dev_str.internal_ops =
+		&cam_actuator_internal_ops;
+	a_ctrl->v4l2_dev_str.ops =
+		&cam_actuator_subdev_ops;
+	strlcpy(a_ctrl->device_name, CAMX_ACTUATOR_DEV_NAME,
+		sizeof(a_ctrl->device_name));
+	a_ctrl->v4l2_dev_str.name =
+		a_ctrl->device_name;
+	a_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	a_ctrl->v4l2_dev_str.ent_function =
+		CAM_ACTUATOR_DEVICE_TYPE;
+	a_ctrl->v4l2_dev_str.token = a_ctrl;
+
+	rc = cam_register_subdev(&(a_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "Fail with cam_register_subdev rc: %d", rc);
+
+	return rc;
+}
+
 static int32_t cam_actuator_driver_i2c_probe(struct i2c_client *client,
 	const struct i2c_device_id *id)
 {
 	int32_t rc = 0, i = 0;
 	struct cam_actuator_ctrl_t *a_ctrl;
+	struct cam_hw_soc_info *soc_info = NULL;
 
 	if (client == NULL || id == NULL) {
 		CAM_ERR(CAM_ACTUATOR, "Invalid Args client: %pK id: %pK",
@@ -61,13 +144,29 @@
 
 	i2c_set_clientdata(client, a_ctrl);
 
+	a_ctrl->io_master_info.client = client;
+	soc_info = &a_ctrl->soc_info;
+	soc_info->dev = &client->dev;
+	soc_info->dev_name = client->name;
+	a_ctrl->io_master_info.master_type = I2C_MASTER;
+
+	rc = cam_actuator_parse_dt(a_ctrl, &client->dev);
+	if (rc < 0) {
+		CAM_ERR(CAM_ACTUATOR, "failed: cam_sensor_parse_dt rc %d", rc);
+		goto free_ctrl;
+	}
+
+	rc = cam_actuator_init_subdev(a_ctrl);
+	if (rc)
+		goto free_ctrl;
+
 	a_ctrl->i2c_data.per_frame =
 		(struct i2c_settings_array *)
 		kzalloc(sizeof(struct i2c_settings_array) *
 		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
 	if (a_ctrl->i2c_data.per_frame == NULL) {
 		rc = -ENOMEM;
-		goto free_ctrl;
+		goto unreg_subdev;
 	}
 
 	INIT_LIST_HEAD(&(a_ctrl->i2c_data.init_settings.list_head));
@@ -75,18 +174,28 @@
 	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
 		INIT_LIST_HEAD(&(a_ctrl->i2c_data.per_frame[i].list_head));
 
-	/* Initialize sensor device type */
-	a_ctrl->io_master_info.master_type = I2C_MASTER;
-
-	rc = cam_actuator_parse_dt(a_ctrl, &client->dev);
+	rc = cam_soc_util_request_platform_resource(&a_ctrl->soc_info,
+		NULL, NULL);
 	if (rc < 0) {
-		CAM_ERR(CAM_ACTUATOR, "failed: cam_sensor_parse_dt rc %d", rc);
+		CAM_ERR(CAM_ACTUATOR,
+			"Requesting Platform Resources failed rc %d", rc);
 		goto free_mem;
 	}
 
+	a_ctrl->bridge_intf.device_hdl = -1;
+	a_ctrl->bridge_intf.ops.get_dev_info =
+		cam_actuator_publish_dev_info;
+	a_ctrl->bridge_intf.ops.link_setup =
+		cam_actuator_establish_link;
+	a_ctrl->bridge_intf.ops.apply_req =
+		cam_actuator_apply_request;
+
+	v4l2_set_subdevdata(&(a_ctrl->v4l2_dev_str.sd), a_ctrl);
 	return rc;
 free_mem:
 	kfree(a_ctrl->i2c_data.per_frame);
+unreg_subdev:
+	cam_unregister_subdev(&(a_ctrl->v4l2_dev_str));
 free_ctrl:
 	kfree(a_ctrl);
 	return rc;
@@ -129,63 +238,6 @@
 	return rc;
 }
 
-#ifdef CONFIG_COMPAT
-static long cam_actuator_init_subdev_do_ioctl(struct v4l2_subdev *sd,
-	unsigned int cmd, unsigned long arg)
-{
-	struct cam_control cmd_data;
-	int32_t rc = 0;
-
-	if (copy_from_user(&cmd_data, (void __user *)arg,
-		sizeof(cmd_data))) {
-		CAM_ERR(CAM_ACTUATOR,
-			"Failed to copy from user_ptr=%pK size=%zu\n",
-			(void __user *)arg, sizeof(cmd_data));
-		return -EFAULT;
-	}
-
-	switch (cmd) {
-	case VIDIOC_CAM_CONTROL:
-		cmd = VIDIOC_CAM_CONTROL;
-		rc = cam_actuator_subdev_ioctl(sd, cmd, &cmd_data);
-		if (rc < 0) {
-			CAM_ERR(CAM_ACTUATOR,
-				"Failed in actuator suddev handling");
-			return rc;
-		}
-		break;
-	default:
-		CAM_ERR(CAM_ACTUATOR, "Invalid compat ioctl: %d", cmd);
-		rc = -EINVAL;
-	}
-
-	if (!rc) {
-		if (copy_to_user((void __user *)arg, &cmd_data,
-			sizeof(cmd_data))) {
-			CAM_ERR(CAM_ACTUATOR,
-				"Failed to copy to user_ptr=%pK size=%zu\n",
-				(void __user *)arg, sizeof(cmd_data));
-			rc = -EFAULT;
-		}
-	}
-	return rc;
-}
-
-#endif
-
-static struct v4l2_subdev_core_ops cam_actuator_subdev_core_ops = {
-	.ioctl = cam_actuator_subdev_ioctl,
-#ifdef CONFIG_COMPAT
-	.compat_ioctl32 = cam_actuator_init_subdev_do_ioctl,
-#endif
-};
-
-static struct v4l2_subdev_ops cam_actuator_subdev_ops = {
-	.core = &cam_actuator_subdev_core_ops,
-};
-
-static const struct v4l2_subdev_internal_ops cam_actuator_internal_ops;
-
 static const struct of_device_id cam_actuator_driver_dt_match[] = {
 	{.compatible = "qcom,actuator"},
 	{}
@@ -206,7 +258,8 @@
 	/*fill in platform device*/
 	a_ctrl->v4l2_dev_str.pdev = pdev;
 	a_ctrl->soc_info.pdev = pdev;
-
+	a_ctrl->soc_info.dev = &pdev->dev;
+	a_ctrl->soc_info.dev_name = pdev->name;
 	a_ctrl->io_master_info.master_type = CCI_MASTER;
 
 	a_ctrl->io_master_info.cci_client = kzalloc(sizeof(
@@ -235,32 +288,16 @@
 	/* Fill platform device id*/
 	pdev->id = a_ctrl->id;
 
-	a_ctrl->v4l2_dev_str.internal_ops =
-		&cam_actuator_internal_ops;
-	a_ctrl->v4l2_dev_str.ops =
-		&cam_actuator_subdev_ops;
-	strlcpy(a_ctrl->device_name, CAMX_ACTUATOR_DEV_NAME,
-		sizeof(a_ctrl->device_name));
-	a_ctrl->v4l2_dev_str.name =
-		a_ctrl->device_name;
-	a_ctrl->v4l2_dev_str.sd_flags =
-		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
-	a_ctrl->v4l2_dev_str.ent_function =
-		CAM_ACTUATOR_DEVICE_TYPE;
-	a_ctrl->v4l2_dev_str.token = a_ctrl;
-
-	rc = cam_register_subdev(&(a_ctrl->v4l2_dev_str));
-	if (rc < 0) {
-		CAM_ERR(CAM_ACTUATOR, "Fail with cam_register_subdev");
+	rc = cam_actuator_init_subdev(a_ctrl);
+	if (rc)
 		goto free_mem;
-	}
 
 	rc = cam_soc_util_request_platform_resource(&a_ctrl->soc_info,
 			NULL, NULL);
 	if (rc < 0) {
 		CAM_ERR(CAM_ACTUATOR,
 			"Requesting Platform Resources failed rc %d", rc);
-		goto free_ctrl;
+		goto unreg_subdev;
 	}
 
 	a_ctrl->bridge_intf.device_hdl = -1;
@@ -275,6 +312,8 @@
 	v4l2_set_subdevdata(&a_ctrl->v4l2_dev_str.sd, a_ctrl);
 
 	return rc;
+unreg_subdev:
+	cam_unregister_subdev(&(a_ctrl->v4l2_dev_str));
 free_mem:
 	kfree(a_ctrl->i2c_data.per_frame);
 free_ctrl:
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_soc.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_soc.c
index ddc89a8..f47ec2f 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_soc.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_actuator/cam_actuator_soc.c
@@ -25,15 +25,6 @@
 	int32_t                   rc = 0;
 	struct cam_hw_soc_info *soc_info = &a_ctrl->soc_info;
 	struct device_node *of_node = NULL;
-	struct platform_device *pdev = NULL;
-
-	if (!soc_info->pdev) {
-		CAM_ERR(CAM_ACTUATOR, "soc_info is not initialized");
-		return -EINVAL;
-	}
-
-	pdev = soc_info->pdev;
-	of_node = pdev->dev.of_node;
 
