Merge "diag: Update the logging codes of events, logs and msgs"
diff --git a/Documentation/devicetree/bindings/arm/msm/msm.txt b/Documentation/devicetree/bindings/arm/msm/msm.txt
index 74e90e6..0319e2f 100644
--- a/Documentation/devicetree/bindings/arm/msm/msm.txt
+++ b/Documentation/devicetree/bindings/arm/msm/msm.txt
@@ -104,6 +104,9 @@
 - SXR1130
   compatible = "qcom,sxr1130"
 
+- QRD1130
+  compatible = "qcom,sxr1130-qrd"
+
 - MSM8952
   compatible = "qcom,msm8952"
 
@@ -140,6 +143,9 @@
 - SDA429
   compatible = "qcom,sda429"
 
+- QM215
+  compatible = "qcom, qm215"
+
 - MDM9640
   compatible = "qcom,mdm9640"
 
@@ -361,6 +367,7 @@
 compatible = "qcom,sdm439-qrd"
 compatible = "qcom,sda439-cdp"
 compatible = "qcom,sda439-mtp"
+compatible = "qcom,qm215-qrd"
 compatible = "qcom,msm8953-rumi"
 compatible = "qcom,msm8953-sim"
 compatible = "qcom,msm8953-cdp"
diff --git a/Documentation/devicetree/bindings/clock/qcom,debugcc.txt b/Documentation/devicetree/bindings/clock/qcom,debugcc.txt
index a4452a5..1c1772ad 100644
--- a/Documentation/devicetree/bindings/clock/qcom,debugcc.txt
+++ b/Documentation/devicetree/bindings/clock/qcom,debugcc.txt
@@ -5,6 +5,7 @@
 - compatible : shall contain only one of the following:
 			"qcom,debugcc-sdm845"
 			"qcom,debugcc-sdxpoorwills"
+			"qcom,debugcc-sdxpoorwills-v2"
 
 - clock-names: Shall contain "xo_clk_src"
 - clocks: phandle + clock reference to the CXO clock.
diff --git a/Documentation/devicetree/bindings/clock/qcom,gcc.txt b/Documentation/devicetree/bindings/clock/qcom,gcc.txt
index ba29471..b93c3a1 100644
--- a/Documentation/devicetree/bindings/clock/qcom,gcc.txt
+++ b/Documentation/devicetree/bindings/clock/qcom,gcc.txt
@@ -21,6 +21,7 @@
 			"qcom,gcc-sdm845-v2.1"
 			"qcom,gcc-sdm670"
 			"qcom,gcc-sdxpoorwills"
+			"qcom,gcc-sdxpoorwills-v2"
 
 - reg : shall contain base register location and length
 - #clock-cells : shall contain 1
diff --git a/Documentation/devicetree/bindings/input/touchscreen/synaptics_dsxv26_i2c.txt b/Documentation/devicetree/bindings/input/touchscreen/synaptics_dsxv26_i2c.txt
index 885be72..426992a 100644
--- a/Documentation/devicetree/bindings/input/touchscreen/synaptics_dsxv26_i2c.txt
+++ b/Documentation/devicetree/bindings/input/touchscreen/synaptics_dsxv26_i2c.txt
@@ -37,6 +37,7 @@
  - synaptics,bus-lpm-cur-uA	   : I2C bus idle mode current setting.
  - synaptics,swap-axes		   : specify whether to swap axes.
  - synaptics,resume-in-workqueue	: specify whether to defer the resume to workqueue.
+ - synaptics,fw-name		   : name of firmware .img file in /lib/firmware
  - clock-names			: Clock names used for secure touch. They are: "iface_clk", "core_clk"
  - clocks			: Defined if 'clock-names' DT property is defined. These clocks
 				  are associated with the underlying I2C bus.
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,msm8917-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/qcom,msm8917-pinctrl.txt
index d2327a257..751448c 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,msm8917-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,msm8917-pinctrl.txt
@@ -11,7 +11,13 @@
 - reg:
 	Usage: required
 	Value type: <prop-encoded-array>
-	Definition: the base address and size of the TLMM register space.
+	Definition: the base address and size of the TLMM register space
+		    provided as "pinctrl_regs".
+
+- reg-names:
+	Usage: required
+	Value type: <prop-encoded-array>
+	Definition: Provides labels for the reg property.
 