 	/* Initialize mutex */
 	mutex_init(&(a_ctrl->actuator_mutex));
@@ -43,14 +34,19 @@
 		CAM_ERR(CAM_ACTUATOR, "parsing common soc dt(rc %d)", rc);
 		return rc;
 	}
-	rc = of_property_read_u32(of_node, "cci-master",
-		&(a_ctrl->cci_i2c_master));
-	CAM_DBG(CAM_ACTUATOR, "cci-master %d, rc %d",
-		a_ctrl->cci_i2c_master, rc);
-	if (rc < 0 || a_ctrl->cci_i2c_master >= MASTER_MAX) {
-		CAM_ERR(CAM_ACTUATOR, "Wrong info from dt CCI master as : %d",
-			a_ctrl->cci_i2c_master);
-		return rc;
+
+	of_node = soc_info->dev->of_node;
+
+	if (a_ctrl->io_master_info.master_type == CCI_MASTER) {
+		rc = of_property_read_u32(of_node, "cci-master",
+			&(a_ctrl->cci_i2c_master));
+		CAM_DBG(CAM_ACTUATOR, "cci-master %d, rc %d",
+			a_ctrl->cci_i2c_master, rc);
+		if ((rc < 0) || (a_ctrl->cci_i2c_master >= MASTER_MAX)) {
+			CAM_ERR(CAM_ACTUATOR, "Wrong info: dt CCI master:%d",
+				a_ctrl->cci_i2c_master);
+			return rc;
+		}
 	}
 
 	if (!soc_info->gpio_data) {
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c
index dad02bf..6aa7586 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c
@@ -188,6 +188,8 @@
 	new_cci_dev->v4l2_dev_str.pdev = pdev;
 
 	soc_info->pdev = pdev;
+	soc_info->dev = &pdev->dev;
+	soc_info->dev_name = pdev->name;
 
 	rc = cam_cci_parse_dt_info(pdev, new_cci_dev);
 	if (rc < 0) {
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
index fcf76c8..bdd3e72 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
@@ -16,6 +16,9 @@
 #include "cam_csiphy_soc.h"
 #include <cam_mem_mgr.h>
 
+static int cam_csiphy_mem_dmp_param;
+module_param(cam_csiphy_mem_dmp_param, int, 0644);
+
 void cam_csiphy_query_cap(struct csiphy_device *csiphy_dev,
 	struct cam_csiphy_query_cap *csiphy_cap)
 {
@@ -480,6 +483,9 @@
 			goto release_mutex;
 		}
 		rc = cam_csiphy_config_dev(csiphy_dev);
+		if (cam_csiphy_mem_dmp_param == 1)
+			cam_csiphy_mem_dmp(&csiphy_dev->soc_info);
+
 		if (rc < 0) {
 			CAM_ERR(CAM_CSIPHY, "cam_csiphy_config_dev failed");
 			cam_cpas_stop(csiphy_dev->cpas_handle);
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_dev.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_dev.c
index 1c93a1a..6e74344 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_dev.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_dev.c
@@ -113,7 +113,8 @@
 	new_csiphy_dev->v4l2_dev_str.pdev = pdev;
 
 	new_csiphy_dev->soc_info.pdev = pdev;
-
+	new_csiphy_dev->soc_info.dev = &pdev->dev;
+	new_csiphy_dev->soc_info.dev_name = pdev->name;
 	new_csiphy_dev->ref_count = 0;
 
 	rc = cam_csiphy_parse_dt_info(pdev, new_csiphy_dev);
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_soc.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_soc.c
index a79e0d4..506fc0e 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_soc.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_soc.c
@@ -14,7 +14,6 @@
 #include "cam_csiphy_core.h"
 #include "include/cam_csiphy_1_0_hwreg.h"
 
-#ifdef CAM_CSIPHY_MEM_DMP
 int32_t cam_csiphy_mem_dmp(struct cam_hw_soc_info *soc_info)
 {
 	int32_t rc = 0;
@@ -35,7 +34,6 @@
 	}
 	return rc;
 }
-#endif
 
 int32_t cam_csiphy_enable_hw(struct csiphy_device *csiphy_dev)
 {
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
index 96697f9..02b2c51 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c
@@ -617,7 +617,7 @@
 				return -EINVAL;
 			}
 
-			CAM_ERR(CAM_EEPROM, "copy the data, len:%d",
+			CAM_DBG(CAM_EEPROM, "copy the data, len:%d",
 				e_ctrl->cal_data.num_data);
 			memcpy(read_buffer, e_ctrl->cal_data.mapdata,
 					e_ctrl->cal_data.num_data);
@@ -731,7 +731,7 @@
 int32_t cam_eeprom_driver_cmd(struct cam_eeprom_ctrl_t *e_ctrl, void *arg)
 {
 	int                            rc = 0;
-	struct cam_eeprom_query_cap_t  eeprom_cap;
+	struct cam_eeprom_query_cap_t  eeprom_cap = {0};
 	struct cam_control            *cmd = (struct cam_control *)arg;
 
 	if (!e_ctrl) {
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_dev.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_dev.c
index 82dcc9c..9bbc6df 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_dev.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_dev.c
@@ -111,12 +111,34 @@
 	.core = &cam_eeprom_subdev_core_ops,
 };
 
+static int cam_eeprom_init_subdev(struct cam_eeprom_ctrl_t *e_ctrl)
+{
+	int rc = 0;
+
+	e_ctrl->v4l2_dev_str.internal_ops = &cam_eeprom_internal_ops;
+	e_ctrl->v4l2_dev_str.ops = &cam_eeprom_subdev_ops;
+	strlcpy(e_ctrl->device_name, CAM_EEPROM_NAME,
+		sizeof(e_ctrl->device_name));
+	e_ctrl->v4l2_dev_str.name = e_ctrl->device_name;
+	e_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	e_ctrl->v4l2_dev_str.ent_function = CAM_EEPROM_DEVICE_TYPE;
+	e_ctrl->v4l2_dev_str.token = e_ctrl;
+
+	rc = cam_register_subdev(&(e_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "Fail with cam_register_subdev");
+
+	return rc;
+}
+
 static int cam_eeprom_i2c_driver_probe(struct i2c_client *client,
 	 const struct i2c_device_id *id)
 {
 	int                             rc = 0;
 	struct cam_eeprom_ctrl_t       *e_ctrl = NULL;
 	struct cam_eeprom_soc_private  *soc_private = NULL;
+	struct cam_hw_soc_info         *soc_info = NULL;
 
 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
 		CAM_ERR(CAM_EEPROM, "i2c_check_functionality failed");
@@ -129,27 +151,67 @@
 		rc = -ENOMEM;
 		goto probe_failure;
 	}
-	e_ctrl->v4l2_dev_str.ops = &cam_eeprom_subdev_ops;
+
+	i2c_set_clientdata(client, e_ctrl);
+
+	mutex_init(&(e_ctrl->eeprom_mutex));
+
+	soc_info = &e_ctrl->soc_info;
+	soc_info->dev = &client->dev;
+	soc_info->dev_name = client->name;
+	e_ctrl->io_master_info.master_type = I2C_MASTER;
+	e_ctrl->io_master_info.client = client;
+	e_ctrl->eeprom_device_type = MSM_CAMERA_I2C_DEVICE;
+
+	rc = cam_eeprom_parse_dt(e_ctrl);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: soc init rc %d", rc);
+		goto free_soc;
+	}
+
+	rc = cam_eeprom_update_i2c_info(e_ctrl, &soc_private->i2c_info);
+	if (rc) {
+		CAM_ERR(CAM_EEPROM, "failed: to update i2c info rc %d", rc);
+		goto free_soc;
+	}
+
+	if (e_ctrl->userspace_probe == false) {
+		rc = cam_eeprom_parse_read_memory_map(soc_info->dev->of_node,
+			e_ctrl);
+		if (rc) {
+			CAM_ERR(CAM_EEPROM, "failed: read mem map rc %d", rc);
+			goto free_soc;
+		}
+	}
+
 	soc_private = (struct cam_eeprom_soc_private *)(id->driver_data);
 	if (!soc_private) {
 		CAM_ERR(CAM_EEPROM, "board info NULL");
 		rc = -EINVAL;
 		goto ectrl_free;
 	}
+
+	rc = cam_eeprom_init_subdev(e_ctrl);
+	if (rc)
+		goto free_soc;
+
 	e_ctrl->cal_data.mapdata = NULL;
 	e_ctrl->cal_data.map = NULL;
 	e_ctrl->userspace_probe = false;
 
-	e_ctrl->eeprom_device_type = MSM_CAMERA_I2C_DEVICE;
-	e_ctrl->io_master_info.master_type = I2C_MASTER;
-	e_ctrl->io_master_info.client = client;
-
 	if (soc_private->i2c_info.slave_addr != 0)
 		e_ctrl->io_master_info.client->addr =
 			soc_private->i2c_info.slave_addr;
 
-	return rc;
+	e_ctrl->bridge_intf.device_hdl = -1;
+	e_ctrl->bridge_intf.ops.get_dev_info = NULL;
+	e_ctrl->bridge_intf.ops.link_setup = NULL;
+	e_ctrl->bridge_intf.ops.apply_req = NULL;
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, e_ctrl);
 
+	return rc;
+free_soc:
+	kfree(soc_private);
 ectrl_free:
 	kfree(e_ctrl);
 probe_failure:
@@ -194,6 +256,7 @@
 static int cam_eeprom_spi_setup(struct spi_device *spi)
 {
 	struct cam_eeprom_ctrl_t       *e_ctrl = NULL;
+	struct cam_hw_soc_info         *soc_info = NULL;
 	struct cam_sensor_spi_client   *spi_client;
 	struct cam_eeprom_soc_private  *eb_info;
 	struct cam_sensor_power_ctrl_t *power_info = NULL;
@@ -203,6 +266,10 @@
 	if (!e_ctrl)
 		return -ENOMEM;
 
+	soc_info = &e_ctrl->soc_info;
+	soc_info->dev = &spi->dev;
+	soc_info->dev_name = spi->modalias;
+
 	e_ctrl->v4l2_dev_str.ops = &cam_eeprom_subdev_ops;
 	e_ctrl->userspace_probe = false;
 	e_ctrl->cal_data.mapdata = NULL;
@@ -234,14 +301,14 @@
 	/* Initialize mutex */
 	mutex_init(&(e_ctrl->eeprom_mutex));
 
-	rc = cam_eeprom_spi_driver_soc_init(e_ctrl);
+	rc = cam_eeprom_parse_dt(e_ctrl);
 	if (rc) {
 		CAM_ERR(CAM_EEPROM, "failed: spi soc init rc %d", rc);
 		goto board_free;
 	}
 
 	if (e_ctrl->userspace_probe == false) {
-		rc = cam_eeprom_parse_read_memory_map(spi->dev.of_node,
+		rc = cam_eeprom_parse_read_memory_map(soc_info->dev->of_node,
 			e_ctrl);
 		if (rc) {
 			CAM_ERR(CAM_EEPROM, "failed: read mem map rc %d", rc);
@@ -249,6 +316,16 @@
 		}
 	}
 
+	rc = cam_eeprom_init_subdev(e_ctrl);
+	if (rc)
+		goto board_free;
+
+	e_ctrl->bridge_intf.device_hdl = -1;
+	e_ctrl->bridge_intf.ops.get_dev_info = NULL;
+	e_ctrl->bridge_intf.ops.link_setup = NULL;
+	e_ctrl->bridge_intf.ops.apply_req = NULL;
+
+	v4l2_set_subdevdata(&e_ctrl->v4l2_dev_str.sd, e_ctrl);
 	return rc;
 
 board_free:
@@ -317,6 +394,8 @@
 		return -ENOMEM;
 
 	e_ctrl->soc_info.pdev = pdev;
+	e_ctrl->soc_info.dev = &pdev->dev;
+	e_ctrl->soc_info.dev_name = pdev->name;
 	e_ctrl->eeprom_device_type = MSM_CAMERA_PLATFORM_DEVICE;
 	e_ctrl->cal_data.mapdata = NULL;
 	e_ctrl->cal_data.map = NULL;
@@ -338,7 +417,7 @@
 
 	/* Initialize mutex */
 	mutex_init(&(e_ctrl->eeprom_mutex));
-	rc = cam_eeprom_platform_driver_soc_init(e_ctrl);
+	rc = cam_eeprom_parse_dt(e_ctrl);
 	if (rc) {
 		CAM_ERR(CAM_EEPROM, "failed: soc init rc %d", rc);
 		goto free_soc;
@@ -358,21 +437,9 @@
 		}
 	}
 
-	e_ctrl->v4l2_dev_str.internal_ops = &cam_eeprom_internal_ops;
-	e_ctrl->v4l2_dev_str.ops = &cam_eeprom_subdev_ops;
-	strlcpy(e_ctrl->device_name, CAM_EEPROM_NAME,
-		sizeof(e_ctrl->device_name));
-	e_ctrl->v4l2_dev_str.name = e_ctrl->device_name;
-	e_ctrl->v4l2_dev_str.sd_flags =
-		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
-	e_ctrl->v4l2_dev_str.ent_function = CAM_EEPROM_DEVICE_TYPE;
-	e_ctrl->v4l2_dev_str.token = e_ctrl;
-
-	rc = cam_register_subdev(&(e_ctrl->v4l2_dev_str));
-	if (rc) {
-		CAM_ERR(CAM_EEPROM, "fail to create subdev");
+	rc = cam_eeprom_init_subdev(e_ctrl);
+	if (rc)
 		goto free_soc;
-	}
 
 	e_ctrl->bridge_intf.device_hdl = -1;
 	e_ctrl->bridge_intf.ops.get_dev_info = NULL;
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_soc.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_soc.c
index 84e723f..5e12f4a 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_soc.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_soc.c
@@ -121,23 +121,7 @@
 	struct cam_sensor_power_ctrl_t *power_info = &soc_private->power_info;
 	struct device_node             *of_node = NULL;
 
-	if (e_ctrl->eeprom_device_type == MSM_CAMERA_SPI_DEVICE)
-		of_node = e_ctrl->io_master_info.
-			spi_client->spi_master->dev.of_node;
-	else if (e_ctrl->eeprom_device_type == MSM_CAMERA_PLATFORM_DEVICE)
-		of_node = soc_info->pdev->dev.of_node;
-
-	if (!of_node) {
-		CAM_ERR(CAM_EEPROM, "of_node is NULL, device type %d",
-			e_ctrl->eeprom_device_type);
-		return -EINVAL;
-	}
-	rc = cam_soc_util_get_dt_properties(soc_info);
-	if (rc < 0) {
-		CAM_ERR(CAM_EEPROM, "cam_soc_util_get_dt_properties rc %d",
-			rc);
-		return rc;
-	}
+	of_node = soc_info->dev->of_node;
 
 	if (e_ctrl->userspace_probe == false) {
 		rc = cam_get_dt_power_setting_data(of_node,
@@ -209,83 +193,31 @@
 /**
  * @e_ctrl: ctrl structure
  *
- * This function is called from cam_eeprom_spi_driver_probe, it parses
- * the eeprom dt node and decides for userspace or kernel probe.
+ * This function is called from cam_eeprom_platform/i2c/spi_driver_probe
+ * it parses the eeprom dt node and decides for userspace or kernel probe.
  */
-int cam_eeprom_spi_driver_soc_init(struct cam_eeprom_ctrl_t *e_ctrl)
-{
-	int                             rc = 0;
-	struct cam_eeprom_soc_private  *soc_private =
-		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
-
-	rc = of_property_read_u32(e_ctrl->spi->dev.of_node, "cell-index",
-		&e_ctrl->subdev_id);
-	if (rc < 0) {
-		CAM_ERR(CAM_EEPROM, "failed rc %d", rc);
-		return rc;
-	}
-	rc = of_property_read_string(e_ctrl->spi->dev.of_node,
-		"eeprom-name", &soc_private->eeprom_name);
-	if (rc < 0) {
-		CAM_ERR(CAM_EEPROM, "failed rc %d", rc);
-		e_ctrl->userspace_probe = true;
-	}
-
-	CAM_DBG(CAM_EEPROM, "eeprom-name %s, rc %d", soc_private->eeprom_name,
-		rc);
-	rc = cam_eeprom_cmm_dts(soc_private,
-		e_ctrl->io_master_info.spi_client->spi_master->dev.of_node);
-	if (rc < 0)
-		CAM_DBG(CAM_EEPROM, "MM data not available rc %d", rc);
-	rc = cam_eeprom_get_dt_data(e_ctrl);
-	if (rc < 0)
-		CAM_DBG(CAM_EEPROM, "failed: eeprom get dt data rc %d", rc);
-
-	return rc;
-}
-
-/**
- * @e_ctrl: ctrl structure
- *
- * This function is called from cam_eeprom_platform_driver_probe, it parses
- * the eeprom dt node and decides for userspace or kernel probe.
- */
-int cam_eeprom_platform_driver_soc_init(struct cam_eeprom_ctrl_t *e_ctrl)
+int cam_eeprom_parse_dt(struct cam_eeprom_ctrl_t *e_ctrl)
 {
 	int                             rc = 0;
 	struct cam_hw_soc_info         *soc_info = &e_ctrl->soc_info;
 	struct device_node             *of_node = NULL;
-	struct platform_device         *pdev = NULL;
 	struct cam_eeprom_soc_private  *soc_private =
 		(struct cam_eeprom_soc_private *)e_ctrl->soc_info.soc_private;
 	uint32_t                        temp;
 
-	if (!soc_info->pdev) {
-		CAM_ERR(CAM_EEPROM, "Error:soc_info is not initialized");
-		return -EINVAL;
-	}
-
-	pdev = soc_info->pdev;
-	of_node = pdev->dev.of_node;
-	if (!of_node) {
-		CAM_ERR(CAM_EEPROM, "dev.of_node NULL");
-		return -EINVAL;
-	}
-
-	rc = of_property_read_u32(of_node, "cell-index",
-		&e_ctrl->subdev_id);
+	rc = cam_soc_util_get_dt_properties(soc_info);
 	if (rc < 0) {
-		CAM_ERR(CAM_EEPROM, "failed rc %d\n", rc);
+		CAM_ERR(CAM_EEPROM, "Failed to read DT properties rc : %d", rc);
 		return rc;
 	}
 