 - interrupts:
 	Usage: required
@@ -167,6 +173,7 @@
 	tlmm: pinctrl@1000000 {
 		compatible = "qcom,msm8917-pinctrl";
 		reg = <0x1000000 0x300000>;
+		reg-names = "pinctrl_regs";
 		interrupts = <0 208 0>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,msm8937-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/qcom,msm8937-pinctrl.txt
index f697704..39872c5 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,msm8937-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,msm8937-pinctrl.txt
@@ -11,7 +11,13 @@
 - reg:
 	Usage: required
 	Value type: <prop-encoded-array>
-	Definition: the base address and size of the TLMM register space.
+	Definition: the base address and size of the TLMM register space
+		    provided as "pinctrl_regs".
+
+- reg-names:
+	Usage: required
+	Value type: <prop-encoded-array>
+	Definition: Provides labels for the reg property.
 
 - interrupts:
 	Usage: required
@@ -167,6 +173,7 @@
 	tlmm: pinctrl@1000000 {
 		compatible = "qcom,msm8937-pinctrl";
 		reg = <0x1000000 0x300000>;
+		reg-names = "pinctrl_regs";
 		interrupts = <0 208 0>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,msm8953-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/qcom,msm8953-pinctrl.txt
index 4b483e5..8da0a75 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,msm8953-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,msm8953-pinctrl.txt
@@ -11,7 +11,13 @@
 - reg:
 	Usage: required
 	Value type: <prop-encoded-array>
-	Definition: the base address and size of the TLMM register space.
+	Definition: the base address and size of the TLMM register space
+		    provided as "pinctrl_regs".
+
+- reg-names:
+	Usage: required
+	Value type: <prop-encoded-array>
+	Definition: Provides labels for the reg property.
 
 - interrupts:
 	Usage: required
@@ -173,6 +179,7 @@
 	tlmm: pinctrl@1000000 {
 		compatible = "qcom,msm8953-pinctrl";
 		reg = <0x1000000 0x300000>;
+		reg-names = "pinctrl_regs";
 		interrupts = <0 208 0>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,sdm670-pinctrl b/Documentation/devicetree/bindings/pinctrl/qcom,sdm670-pinctrl
index 0eb1043f..2b3dc01 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,sdm670-pinctrl
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,sdm670-pinctrl
@@ -11,7 +11,16 @@
 - reg:
 	Usage: required
 	Value type: <prop-encoded-array>
-	Definition: the base address and size of the TLMM register space.
+	Definition: the base address and size of the TLMM register space
+		    provided as "pinctrl_regs", optional base address of
+		    PDC mux selection registers provided as "pdc_regs"
+		    and optional base address of shared SPI config
+		    registers provided as "spi_cfg_regs".
+
+- reg-names:
+	Usage: required
+	Value type: <prop-encoded-array>
+	Definition: Provides labels for the reg property.
 
 - interrupts:
 	Usage: required
@@ -137,7 +146,8 @@
 
 	tlmm: pinctrl@03400000 {
 		compatible = "qcom,sdm670-pinctrl";
-		reg = <0x03400000 0xc00000>;
+		reg = <0x03400000 0xc00000>, <0x179900f0 0x60>;
+		reg-names = "pinctrl_regs", "spi_cfg_regs";
 		interrupts = <0 208 0>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,sdm845-pinctrl b/Documentation/devicetree/bindings/pinctrl/qcom,sdm845-pinctrl
index 7e75d2c..f8fc5d0 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,sdm845-pinctrl
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,sdm845-pinctrl
@@ -11,7 +11,17 @@
 - reg:
 	Usage: required
 	Value type: <prop-encoded-array>
-	Definition: the base address and size of the TLMM register space.
+	Definition: the base address and size of the TLMM register space
+		    provided as "pinctrl_regs", optional base address of
+		    PDC mux selection registers provided as "pdc_regs"
+		    and optional base address of shared SPI config
+		    registers provided as "spi_cfg_regs".
+
+- reg-names:
+	Usage: required
+	Value type: <prop-encoded-array>
+	Definition: Provides labels for the reg property.
+
 