-	rc = of_property_read_u32(of_node, "cci-master",
-		&e_ctrl->cci_i2c_master);
-	if (rc < 0) {
-		CAM_DBG(CAM_EEPROM, "failed rc %d", rc);
-		return rc;
+	if (!soc_info->dev) {
+		CAM_ERR(CAM_EEPROM, "Dev is NULL");
+		return -EINVAL;
 	}
 
+	of_node = soc_info->dev->of_node;
+
 	rc = of_property_read_string(of_node, "eeprom-name",
 		&soc_private->eeprom_name);
 	if (rc < 0) {
@@ -293,11 +225,27 @@
 		e_ctrl->userspace_probe = true;
 	}
 
+	if (e_ctrl->io_master_info.master_type == CCI_MASTER) {
+		rc = of_property_read_u32(of_node, "cci-master",
+			&e_ctrl->cci_i2c_master);
+		if (rc < 0) {
+			CAM_DBG(CAM_EEPROM, "failed rc %d", rc);
+			return rc;
+		}
+	}
+
+	if (e_ctrl->io_master_info.master_type == SPI_MASTER) {
+		rc = cam_eeprom_cmm_dts(soc_private, soc_info->dev->of_node);
+		if (rc < 0)
+			CAM_DBG(CAM_EEPROM, "MM data not available rc %d", rc);
+	}
+
 	rc = cam_eeprom_get_dt_data(e_ctrl);
 	if (rc < 0)
 		CAM_DBG(CAM_EEPROM, "failed: eeprom get dt data rc %d", rc);
 
-	if (e_ctrl->userspace_probe == false) {
+	if ((e_ctrl->userspace_probe == false) &&
+			(e_ctrl->io_master_info.master_type != SPI_MASTER)) {
 		rc = of_property_read_u32(of_node, "slave-addr", &temp);
 		if (rc < 0)
 			CAM_DBG(CAM_EEPROM, "failed: no slave-addr rc %d", rc);
@@ -319,5 +267,6 @@
 		CAM_DBG(CAM_EEPROM, "slave-addr = 0x%X",
 			soc_private->i2c_info.slave_addr);
 	}
+
 	return rc;
 }
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_soc.h b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_soc.h
index 02e59d7..08c436c 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_soc.h
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_soc.h
@@ -17,6 +17,5 @@
 int cam_eeprom_parse_dt_memory_map(struct device_node *of,
 	struct cam_eeprom_memory_block_t *data);
 
-int cam_eeprom_platform_driver_soc_init(struct cam_eeprom_ctrl_t *e_ctrl);
-int cam_eeprom_spi_driver_soc_init(struct cam_eeprom_ctrl_t *e_ctrl);
+int cam_eeprom_parse_dt(struct cam_eeprom_ctrl_t *e_ctrl);
 #endif/* _CAM_EEPROM_SOC_H_ */
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
index 7af7efc..5c64451 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
@@ -617,6 +617,7 @@
 	info->dev_id = CAM_REQ_MGR_DEVICE_FLASH;
 	strlcpy(info->name, CAM_FLASH_NAME, sizeof(info->name));
 	info->p_delay = CAM_FLASH_PIPELINE_DELAY;
+	info->trigger = CAM_TRIGGER_POINT_EOF;
 	return 0;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_dev.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_dev.c
index 32df2f1..7040ba2 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_dev.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_dev.c
@@ -286,6 +286,8 @@
 
 	flash_ctrl->pdev = pdev;
 	flash_ctrl->soc_info.pdev = pdev;
+	flash_ctrl->soc_info.dev = &pdev->dev;
+	flash_ctrl->soc_info.dev_name = pdev->name;
 
 	rc = cam_flash_get_dt_data(flash_ctrl, &flash_ctrl->soc_info);
 	if (rc) {
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c
index f6e6a9a..75205f9 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_core.c
@@ -588,6 +588,7 @@
 	info->dev_id = CAM_REQ_MGR_DEVICE_SENSOR;
 	strlcpy(info->name, CAM_SENSOR_NAME, sizeof(info->name));
 	info->p_delay = 2;
+	info->trigger = CAM_TRIGGER_POINT_SOF;
 
 	return rc;
 }
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_dev.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_dev.c
index 40cf689..122aa3e 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_dev.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_dev.c
@@ -34,11 +34,91 @@
 	return rc;
 }
 
+#ifdef CONFIG_COMPAT
+static long cam_sensor_init_subdev_do_ioctl(struct v4l2_subdev *sd,
+	unsigned int cmd, unsigned long arg)
+{
+	struct cam_control cmd_data;
+	int32_t rc = 0;
+
+	if (copy_from_user(&cmd_data, (void __user *)arg,
+		sizeof(cmd_data))) {
+		CAM_ERR(CAM_SENSOR, "Failed to copy from user_ptr=%pK size=%zu",
+			(void __user *)arg, sizeof(cmd_data));
+		return -EFAULT;
+	}
+
+	switch (cmd) {
+	case VIDIOC_CAM_CONTROL:
+		rc = cam_sensor_subdev_ioctl(sd, cmd, &cmd_data);
+		if (rc < 0)
+			CAM_ERR(CAM_SENSOR, "cam_sensor_subdev_ioctl failed");
+			break;
+	default:
+		CAM_ERR(CAM_SENSOR, "Invalid compat ioctl cmd_type: %d", cmd);
+		rc = -EINVAL;
+	}
+
+	if (!rc) {
+		if (copy_to_user((void __user *)arg, &cmd_data,
+			sizeof(cmd_data))) {
+			CAM_ERR(CAM_SENSOR,
+				"Failed to copy to user_ptr=%pK size=%zu",
+				(void __user *)arg, sizeof(cmd_data));
+			rc = -EFAULT;
+		}
+	}
+
+	return rc;
+}
+
+#endif
+static struct v4l2_subdev_core_ops cam_sensor_subdev_core_ops = {
+	.ioctl = cam_sensor_subdev_ioctl,
+#ifdef CONFIG_COMPAT
+	.compat_ioctl32 = cam_sensor_init_subdev_do_ioctl,
+#endif
+	.s_power = cam_sensor_power,
+};
+
+static struct v4l2_subdev_ops cam_sensor_subdev_ops = {
+	.core = &cam_sensor_subdev_core_ops,
+};
+
+static const struct v4l2_subdev_internal_ops cam_sensor_internal_ops;
+
+static int cam_sensor_init_subdev_params(struct cam_sensor_ctrl_t *s_ctrl)
+{
+	int rc = 0;
+
+	s_ctrl->v4l2_dev_str.internal_ops =
+		&cam_sensor_internal_ops;
+	s_ctrl->v4l2_dev_str.ops =
+		&cam_sensor_subdev_ops;
+	strlcpy(s_ctrl->device_name, CAMX_SENSOR_DEV_NAME,
+		sizeof(s_ctrl->device_name));
+	s_ctrl->v4l2_dev_str.name =
+		s_ctrl->device_name;
+	s_ctrl->v4l2_dev_str.sd_flags =
+		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
+	s_ctrl->v4l2_dev_str.ent_function =
+		CAM_SENSOR_DEVICE_TYPE;
+	s_ctrl->v4l2_dev_str.token = s_ctrl;
+
+	rc = cam_register_subdev(&(s_ctrl->v4l2_dev_str));
+	if (rc)
+		CAM_ERR(CAM_SENSOR, "Fail with cam_register_subdev rc: %d", rc);
+
+	return rc;
+}
+
 static int32_t cam_sensor_driver_i2c_probe(struct i2c_client *client,
 	const struct i2c_device_id *id)
 {
 	int32_t rc = 0;
-	struct cam_sensor_ctrl_t *s_ctrl;
+	int i = 0;
+	struct cam_sensor_ctrl_t *s_ctrl = NULL;
+	struct cam_hw_soc_info   *soc_info = NULL;
 
 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
 		CAM_ERR(CAM_SENSOR,
@@ -53,9 +133,15 @@
 
 	i2c_set_clientdata(client, s_ctrl);
 
+	s_ctrl->io_master_info.client = client;
+	soc_info = &s_ctrl->soc_info;
+	soc_info->dev = &client->dev;
+	soc_info->dev_name = client->name;
+
 	/* Initialize sensor device type */
 	s_ctrl->of_node = client->dev.of_node;
 	s_ctrl->io_master_info.master_type = I2C_MASTER;
+	s_ctrl->is_probe_succeed = 0;
 
 	rc = cam_sensor_parse_dt(s_ctrl);
 	if (rc < 0) {
@@ -63,7 +149,35 @@
 		goto free_s_ctrl;
 	}
 