 - interrupts:
 	Usage: required
@@ -177,7 +187,8 @@
 
 	tlmm: pinctrl@03400000 {
 		compatible = "qcom,sdm845-pinctrl";
-		reg = <0x03800000 0xc00000>;
+		reg = <0x03800000 0xc00000>, <0x179900f0 0x60>;
+		reg-names = "pinctrl_regs", "spi_cfg_regs";
 		interrupts = <0 208 0>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/Documentation/devicetree/bindings/pinctrl/qcom,sdxpoorwill-pinctrl b/Documentation/devicetree/bindings/pinctrl/qcom,sdxpoorwill-pinctrl
index 9a69084..552cec8 100644
--- a/Documentation/devicetree/bindings/pinctrl/qcom,sdxpoorwill-pinctrl
+++ b/Documentation/devicetree/bindings/pinctrl/qcom,sdxpoorwill-pinctrl
@@ -11,7 +11,17 @@
 - reg:
 	Usage: required
 	Value type: <prop-encoded-array>
-	Definition: the base address and size of the TLMM register space.
+	Definition: the base address and size of the TLMM register space
+		    provided as "pinctrl_regs", optional base address of
+		    PDC mux selection registers provided as "pdc_regs"
+		    and optional base address of shared SPI config
+		    registers provided as "spi_cfg_regs".
+
+- reg-names:
+	Usage: required
+	Value type: <prop-encoded-array>
+	Definition: Provides labels for the reg property.
+
 
 - interrupts:
 	Usage: required
@@ -178,6 +188,7 @@
 	tlmm: pinctrl@03900000 {
 		compatible = "qcom,sdxpoorwills-pinctrl";
 		reg = <0x03900000 0x300000>;
+		reg-names = "pinctrl_regs", "pdc_regs";
 		interrupts = <0 212 0>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/arch/arm/boot/dts/qcom/Makefile b/arch/arm/boot/dts/qcom/Makefile
index b5734c5..3902b55 100644
--- a/arch/arm/boot/dts/qcom/Makefile
+++ b/arch/arm/boot/dts/qcom/Makefile
@@ -13,7 +13,9 @@
 	sdxpoorwills-pcie-ep-cdp.dtb \
 	sdxpoorwills-pcie-ep-mtp.dtb \
 	sdxpoorwills-v2-mtp.dtb \
-	sdxpoorwills-v2-cdp.dtb
+	sdxpoorwills-v2-cdp.dtb \
+	sdxpoorwills-v2-dualwifi-mtp.dtb \
+	sdxpoorwills-v2-dualwifi-cdp.dtb
 
 dtb-$(CONFIG_ARCH_MDM9650) += mdm9650-nand-mtp.dtb \
 	mdm9650-ttp.dtb \
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-pinctrl.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-pinctrl.dtsi
index d31916b..c167bdd 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-pinctrl.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-pinctrl.dtsi
@@ -15,6 +15,7 @@
 		compatible = "qcom,sdxpoorwills-pinctrl";
 		reg = <0x3900000 0x300000>,
 			<0xB204900 0x280>;
+		reg-names = "pinctrl_regs", "pdc_regs";
 		interrupts = <0 212 0>;
 		gpio-controller;
 		#gpio-cells = <2>;
@@ -1683,6 +1684,21 @@
 				};
 			};
 		};
+
+		emac {
+			emac_pin_pps_0: emac_pin_pps_0 {
+				mux {
+					pins = "gpio89";
+					function = "emac_pps";
+				};
+
+				config {
+					pins = "gpio89";
+					drive-strength = <8>;	/* 8 mA */
+					bias-disable;		/* NO PULL*/
+				};
+			};
+		};
 	};
 };
 
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-usb.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-usb.dtsi
index 0d36f2a..a26aa71 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-usb.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-usb.dtsi
@@ -20,6 +20,7 @@
 		compatible = "qcom,dwc-usb3-msm";
 		reg = <0x0a600000 0xf8c00>;
 		reg-names = "core_base";
+		iommus = <&apps_smmu 0x1a0 0x0>;
 		#address-cells = <1>;
 		#size-cells = <1>;
 		ranges;
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-cdp.dts b/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-cdp.dts
new file mode 100644
index 0000000..2f775d8
--- /dev/null
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-cdp.dts
@@ -0,0 +1,35 @@
+/* Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "sdxpoorwills-dualwifi-cdp.dtsi"
+#include "sdxpoorwills-v2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDXPOORWILLS V2 DUALWIFI CDP";
+	compatible = "qcom,sdxpoorwills-cdp",
+		"qcom,sdxpoorwills", "qcom,cdp";
+	qcom,board-id = <1 0x105>;
+};
+
+&cnss_pcie {
+	qcom,is-dual-wifi-enabled;
+};
+
+&cnss_sdio {
+	status = "okay";
+};
+
+&blsp1_uart2b_hs {
+	status = "okay";
+};
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-cdp.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-cdp.dtsi
new file mode 100644
index 0000000..d447724
--- /dev/null
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-cdp.dtsi
@@ -0,0 +1,38 @@
+/* Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdxpoorwills-cdp.dtsi"
+
+&sdhc_1 {
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+
+	qcom,core_3_0v_support;
+	qcom,nonremovable;
+
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on
+					&sdc1_wlan_gpio_active>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off
+					&sdc1_wlan_gpio_sleep>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_1>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 210 0
+			1 &intc 0 227 0
+			2 &tlmm 82 0x4>;
+	interrupt-names = "hc_irq", "pwr_irq", "sdiowakeup_irq";
+
+	/delete-property/ qcom,devfreq,freq-table;
+	/delete-property/ cd-gpios;
+};
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-mtp.dts b/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-mtp.dts
new file mode 100644
index 0000000..b11ce13
--- /dev/null
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-mtp.dts
@@ -0,0 +1,35 @@
+/* Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "sdxpoorwills-dualwifi-mtp.dtsi"
+#include "sdxpoorwills-v2.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SDXPOORWILLS V2 DUALWIFI MTP";
+	compatible = "qcom,sdxpoorwills-mtp",
+		"qcom,sdxpoorwills", "qcom,mtp";
+	qcom,board-id = <8 0x104>;
+};
+
+&cnss_pcie {
+	qcom,is-dual-wifi-enabled;
+};
+
+&cnss_sdio {
+	status = "okay";
+};
+
+&blsp1_uart2b_hs {
+	status = "okay";
+};
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-mtp.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-mtp.dtsi
new file mode 100644
index 0000000..b60225a
--- /dev/null
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-v2-dualwifi-mtp.dtsi
@@ -0,0 +1,38 @@
+/* Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdxpoorwills-mtp.dtsi"
+
+&sdhc_1 {
+	qcom,vdd-io-voltage-level = <1800000 1800000>;
+
+	qcom,core_3_0v_support;
+	qcom,nonremovable;
+
+	pinctrl-0 = <&sdc1_clk_on &sdc1_cmd_on &sdc1_data_on
+					&sdc1_wlan_gpio_active>;
+	pinctrl-1 = <&sdc1_clk_off &sdc1_cmd_off &sdc1_data_off
+					&sdc1_wlan_gpio_sleep>;
+
+	#address-cells = <0>;
+	interrupt-parent = <&sdhc_1>;
+	interrupts = <0 1 2>;
+	#interrupt-cells = <1>;
+	interrupt-map-mask = <0xffffffff>;
+	interrupt-map = <0 &intc 0 210 0
+			1 &intc 0 227 0
+			2 &tlmm 82 0x4>;
+	interrupt-names = "hc_irq", "pwr_irq", "sdiowakeup_irq";
+
+	/delete-property/ qcom,devfreq,freq-table;
+	/delete-property/ cd-gpios;
+};
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills-v2.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills-v2.dtsi
index eef2ffb..a3431cf 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills-v2.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills-v2.dtsi
@@ -19,4 +19,18 @@
 
 &emac_hw {
 	emac-core-version = <5>;
+	pinctrl-names = "dev-emac_pin_pps_0";
+	pinctrl-0 = <&emac_pin_pps_0>;
+};
+
+&apps_smmu {
+	/delete-property/ qcom,no-asid-retention;
+};
+
+&clock_debug {
+	compatible = "qcom,debugcc-sdxpoorwills-v2", "syscon";
+};
+
+&clock_gcc {
+	compatible = "qcom,gcc-sdxpoorwills-v2", "syscon";
 };
diff --git a/arch/arm/boot/dts/qcom/sdxpoorwills.dtsi b/arch/arm/boot/dts/qcom/sdxpoorwills.dtsi
index 61363fe..37495a1 100644
--- a/arch/arm/boot/dts/qcom/sdxpoorwills.dtsi
+++ b/arch/arm/boot/dts/qcom/sdxpoorwills.dtsi
@@ -1166,6 +1166,11 @@
 		clock-names = "iface_clk";
 	};
 