+	rc = cam_sensor_init_subdev_params(s_ctrl);
+	if (rc)
+		goto free_s_ctrl;
+
+	s_ctrl->i2c_data.per_frame =
+		(struct i2c_settings_array *)
+		kzalloc(sizeof(struct i2c_settings_array) *
+		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
+	if (s_ctrl->i2c_data.per_frame == NULL) {
+		rc = -ENOMEM;
+		goto unreg_subdev;
+	}
+
+	INIT_LIST_HEAD(&(s_ctrl->i2c_data.init_settings.list_head));
+
+	for (i = 0; i < MAX_PER_FRAME_ARRAY; i++)
+		INIT_LIST_HEAD(&(s_ctrl->i2c_data.per_frame[i].list_head));
+
+	s_ctrl->bridge_intf.device_hdl = -1;
+	s_ctrl->bridge_intf.ops.get_dev_info = cam_sensor_publish_dev_info;
+	s_ctrl->bridge_intf.ops.link_setup = cam_sensor_establish_link;
+	s_ctrl->bridge_intf.ops.apply_req = cam_sensor_apply_request;
+	s_ctrl->bridge_intf.ops.flush_req = cam_sensor_flush_request;
+
+	s_ctrl->sensordata->power_info.dev = soc_info->dev;
+	v4l2_set_subdevdata(&(s_ctrl->v4l2_dev_str.sd), s_ctrl);
 	return rc;
+unreg_subdev:
+	cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
 free_s_ctrl:
 	kfree(s_ctrl);
 	return rc;
@@ -100,59 +214,6 @@
 	return 0;
 }
 
-#ifdef CONFIG_COMPAT
-static long cam_sensor_init_subdev_do_ioctl(struct v4l2_subdev *sd,
-	unsigned int cmd, unsigned long arg)
-{
-	struct cam_control cmd_data;
-	int32_t rc = 0;
-
-	if (copy_from_user(&cmd_data, (void __user *)arg,
-		sizeof(cmd_data))) {
-		CAM_ERR(CAM_SENSOR, "Failed to copy from user_ptr=%pK size=%zu",
-			(void __user *)arg, sizeof(cmd_data));
-		return -EFAULT;
-	}
-
-	switch (cmd) {
-	case VIDIOC_CAM_CONTROL:
-		rc = cam_sensor_subdev_ioctl(sd, cmd, &cmd_data);
-		if (rc < 0)
-			CAM_ERR(CAM_SENSOR, "cam_sensor_subdev_ioctl failed");
-		break;
-	default:
-		CAM_ERR(CAM_SENSOR, "Invalid compat ioctl cmd_type: %d", cmd);
-		rc = -EINVAL;
-	}
-
-	if (!rc) {
-		if (copy_to_user((void __user *)arg, &cmd_data,
-			sizeof(cmd_data))) {
-			CAM_ERR(CAM_SENSOR,
-				"Failed to copy to user_ptr=%pK size=%zu",
-				(void __user *)arg, sizeof(cmd_data));
-			rc = -EFAULT;
-		}
-	}
-	return rc;
-}
-
-#endif
-
-static struct v4l2_subdev_core_ops cam_sensor_subdev_core_ops = {
-	.ioctl = cam_sensor_subdev_ioctl,
-#ifdef CONFIG_COMPAT
-	.compat_ioctl32 = cam_sensor_init_subdev_do_ioctl,
-#endif
-	.s_power = cam_sensor_power,
-};
-
-static struct v4l2_subdev_ops cam_sensor_subdev_ops = {
-	.core = &cam_sensor_subdev_core_ops,
-};
-
-static const struct v4l2_subdev_internal_ops cam_sensor_internal_ops;
-
 static const struct of_device_id cam_sensor_driver_dt_match[] = {
 	{.compatible = "qcom,cam-sensor"},
 	{}
@@ -173,6 +234,8 @@
 
 	soc_info = &s_ctrl->soc_info;
 	soc_info->pdev = pdev;
+	soc_info->dev = &pdev->dev;
+	soc_info->dev_name = pdev->name;
 
 	/* Initialize sensor device type */
 	s_ctrl->of_node = pdev->dev.of_node;
@@ -192,25 +255,9 @@
 	/* Fill platform device id*/
 	pdev->id = soc_info->index;
 
-	s_ctrl->v4l2_dev_str.internal_ops =
-		&cam_sensor_internal_ops;
-	s_ctrl->v4l2_dev_str.ops =
-		&cam_sensor_subdev_ops;
-	strlcpy(s_ctrl->device_name, CAMX_SENSOR_DEV_NAME,
-		sizeof(s_ctrl->device_name));
-	s_ctrl->v4l2_dev_str.name =
-		s_ctrl->device_name;
-	s_ctrl->v4l2_dev_str.sd_flags =
-		(V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS);
-	s_ctrl->v4l2_dev_str.ent_function =
-		CAM_SENSOR_DEVICE_TYPE;
-	s_ctrl->v4l2_dev_str.token = s_ctrl;
-
-	rc = cam_register_subdev(&(s_ctrl->v4l2_dev_str));
-	if (rc < 0) {
-		CAM_ERR(CAM_SENSOR, "Fail with cam_register_subdev");
+	rc = cam_sensor_init_subdev_params(s_ctrl);
+	if (rc)
 		goto free_s_ctrl;
-	}
 
 	s_ctrl->i2c_data.per_frame =
 		(struct i2c_settings_array *)
@@ -218,7 +265,7 @@
 		MAX_PER_FRAME_ARRAY, GFP_KERNEL);
 	if (s_ctrl->i2c_data.per_frame == NULL) {
 		rc = -ENOMEM;
-		goto free_s_ctrl;
+		goto unreg_subdev;
 	}
 
 	INIT_LIST_HEAD(&(s_ctrl->i2c_data.init_settings.list_head));
@@ -237,6 +284,8 @@
 	v4l2_set_subdevdata(&(s_ctrl->v4l2_dev_str.sd), s_ctrl);
 
 	return rc;
+unreg_subdev:
+	cam_unregister_subdev(&(s_ctrl->v4l2_dev_str));
 free_s_ctrl:
 	devm_kfree(&pdev->dev, s_ctrl);
 	return rc;
@@ -273,9 +322,12 @@
 	int32_t rc = 0;
 
 	rc = platform_driver_register(&cam_sensor_platform_driver);
-	if (rc)
-		CAM_ERR(CAM_SENSOR, "platform_driver_register failed rc = %d",
+	if (rc < 0) {
+		CAM_ERR(CAM_SENSOR, "platform_driver_register Failed: rc = %d",
 			rc);
+		return rc;
+	}
+
 	rc = i2c_add_driver(&cam_sensor_driver_i2c);
 	if (rc)
 		CAM_ERR(CAM_SENSOR, "i2c_add_driver failed rc = %d", rc);
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_soc.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_soc.c
index c10d634..1c3ead0 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_soc.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor/cam_sensor_soc.c
@@ -143,14 +143,17 @@
 		goto FREE_SENSOR_DATA;
 	}
 
-	/* Get CCI master */
-	rc = of_property_read_u32(of_node, "cci-master",
-		&s_ctrl->cci_i2c_master);
-	CAM_DBG(CAM_SENSOR, "cci-master %d, rc %d", s_ctrl->cci_i2c_master, rc);
-	if (rc < 0) {
-		/* Set default master 0 */
-		s_ctrl->cci_i2c_master = MASTER_0;
-		rc = 0;
+	if (s_ctrl->io_master_info.master_type == CCI_MASTER) {
+		/* Get CCI master */
+		rc = of_property_read_u32(of_node, "cci-master",
+			&s_ctrl->cci_i2c_master);
+		CAM_DBG(CAM_SENSOR, "cci-master %d, rc %d",
+			s_ctrl->cci_i2c_master, rc);
+		if (rc < 0) {
+			/* Set default master 0 */
+			s_ctrl->cci_i2c_master = MASTER_0;
+			rc = 0;
+		}
 	}
 
 	if (of_property_read_u32(of_node, "sensor-position-pitch",
@@ -194,6 +197,9 @@
 		if (!(s_ctrl->io_master_info.cci_client))
 			return -ENOMEM;
 
+	} else if (s_ctrl->io_master_info.master_type == I2C_MASTER) {
+		if (!(s_ctrl->io_master_info.client))
+			return -EINVAL;
 	} else {
 		CAM_ERR(CAM_SENSOR,
 			"Invalid master / Master type Not supported");
@@ -220,7 +226,7 @@
 
 	/* Initialize default parameters */
 	for (i = 0; i < soc_info->num_clk; i++) {
-		soc_info->clk[i] = devm_clk_get(&soc_info->pdev->dev,
+		soc_info->clk[i] = devm_clk_get(soc_info->dev,
 					soc_info->clk_name[i]);
 		if (!soc_info->clk[i]) {
 			CAM_ERR(CAM_SENSOR, "get failed for %s",
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_io/cam_sensor_io.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_io/cam_sensor_io.c
index 154f4ad..f0142e7 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_io/cam_sensor_io.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_io/cam_sensor_io.c
@@ -104,6 +104,9 @@
 	} else if (io_master_info->master_type == I2C_MASTER) {
 		return cam_qup_i2c_write_table(io_master_info,
 			write_setting);
+	} else if (io_master_info->master_type == SPI_MASTER) {
+		return cam_spi_write_table(io_master_info,
+			write_setting);
 	} else {
 		CAM_ERR(CAM_SENSOR, "Invalid Comm. Master:%d",
 			io_master_info->master_type);
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
index b1698ca..878ce73 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_sensor_utils/cam_sensor_util.c
@@ -340,6 +340,14 @@
 	}
 
 	for (i = 0; i < power_setting_size; i++) {
+
+		if (power_setting[i].seq_type < SENSOR_MCLK ||
+			power_setting[i].seq_type >= SENSOR_SEQ_TYPE_MAX) {
+			CAM_ERR(CAM_SENSOR, "failed: Invalid Seq type\n",
+				power_setting[i].seq_type);
+			return -EINVAL;
+		}
+
 		switch (power_setting[i].seq_type) {
 		case SENSOR_VDIG:
 			for (j = 0; j < num_vreg; j++) {
@@ -488,12 +496,8 @@
 			if (j == num_vreg)
 				power_setting[i].seq_val = INVALID_VREG;
 			break;
-
-		default: {
-			CAM_ERR(CAM_SENSOR, "invalid seq_val %d",
-				power_setting[i].seq_val);
+		default:
 			break;
-			}
 		}
 	}
 