+	qcom_tzlog: tz-log@1468B720 {
+		compatible = "qcom,tz-log";
+		reg = <0x1468B720 0x2000>;
+	};
+
 	qcom_seecom: qseecom@90000000{
 		compatible = "qcom,qseecom";
 		reg = <0x90000000 0x600000>;
diff --git a/arch/arm/configs/msm8909-perf_defconfig b/arch/arm/configs/msm8909-perf_defconfig
index 3d30af6..10031dd 100644
--- a/arch/arm/configs/msm8909-perf_defconfig
+++ b/arch/arm/configs/msm8909-perf_defconfig
@@ -33,6 +33,7 @@
 CONFIG_BPF_SYSCALL=y
 # CONFIG_MEMBARRIER is not set
 CONFIG_EMBEDDED=y
+# CONFIG_SLUB_DEBUG is not set
 # CONFIG_COMPAT_BRK is not set
 CONFIG_PROFILING=y
 CONFIG_OPROFILE=m
@@ -150,8 +151,6 @@
 CONFIG_NETFILTER_XT_MATCH_TIME=y
 CONFIG_NETFILTER_XT_MATCH_U32=y
 CONFIG_NF_CONNTRACK_IPV4=y
-CONFIG_NF_DUP_IPV4=y
-CONFIG_NF_LOG_IPV4=y
 CONFIG_IP_NF_IPTABLES=y
 CONFIG_IP_NF_MATCH_AH=y
 CONFIG_IP_NF_MATCH_ECN=y
@@ -170,8 +169,6 @@
 CONFIG_IP_NF_ARPFILTER=y
 CONFIG_IP_NF_ARP_MANGLE=y
 CONFIG_NF_CONNTRACK_IPV6=y
-CONFIG_NF_DUP_IPV6=y
-CONFIG_NF_LOG_IPV6=y
 CONFIG_IP6_NF_IPTABLES=y
 CONFIG_IP6_NF_MATCH_RPFILTER=y
 CONFIG_IP6_NF_FILTER=y
@@ -252,7 +249,6 @@
 CONFIG_CNSS_SDIO=y
 CONFIG_CLD_HL_SDIO_CORE=y
 CONFIG_INPUT_EVDEV=y
-CONFIG_INPUT_EVBUG=m
 CONFIG_KEYBOARD_GPIO=y
 CONFIG_INPUT_JOYSTICK=y
 CONFIG_INPUT_TOUCHSCREEN=y
@@ -370,7 +366,6 @@
 CONFIG_USB_CONFIGFS_F_CDEV=y
 CONFIG_MMC=y
 CONFIG_MMC_PERF_PROFILING=y
-CONFIG_MMC_RING_BUFFER=y
 CONFIG_MMC_PARANOID_SD_INIT=y
 CONFIG_MMC_CLKGATE=y
 CONFIG_MMC_BLOCK_MINORS=32
@@ -427,6 +422,7 @@
 CONFIG_MSM_EVENT_TIMER=y
 CONFIG_QTI_RPM_STATS_LOG=y
 CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC=y
+CONFIG_MEM_SHARE_QMI_SERVICE=y
 CONFIG_MSM_BAM_DMUX=y
 CONFIG_WCNSS_CORE=y
 CONFIG_WCNSS_CORE_PRONTO=y
diff --git a/arch/arm/configs/msm8909_defconfig b/arch/arm/configs/msm8909_defconfig
index 787b38e..17640c9 100644
--- a/arch/arm/configs/msm8909_defconfig
+++ b/arch/arm/configs/msm8909_defconfig
@@ -36,6 +36,7 @@
 CONFIG_OPROFILE=m
 CONFIG_KPROBES=y
 CONFIG_CC_STACKPROTECTOR_REGULAR=y
+CONFIG_ARCH_MMAP_RND_BITS=16
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
@@ -56,6 +57,7 @@
 CONFIG_CMA_DEBUGFS=y
 CONFIG_ZSMALLOC=y
 CONFIG_BALANCE_ANON_FILE_RECLAIM=y
+CONFIG_PROCESS_RECLAIM=y
 CONFIG_SECCOMP=y
 CONFIG_BUILD_ARM_APPENDED_DTB_IMAGE=y
 CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
@@ -466,12 +468,12 @@
 CONFIG_MSM_EVENT_TIMER=y
 CONFIG_QTI_RPM_STATS_LOG=y
 CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC=y
+CONFIG_MEM_SHARE_QMI_SERVICE=y
 CONFIG_MSM_BAM_DMUX=y
 CONFIG_WCNSS_CORE=y
 CONFIG_WCNSS_CORE_PRONTO=y
 CONFIG_WCNSS_REGISTER_DUMP_ON_BITE=y
 CONFIG_CNSS_CRYPTO=y
-CONFIG_QCOM_DEVFREQ_DEVBW=y
 CONFIG_IIO=y
 CONFIG_INV_ICM20602_IIO=y
 CONFIG_PWM=y
@@ -573,13 +575,12 @@
 CONFIG_SECURITY_SMACK=y
 CONFIG_SECURITY_APPARMOR=y
 CONFIG_DEFAULT_SECURITY_DAC=y
-CONFIG_CRYPTO_CTR=y
-CONFIG_CRYPTO_XTS=y
 CONFIG_CRYPTO_XCBC=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_MD4=y
 CONFIG_CRYPTO_TWOFISH=y
 CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_DEV_QCE=y
 CONFIG_CRYPTO_DEV_QCOM_MSM_QCE=y
 CONFIG_CRYPTO_DEV_QCRYPTO=y
 CONFIG_CRYPTO_DEV_QCEDEV=y
diff --git a/arch/arm/configs/msm8909w-perf_defconfig b/arch/arm/configs/msm8909w-perf_defconfig
index 080ccff..6ef7915 100644
--- a/arch/arm/configs/msm8909w-perf_defconfig
+++ b/arch/arm/configs/msm8909w-perf_defconfig
@@ -443,7 +443,6 @@
 CONFIG_WCNSS_CORE=y
 CONFIG_WCNSS_CORE_PRONTO=y
 CONFIG_WCNSS_REGISTER_DUMP_ON_BITE=y
-CONFIG_QCOM_DEVFREQ_DEVBW=y
 CONFIG_IIO=y
 CONFIG_QCOM_SPMI_IADC=y
 CONFIG_QCOM_SPMI_VADC=y
diff --git a/arch/arm/configs/msm8909w_defconfig b/arch/arm/configs/msm8909w_defconfig
index 0fc7cd2..986a65c 100644
--- a/arch/arm/configs/msm8909w_defconfig
+++ b/arch/arm/configs/msm8909w_defconfig
@@ -437,7 +437,6 @@
 CONFIG_WCNSS_CORE=y
 CONFIG_WCNSS_CORE_PRONTO=y
 CONFIG_WCNSS_REGISTER_DUMP_ON_BITE=y
-CONFIG_QCOM_DEVFREQ_DEVBW=y
 CONFIG_IIO=y
 CONFIG_QCOM_SPMI_IADC=y
 CONFIG_QCOM_SPMI_VADC=y
diff --git a/arch/arm/configs/msm8937-perf_defconfig b/arch/arm/configs/msm8937-perf_defconfig
index 26d0d06..f1f9cf0 100644
--- a/arch/arm/configs/msm8937-perf_defconfig
+++ b/arch/arm/configs/msm8937-perf_defconfig
@@ -543,6 +543,8 @@
 CONFIG_MAILBOX=y
 CONFIG_ARM_SMMU=y
 CONFIG_QCOM_LAZY_MAPPING=y
+CONFIG_IOMMU_DEBUG=y
+CONFIG_IOMMU_DEBUG_TRACKING=y
 CONFIG_QCOM_RUN_QUEUE_STATS=y
 CONFIG_MSM_SPM=y
 CONFIG_MSM_L2_SPM=y
@@ -623,6 +625,7 @@
 # CONFIG_DEBUG_PREEMPT is not set
 CONFIG_IPC_LOGGING=y
 CONFIG_CPU_FREQ_SWITCH_PROFILER=y
+CONFIG_DEBUG_SET_MODULE_RONX=y
 CONFIG_CORESIGHT=y
 CONFIG_CORESIGHT_LINK_AND_SINK_TMC=y
 CONFIG_CORESIGHT_REMOTE_ETM=y
diff --git a/arch/arm/configs/msm8937go-perf_defconfig b/arch/arm/configs/msm8937go-perf_defconfig
new file mode 100644
index 0000000..ed23f82
--- /dev/null
+++ b/arch/arm/configs/msm8937go-perf_defconfig
@@ -0,0 +1,640 @@
+CONFIG_LOCALVERSION="-perf"
+# CONFIG_LOCALVERSION_AUTO is not set
+# CONFIG_FHANDLE is not set
+CONFIG_AUDIT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_SCHED_WALT=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_RCU_EXPERT=y
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_ALL=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_CPU_MAX_BUF_SHIFT=17
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_SCHEDTUNE=y
+CONFIG_MEMCG=y
+CONFIG_MEMCG_SWAP=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_CGROUP_BPF=y
+CONFIG_SCHED_CORE_CTL=y
+CONFIG_NAMESPACES=y
+# CONFIG_UTS_NS is not set
+# CONFIG_PID_NS is not set
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_SCHED_TUNE=y
+CONFIG_DEFAULT_USE_ENERGY_AWARE=y
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_LZ4 is not set
+CONFIG_KALLSYMS_ALL=y
+CONFIG_BPF_SYSCALL=y
+# CONFIG_MEMBARRIER is not set
+CONFIG_EMBEDDED=y
+# CONFIG_SLUB_DEBUG is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_CC_STACKPROTECTOR_STRONG=y
+CONFIG_ARCH_MMAP_RND_BITS=16
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SIG=y
+CONFIG_MODULE_SIG_FORCE=y
+CONFIG_MODULE_SIG_SHA512=y
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_IOSCHED_DEADLINE is not set