@@ -507,15 +511,21 @@
 	uint8_t size = 0;
 	struct cam_soc_gpio_data *gpio_conf =
 			soc_info->gpio_data;
-	struct gpio *gpio_tbl = gpio_conf->cam_gpio_req_tbl;
+	struct gpio *gpio_tbl = NULL;
 
-	size = gpio_conf->cam_gpio_req_tbl_size;
+	if (!gpio_conf) {
+		CAM_INFO(CAM_SENSOR, "No GPIO data");
+		return 0;
+	}
 
 	if (gpio_conf->cam_gpio_common_tbl_size <= 0) {
 		CAM_INFO(CAM_SENSOR, "No GPIO entry");
-		return 0;
+		return -EINVAL;
 	}
 
+	gpio_tbl = gpio_conf->cam_gpio_req_tbl;
+	size = gpio_conf->cam_gpio_req_tbl_size;
+
 	if (!gpio_tbl || !size) {
 		CAM_ERR(CAM_SENSOR, "invalid gpio_tbl %pK / size %d",
 			gpio_tbl, size);
@@ -857,13 +867,16 @@
 {
 	int rc = 0, val = 0;
 	uint32_t gpio_array_size;
-	struct platform_device *pdev = NULL;
 	struct device_node *of_node = NULL;
 	struct cam_soc_gpio_data *gconf = NULL;
 	struct msm_camera_gpio_num_info *gpio_num_info = NULL;
 
-	pdev = soc_info->pdev;
-	of_node = pdev->dev.of_node;
+	if (!soc_info->dev) {
+		CAM_ERR(CAM_SENSOR, "device node NULL");
+		return -EINVAL;
+	}
+
+	of_node = soc_info->dev->of_node;
 
 	gconf = soc_info->gpio_data;
 	if (!gconf) {
@@ -1096,8 +1109,8 @@
 	int gpio_offset = -1;
 
 	if (!gpio_num_info) {
-		CAM_ERR(CAM_SENSOR, "Input Parameters are not proper");
-		return -EINVAL;
+		CAM_INFO(CAM_SENSOR, "Input Parameters are not proper");
+		return 0;
 	}
 
 	CAM_DBG(CAM_SENSOR, "Seq type: %d, config: %d", seq_type, val);
@@ -1177,7 +1190,7 @@
 
 					soc_info->rgltr[j] =
 					regulator_get(
-						&soc_info->pdev->dev,
+						soc_info->dev,
 						soc_info->rgltr_name[j]);
 
 					if (IS_ERR_OR_NULL(
@@ -1270,7 +1283,7 @@
 				vreg_idx = power_setting->seq_val;
 
 				soc_info->rgltr[vreg_idx] =
-					regulator_get(&soc_info->pdev->dev,
+					regulator_get(soc_info->dev,
 						soc_info->rgltr_name[vreg_idx]);
 				if (IS_ERR_OR_NULL(
 					soc_info->rgltr[vreg_idx])) {
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
index a1cdfe9..4323358 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
@@ -182,3 +182,78 @@
 	return rc;
 }
 
+int cam_packet_util_process_generic_cmd_buffer(
+	struct cam_cmd_buf_desc *cmd_buf,
+	cam_packet_generic_blob_handler blob_handler_cb, void *user_data)
+{
+	int       rc;
+	uint64_t  cpu_addr;
+	size_t    buf_size;
+	uint32_t *blob_ptr;
+	uint32_t  blob_type, blob_size, blob_block_size, len_read;
+
+	if (!cmd_buf || !blob_handler_cb) {
+		CAM_ERR(CAM_UTIL, "Invalid args %pK %pK",
+			cmd_buf, blob_handler_cb);
+		return -EINVAL;
+	}
+
+	if (!cmd_buf->length || !cmd_buf->size) {
+		CAM_ERR(CAM_UTIL, "Invalid cmd buf size %d %d",
+			cmd_buf->length, cmd_buf->size);
+		return -EINVAL;
+	}
+
+	rc = cam_mem_get_cpu_buf(cmd_buf->mem_handle, &cpu_addr, &buf_size);
+	if (rc || !cpu_addr || (buf_size == 0)) {
+		CAM_ERR(CAM_UTIL, "Failed in Get cpu addr, rc=%d, cpu_addr=%pK",
+			rc, cpu_addr);
+		return rc;
+	}
+
+	blob_ptr = (uint32_t *)((uint8_t *)cpu_addr + cmd_buf->offset);
+
+	CAM_DBG(CAM_UTIL,
+		"GenericCmdBuffer cpuaddr=%pK, blobptr=%pK, len=%d",
+		cpu_addr, blob_ptr, cmd_buf->length);
+
+	len_read = 0;
+	while (len_read < cmd_buf->length) {
+		blob_type =
+			((*blob_ptr) & CAM_GENERIC_BLOB_CMDBUFFER_TYPE_MASK) >>
+			CAM_GENERIC_BLOB_CMDBUFFER_TYPE_SHIFT;
+		blob_size =
+			((*blob_ptr) & CAM_GENERIC_BLOB_CMDBUFFER_SIZE_MASK) >>
+			CAM_GENERIC_BLOB_CMDBUFFER_SIZE_SHIFT;
+
+		blob_block_size = sizeof(uint32_t) +
+			(((blob_size + sizeof(uint32_t) - 1) /
+			sizeof(uint32_t)) * sizeof(uint32_t));
+
+		CAM_DBG(CAM_UTIL,
+			"Blob type=%d size=%d block_size=%d len_read=%d total=%d",
+			blob_type, blob_size, blob_block_size, len_read,
+			cmd_buf->length);
+
+		if (len_read + blob_block_size > cmd_buf->length) {
+			CAM_ERR(CAM_UTIL, "Invalid Blob %d %d %d %d",
+				blob_type, blob_size, len_read,
+				cmd_buf->length);
+			return -EINVAL;
+		}
+
+		len_read += blob_block_size;
+
+		rc = blob_handler_cb(user_data, blob_type, blob_size,
+			(uint8_t *)(blob_ptr + 1));
+		if (rc) {
+			CAM_ERR(CAM_UTIL, "Error in handling blob type %d %d",
+				blob_type, blob_size);
+			return rc;
+		}
+
+		blob_ptr += (blob_block_size / sizeof(uint32_t));
+	}
+
+	return 0;
+}
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.h b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.h
index 8b590a7..2fa7585 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.h
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.h
@@ -33,6 +33,10 @@
 	uint32_t   used_bytes;
 };
 
+/* Generic Cmd Buffer blob callback function type */
+typedef int (*cam_packet_generic_blob_handler)(void *user_data,
+	uint32_t blob_type, uint32_t blob_size, uint8_t *blob_data);
+
 /**
  * cam_packet_util_validate_packet()
  *
@@ -86,4 +90,24 @@
 int cam_packet_util_process_patches(struct cam_packet *packet,
 	int32_t iommu_hdl);
 
+/**
+ * cam_packet_util_process_generic_cmd_buffer()
+ *
+ * @brief:              Process Generic Blob command buffer. This utility
+ *                      function process the command buffer and calls the
+ *                      blob_handle_cb callback for each blob that exists
+ *                      in the command buffer.
+ *
+ * @cmd_buf:            Generic Blob Cmd Buffer handle
+ * @blob_handler_cb:    Callback pointer to call for each blob exists in the
+ *                      command buffer
+ * @user_data:          User data to be passed while callback
+ *
+ * @return:             0: Success
+ *                      Negative: Failure
+ */
+int cam_packet_util_process_generic_cmd_buffer(
+	struct cam_cmd_buf_desc *cmd_buf,
+	cam_packet_generic_blob_handler blob_handler_cb, void *user_data);
+
 #endif /* _CAM_PACKET_UTIL_H_ */
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_soc_util.c b/drivers/media/platform/msm/camera/cam_utils/cam_soc_util.c
index e5c7dbb..743dfda 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_soc_util.c
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_soc_util.c
@@ -315,17 +315,14 @@
 	int num_clk_rates, num_clk_levels;
 	int i, j, rc;
 	int32_t num_clk_level_strings;
-	struct platform_device *pdev = NULL;
 	const char *src_clk_str = NULL;
 	const char *clk_cntl_lvl_string = NULL;
 	enum cam_vote_level level;
 
-	if (!soc_info || !soc_info->pdev)
+	if (!soc_info || !soc_info->dev)
 		return -EINVAL;
 