+CONFIG_ARCH_QCOM=y
+CONFIG_ARCH_MSM8937=y
+CONFIG_ARCH_MSM8917=y
+CONFIG_ARCH_SDM439=y
+CONFIG_ARCH_SDM429=y
+# CONFIG_VDSO is not set
+CONFIG_SMP=y
+CONFIG_SCHED_MC=y
+CONFIG_NR_CPUS=8
+CONFIG_ARM_PSCI=y
+CONFIG_PREEMPT=y
+CONFIG_AEABI=y
+CONFIG_HIGHMEM=y
+CONFIG_ARM_MODULE_PLTS=y
+CONFIG_CMA=y
+CONFIG_CMA_DEBUGFS=y
+CONFIG_ZSMALLOC=y
+CONFIG_PROCESS_RECLAIM=y
+CONFIG_SECCOMP=y
+CONFIG_BUILD_ARM_APPENDED_DTB_IMAGE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_BOOST=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_MSM=y
+CONFIG_CPU_IDLE=y
+CONFIG_VFP=y
+CONFIG_NEON=y
+CONFIG_KERNEL_MODE_NEON=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_PM_AUTOSLEEP=y
+CONFIG_PM_WAKELOCKS=y
+CONFIG_PM_WAKELOCKS_LIMIT=0
+# CONFIG_PM_WAKELOCKS_GC is not set
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_XFRM_STATISTICS=y
+CONFIG_NET_KEY=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_NET_IPVTI=y
+CONFIG_INET_AH=y
+CONFIG_INET_ESP=y
+CONFIG_INET_IPCOMP=y
+CONFIG_INET_DIAG_DESTROY=y
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_IPV6_OPTIMISTIC_DAD=y
+CONFIG_INET6_AH=y
+CONFIG_INET6_ESP=y
+CONFIG_INET6_IPCOMP=y
+CONFIG_IPV6_MIP6=y
+CONFIG_IPV6_VTI=y
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_SECMARK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
+CONFIG_NF_CONNTRACK_AMANDA=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
+CONFIG_NETFILTER_XT_TARGET_HARDIDLETIMER=y
+CONFIG_NETFILTER_XT_TARGET_LOG=y
+CONFIG_NETFILTER_XT_TARGET_MARK=y
+CONFIG_NETFILTER_XT_TARGET_NFLOG=y
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=y
+CONFIG_NETFILTER_XT_TARGET_TEE=y
+CONFIG_NETFILTER_XT_TARGET_TPROXY=y
+CONFIG_NETFILTER_XT_TARGET_TRACE=y
+CONFIG_NETFILTER_XT_TARGET_SECMARK=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+CONFIG_NETFILTER_XT_MATCH_BPF=y
+CONFIG_NETFILTER_XT_MATCH_COMMENT=y
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
+CONFIG_NETFILTER_XT_MATCH_DSCP=y
+CONFIG_NETFILTER_XT_MATCH_ESP=y
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_HELPER=y
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
+# CONFIG_NETFILTER_XT_MATCH_L2TP is not set
+CONFIG_NETFILTER_XT_MATCH_LENGTH=y
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
+CONFIG_NETFILTER_XT_MATCH_MAC=y
+CONFIG_NETFILTER_XT_MATCH_MARK=y
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
+CONFIG_NETFILTER_XT_MATCH_POLICY=y
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
+CONFIG_NETFILTER_XT_MATCH_QTAGUID=y
+CONFIG_NETFILTER_XT_MATCH_QUOTA=y
+CONFIG_NETFILTER_XT_MATCH_QUOTA2=y
+CONFIG_NETFILTER_XT_MATCH_SOCKET=y
+CONFIG_NETFILTER_XT_MATCH_STATE=y
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
+CONFIG_NETFILTER_XT_MATCH_STRING=y
+CONFIG_NETFILTER_XT_MATCH_TIME=y
+CONFIG_NETFILTER_XT_MATCH_U32=y
+CONFIG_NF_CONNTRACK_IPV4=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_MATCH_AH=y
+CONFIG_IP_NF_MATCH_ECN=y
+CONFIG_IP_NF_MATCH_RPFILTER=y
+CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_IP_NF_NAT=y
+CONFIG_IP_NF_TARGET_MASQUERADE=y