-	pdev = soc_info->pdev;
-
-	of_node = pdev->dev.of_node;
+	of_node = soc_info->dev->of_node;
 
 	count = of_property_count_strings(of_node, "clock-names");
 
@@ -563,13 +560,11 @@
 	int16_t gpio_array_size = 0;
 	struct cam_soc_gpio_data *gconf = NULL;
 	struct device_node *of_node = NULL;
-	struct platform_device *pdev = NULL;
 
-	if (!soc_info || !soc_info->pdev)
+	if (!soc_info || !soc_info->dev)
 		return -EINVAL;
 
-	pdev = soc_info->pdev;
-	of_node = pdev->dev.of_node;
+	of_node = soc_info->dev->of_node;
 
 	/* Validate input parameters */
 	if (!of_node) {
@@ -685,15 +680,13 @@
 {
 	int rc = 0, count = 0, i = 0;
 	struct device_node *of_node = NULL;
-	struct platform_device *pdev = NULL;
 
-	if (!soc_info || !soc_info->pdev) {
+	if (!soc_info || !soc_info->dev) {
 		CAM_ERR(CAM_UTIL, "Invalid parameters");
 		return -EINVAL;
 	}
 
-	pdev = soc_info->pdev;
-	of_node = pdev->dev.of_node;
+	of_node = soc_info->dev->of_node;
 
 	soc_info->num_rgltr = 0;
 	count = of_property_count_strings(of_node, "regulator-names");
@@ -758,20 +751,19 @@
 {
 	struct device_node *of_node = NULL;
 	int count = 0, i = 0, rc = 0;
-	struct platform_device *pdev = NULL;
 
-	if (!soc_info || !soc_info->pdev)
+	if (!soc_info || !soc_info->dev)
 		return -EINVAL;
 
-	pdev = soc_info->pdev;
-	of_node = pdev->dev.of_node;
+	of_node = soc_info->dev->of_node;
 
 	rc = of_property_read_u32(of_node, "cell-index", &soc_info->index);
 	if (rc) {
 		CAM_ERR(CAM_UTIL, "device %s failed to read cell-index",
-			pdev->name);
+			soc_info->dev_name);
 		return rc;
 	}
+
 	count = of_property_count_strings(of_node, "reg-names");
 	if (count <= 0) {
 		CAM_ERR(CAM_UTIL, "no reg-names found");
@@ -787,8 +779,8 @@
 			return rc;
 		}
 		soc_info->mem_block[i] =
-			platform_get_resource_byname(pdev, IORESOURCE_MEM,
-			soc_info->mem_block_name[i]);
+			platform_get_resource_byname(soc_info->pdev,
+			IORESOURCE_MEM, soc_info->mem_block_name[i]);
 
 		if (!soc_info->mem_block[i]) {
 			CAM_ERR(CAM_UTIL, "no mem resource by name %s",
@@ -813,7 +805,8 @@
 		CAM_WARN(CAM_UTIL, "No interrupt line present");
 		rc = 0;
 	} else {
-		soc_info->irq_line = platform_get_resource_byname(pdev,
+		soc_info->irq_line =
+			platform_get_resource_byname(soc_info->pdev,
 			IORESOURCE_IRQ, soc_info->irq_name);
 		if (!soc_info->irq_line) {
 			CAM_ERR(CAM_UTIL, "no irq resource");
@@ -842,17 +835,17 @@
  *
  * @brief:              Get regulator resource named vdd
  *
- * @pdev:               Platform device associated with regulator
+ * @dev:                Device associated with regulator
  * @reg:                Return pointer to be filled with regulator on success
  * @rgltr_name:         Name of regulator to get
  *
  * @return:             0 for Success, negative value for failure
  */
-static int cam_soc_util_get_regulator(struct platform_device *pdev,
+static int cam_soc_util_get_regulator(struct device *dev,
 	struct regulator **reg, const char *rgltr_name)
 {
 	int rc = 0;
-	*reg = regulator_get(&pdev->dev, rgltr_name);
+	*reg = regulator_get(dev, rgltr_name);
 	if (IS_ERR_OR_NULL(*reg)) {
 		rc = PTR_ERR(*reg);
 		rc = rc ? rc : -EINVAL;
@@ -945,7 +938,7 @@
 	struct cam_hw_soc_info *soc_info) {
 
 	struct cam_soc_pinctrl_info *device_pctrl = &soc_info->pinctrl_info;
-	struct device *dev = &soc_info->pdev->dev;
+	struct device *dev = soc_info->dev;
 
 	device_pctrl->pinctrl = devm_pinctrl_get(dev);
 	if (IS_ERR_OR_NULL(device_pctrl->pinctrl)) {
@@ -1046,23 +1039,19 @@
 	irq_handler_t handler, void *irq_data)
 {
 	int i = 0, rc = 0;
-	struct platform_device *pdev = NULL;
 
-
-	if (!soc_info || !soc_info->pdev) {
+	if (!soc_info || !soc_info->dev) {
 		CAM_ERR(CAM_UTIL, "Invalid parameters");
 		return -EINVAL;
 	}
 
-	pdev = soc_info->pdev;
-
 	for (i = 0; i < soc_info->num_mem_block; i++) {
 		if (soc_info->reserve_mem) {
 			if (!request_mem_region(soc_info->mem_block[i]->start,
 				resource_size(soc_info->mem_block[i]),
 				soc_info->mem_block_name[i])){
 				CAM_ERR(CAM_UTIL,
-					"Error Mem Region request Failed:%s",
+					"Error Mem region request Failed:%s",
 					soc_info->mem_block_name[i]);
 				rc = -ENOMEM;
 				goto unmap_base;
@@ -1089,14 +1078,15 @@
 			goto put_regulator;
 		}
 
-		rc = cam_soc_util_get_regulator(pdev, &soc_info->rgltr[i],
+		rc = cam_soc_util_get_regulator(soc_info->dev,
+			&soc_info->rgltr[i],
 			soc_info->rgltr_name[i]);
 		if (rc)
 			goto put_regulator;
 	}
 
 	if (soc_info->irq_line) {
-		rc = devm_request_irq(&pdev->dev, soc_info->irq_line->start,
+		rc = devm_request_irq(soc_info->dev, soc_info->irq_line->start,
 			handler, IRQF_TRIGGER_RISING,
 			soc_info->irq_name, irq_data);
 		if (rc) {
@@ -1110,7 +1100,7 @@
 
 	/* Get Clock */
 	for (i = 0; i < soc_info->num_clk; i++) {
-		soc_info->clk[i] = clk_get(&soc_info->pdev->dev,
+		soc_info->clk[i] = clk_get(soc_info->dev,
 			soc_info->clk_name[i]);
 		if (!soc_info->clk[i]) {
 			CAM_ERR(CAM_UTIL, "get failed for %s",
@@ -1144,7 +1134,7 @@
 
 	if (soc_info->irq_line) {
 		disable_irq(soc_info->irq_line->start);
-		devm_free_irq(&soc_info->pdev->dev,
+		devm_free_irq(soc_info->dev,
 			soc_info->irq_line->start, irq_data);
 	}
 
@@ -1177,16 +1167,12 @@
 int cam_soc_util_release_platform_resource(struct cam_hw_soc_info *soc_info)
 {
 	int i;
-	struct platform_device *pdev = NULL;
 
-	if (!soc_info || !soc_info->pdev) {
+	if (!soc_info || !soc_info->dev) {
 		CAM_ERR(CAM_UTIL, "Invalid parameter");
 		return -EINVAL;
 	}
 
-
-	pdev = soc_info->pdev;
-
 	for (i = soc_info->num_clk - 1; i >= 0; i--) {
 		clk_put(soc_info->clk[i]);
 		soc_info->clk[i] = NULL;
@@ -1207,7 +1193,7 @@
 
 	if (soc_info->irq_line) {
 		disable_irq(soc_info->irq_line->start);
-		devm_free_irq(&soc_info->pdev->dev,
+		devm_free_irq(soc_info->dev,
 			soc_info->irq_line->start, soc_info->irq_data);
 	}
 
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_soc_util.h b/drivers/media/platform/msm/camera/cam_utils/cam_soc_util.h
index ae92cab..86c2737 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_soc_util.h
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_soc_util.h
@@ -18,6 +18,8 @@
 #include <linux/io.h>
 #include <linux/delay.h>
 #include <linux/platform_device.h>
+#include <linux/i2c.h>
+#include <linux/spi/spi.h>
 #include <linux/regulator/consumer.h>
 #include <linux/clk/qcom.h>
 
@@ -113,8 +115,10 @@
  *                          Camera hardware driver module
  *
  * @pdev:                   Platform device pointer
+ * @device:                 Device pointer
  * @hw_version:             Camera device version
  * @index:                  Instance id for the camera device
+ * @dev_name:               Device Name
  * @irq_name:               Name of the irq associated with the device
  * @irq_line:               Irq resource
  * @irq_data:               Private data that is passed when IRQ is requested
@@ -147,12 +151,13 @@
  * @gpio_data:              Pointer to gpio info
  * @pinctrl_info:           Pointer to pinctrl info
  * @soc_private:            Soc private data
- *
  */
 struct cam_hw_soc_info {
 	struct platform_device         *pdev;
+	struct device                  *dev;
 	uint32_t                        hw_version;
 	uint32_t                        index;
+	const char                     *dev_name;
 	const char                     *irq_name;
 	struct resource                *irq_line;
 	void                           *irq_data;
diff --git a/include/uapi/media/Kbuild b/include/uapi/media/Kbuild
index 4ded0a4..e72a1f0 100644
--- a/include/uapi/media/Kbuild
+++ b/include/uapi/media/Kbuild
@@ -1,5 +1,6 @@
 header-y += cam_cpas.h
 header-y += cam_defs.h
+header-y += cam_fd.h
 header-y += cam_icp.h
 header-y += cam_isp.h
 header-y += cam_isp_vfe.h
diff --git a/include/uapi/media/cam_defs.h b/include/uapi/media/cam_defs.h
index 5f0f070..fdc56ee 100644
--- a/include/uapi/media/cam_defs.h
+++ b/include/uapi/media/cam_defs.h
@@ -21,6 +21,12 @@
 #define CAM_HANDLE_USER_POINTER                 1
 #define CAM_HANDLE_MEM_HANDLE                   2
 
+/* Generic Blob CmdBuffer header properties */
+#define CAM_GENERIC_BLOB_CMDBUFFER_SIZE_MASK    0xFFFFFF00
+#define CAM_GENERIC_BLOB_CMDBUFFER_SIZE_SHIFT   8
+#define CAM_GENERIC_BLOB_CMDBUFFER_TYPE_MASK    0xFF
+#define CAM_GENERIC_BLOB_CMDBUFFER_TYPE_SHIFT   0
+
 /**
  * struct cam_control - Structure used by ioctl control for camera
  *
diff --git a/include/uapi/media/cam_fd.h b/include/uapi/media/cam_fd.h
new file mode 100644
index 0000000..8feb6e4
--- /dev/null
+++ b/include/uapi/media/cam_fd.h
@@ -0,0 +1,127 @@
+#ifndef __UAPI_CAM_FD_H__
+#define __UAPI_CAM_FD_H__
+
+#include "cam_defs.h"
+
+#define CAM_FD_MAX_FACES                       35
+#define CAM_FD_RAW_RESULT_ENTRIES              512
+
+/* FD Op Codes */
+#define CAM_PACKET_OPCODES_FD_FRAME_UPDATE     0x0
+
+/* FD Command Buffer identifiers */
+#define CAM_FD_CMD_BUFFER_ID_GENERIC           0x0
+#define CAM_FD_CMD_BUFFER_ID_CDM               0x1
+#define CAM_FD_CMD_BUFFER_ID_MAX               0x2
+
+/* FD Blob types */
+#define CAM_FD_BLOB_TYPE_SOC_CLOCK_BW_REQUEST  0x0
+#define CAM_FD_BLOB_TYPE_RAW_RESULTS_REQUIRED  0x1
+
+/* FD Resource IDs */
+#define CAM_FD_INPUT_PORT_ID_IMAGE             0x0
+#define CAM_FD_INPUT_PORT_ID_MAX               0x1
+
+#define CAM_FD_OUTPUT_PORT_ID_RESULTS          0x0
+#define CAM_FD_OUTPUT_PORT_ID_RAW_RESULTS      0x1
+#define CAM_FD_OUTPUT_PORT_ID_WORK_BUFFER      0x2
+#define CAM_FD_OUTPUT_PORT_ID_MAX              0x3
+
+/**
+ * struct cam_fd_soc_clock_bw_request - SOC clock, bandwidth request info
+ *
+ * @clock_rate : Clock rate required while processing frame
+ * @bandwidth  : Bandwidth required while processing frame
+ * @reserved   : Reserved for future use
+ */
+struct cam_fd_soc_clock_bw_request {
+	uint64_t    clock_rate;
+	uint64_t    bandwidth;
+	uint64_t    reserved[4];
+};
+
+/**
+ * struct cam_fd_face - Face properties
+ *
+ * @prop1 : Property 1 of face
+ * @prop2 : Property 2 of face
+ * @prop3 : Property 3 of face
+ * @prop4 : Property 4 of face
+ *
+ * Do not change this layout, this is inline with how HW writes
+ * these values directly when the buffer is programmed to HW
+ */
+struct cam_fd_face {
+	uint32_t    prop1;
+	uint32_t    prop2;
+	uint32_t    prop3;
+	uint32_t    prop4;
+};
+
+/**
+ * struct cam_fd_results - FD results layout
+ *
+ * @faces      : Array of faces with face properties
+ * @face_count : Number of faces detected
+ * @reserved   : Reserved for alignment
+ *
+ * Do not change this layout, this is inline with how HW writes
+ * these values directly when the buffer is programmed to HW
+ */
+struct cam_fd_results {
+	struct cam_fd_face    faces[CAM_FD_MAX_FACES];
+	uint32_t              face_count;
+	uint32_t              reserved[3];
+};
+
+/**
+ * struct cam_fd_hw_caps - Face properties
+ *
+ * @core_version          : FD core version
+ * @wrapper_version       : FD wrapper version
+ * @raw_results_available : Whether raw results are available on this HW
+ * @supported_modes       : Modes supported by this HW.
+ * @reserved              : Reserved for future use
+ */
+struct cam_fd_hw_caps {
+	struct cam_hw_version    core_version;
+	struct cam_hw_version    wrapper_version;
+	uint32_t                 raw_results_available;
+	uint32_t                 supported_modes;
+	uint64_t                 reserved;
+};
+
+/**
+ * struct cam_fd_query_cap_cmd - FD Query capabilities information
+ *
+ * @device_iommu : FD IOMMU handles
+ * @cdm_iommu    : CDM iommu handles
+ * @hw_caps      : FD HW capabilities
+ * @reserved     : Reserved for alignment
+ */
+struct cam_fd_query_cap_cmd {
+	struct cam_iommu_handle    device_iommu;
+	struct cam_iommu_handle    cdm_iommu;
+	struct cam_fd_hw_caps      hw_caps;
+	uint64_t                   reserved;
+};
+
+/**
+ * struct cam_fd_acquire_dev_info - FD acquire device information
+ *
+ * @clk_bw_request  : SOC clock, bandwidth request
+ * @priority        : Priority for this acquire
+ * @mode            : Mode in which to run FD HW.
+ * @get_raw_results : Whether this acquire needs face raw results
+ *                    while frame processing
+ * @reserved        : Reserved field for 64 bit alignment
+ */
+struct cam_fd_acquire_dev_info {
+	struct cam_fd_soc_clock_bw_request clk_bw_request;
+	uint32_t                           priority;
+	uint32_t                           mode;
+	uint32_t                           get_raw_results;
+	uint32_t                           reserved[13];
+};
+
+#endif /* __UAPI_CAM_FD_H__ */
diff --git a/include/uapi/media/cam_isp.h b/include/uapi/media/cam_isp.h
index 2a57130..9253bc7 100644
--- a/include/uapi/media/cam_isp.h
+++ b/include/uapi/media/cam_isp.h
@@ -73,13 +73,16 @@
 #define CAM_ISP_PACKET_META_DMI_COMMON          6
 #define CAM_ISP_PACKET_META_CLOCK               7
 #define CAM_ISP_PACKET_META_CSID                8
-#define CAM_ISP_PACKET_META_MAX                 9
+#define CAM_ISP_PACKET_META_GENERIC_BLOB        10
+#define CAM_ISP_PACKET_META_MAX                 11
 
 /* DSP mode */
 #define CAM_ISP_DSP_MODE_NONE                   0
 #define CAM_ISP_DSP_MODE_ONE_WAY                1
 #define CAM_ISP_DSP_MODE_ROUND                  2
 
+/* ISP Generic Cmd Buffer Blob types */
+#define CAM_ISP_GENERIC_BLOB_TYPE_HFR_CONFIG    0
 
 /* Query devices */
 /**
@@ -222,4 +225,40 @@
 	uint64_t                       res_hdl;
 };
 
+/**
+ * struct cam_isp_port_hfr_config - HFR configuration for this port
+ *
+ * @resource_type:              Resource type
+ * @subsample_pattern:          Subsample pattern. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @subsample_period:           Subsample period. Used in HFR mode. It
+ *                              should be consistent with batchSize and
+ *                              CAMIF programming.
+ * @framedrop_pattern:          Framedrop pattern
+ * @framedrop_period:           Framedrop period
+ * @reserved:                   Reserved for alignment
+ */
+struct cam_isp_port_hfr_config {
+	uint32_t                       resource_type;
+	uint32_t                       subsample_pattern;
+	uint32_t                       subsample_period;
+	uint32_t                       framedrop_pattern;
+	uint32_t                       framedrop_period;
+	uint32_t                       reserved;
+};
+
+/**
+ * struct cam_isp_resource_hfr_config - Resource HFR configuration
+ *
+ * @num_io_configs:             Number of ports
+ * @reserved:                   Reserved for alignment
+ * @io_hfr_config:              HFR configuration for each IO port
+ */
+struct cam_isp_resource_hfr_config {
+	uint32_t                       num_io_configs;
+	uint32_t                       reserved;
+	struct cam_isp_port_hfr_config io_hfr_config[1];
+};
+
 #endif /* __UAPI_CAM_ISP_H__ */