+CONFIG_IP_NF_TARGET_NETMAP=y
+CONFIG_IP_NF_TARGET_REDIRECT=y
+CONFIG_IP_NF_MANGLE=y
+CONFIG_IP_NF_RAW=y
+CONFIG_IP_NF_SECURITY=y
+CONFIG_IP_NF_ARPTABLES=y
+CONFIG_IP_NF_ARPFILTER=y
+CONFIG_IP_NF_ARP_MANGLE=y
+CONFIG_NF_CONNTRACK_IPV6=y
+CONFIG_IP6_NF_IPTABLES=y
+CONFIG_IP6_NF_MATCH_RPFILTER=y
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_RAW=y
+CONFIG_BRIDGE_NF_EBTABLES=y
+CONFIG_BRIDGE_EBT_BROUTE=y
+CONFIG_L2TP=y
+CONFIG_L2TP_DEBUGFS=y
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=y
+CONFIG_L2TP_ETH=y
+CONFIG_BRIDGE=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_HTB=y
+CONFIG_NET_SCH_PRIO=y
+CONFIG_NET_CLS_FW=y
+CONFIG_NET_CLS_U32=y
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_FLOW=y
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=y
+CONFIG_NET_EMATCH_NBYTE=y
+CONFIG_NET_EMATCH_U32=y
+CONFIG_NET_EMATCH_META=y
+CONFIG_NET_EMATCH_TEXT=y
+CONFIG_NET_CLS_ACT=y
+CONFIG_RMNET_DATA=y
+CONFIG_RMNET_DATA_FC=y
+CONFIG_RMNET_DATA_DEBUG_PKT=y
+CONFIG_BT=y
+# CONFIG_BT_BREDR is not set
+# CONFIG_BT_LE is not set
+CONFIG_MSM_BT_POWER=y
+CONFIG_CFG80211=y
+CONFIG_CFG80211_INTERNAL_REGDB=y
+# CONFIG_CFG80211_CRDA_SUPPORT is not set
+CONFIG_RFKILL=y
+CONFIG_NFC_NQ=y
+CONFIG_IPC_ROUTER=y
+CONFIG_IPC_ROUTER_SECURITY=y
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y
+CONFIG_REGMAP_ALLOW_WRITE_DEBUGFS=y
+CONFIG_DMA_CMA=y
+CONFIG_ZRAM=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_HDCP_QSEECOM=y
+CONFIG_QSEECOM=y
+CONFIG_UID_SYS_STATS=y
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_SG=y
+CONFIG_CHR_DEV_SCH=y
+CONFIG_SCSI_CONSTANTS=y
+CONFIG_SCSI_LOGGING=y
+CONFIG_SCSI_SCAN_ASYNC=y
+CONFIG_SCSI_UFSHCD=y
+CONFIG_SCSI_UFSHCD_PLATFORM=y
+CONFIG_SCSI_UFS_QCOM=y
+CONFIG_SCSI_UFS_QCOM_ICE=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_CRYPT=y
+CONFIG_DM_REQ_CRYPT=y
+CONFIG_DM_UEVENT=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_FEC=y
+CONFIG_DM_ANDROID_VERITY_AT_MOST_ONCE_DEFAULT_ENABLED=y
+CONFIG_NETDEVICES=y
+CONFIG_DUMMY=y
+CONFIG_TUN=y
+# CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_CADENCE is not set
+# CONFIG_NET_VENDOR_EZCHIP is not set
+# CONFIG_NET_VENDOR_HISILICON is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
+# CONFIG_NET_VENDOR_ROCKER is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
+CONFIG_PPP=y
+CONFIG_PPP_BSDCOMP=y
+CONFIG_PPP_DEFLATE=y
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=y
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOE=y
+CONFIG_PPPOL2TP=y
+CONFIG_PPPOLAC=y
+CONFIG_PPPOPNS=y
+CONFIG_PPP_ASYNC=y
+CONFIG_PPP_SYNC_TTY=y
+CONFIG_USB_USBNET=y
+# CONFIG_WLAN_VENDOR_ADMTEK is not set
+# CONFIG_WLAN_VENDOR_ATH is not set
+# CONFIG_WLAN_VENDOR_ATMEL is not set
+# CONFIG_WLAN_VENDOR_BROADCOM is not set
+# CONFIG_WLAN_VENDOR_CISCO is not set
+# CONFIG_WLAN_VENDOR_INTEL is not set
+# CONFIG_WLAN_VENDOR_INTERSIL is not set
+# CONFIG_WLAN_VENDOR_MARVELL is not set
+# CONFIG_WLAN_VENDOR_MEDIATEK is not set
+# CONFIG_WLAN_VENDOR_RALINK is not set
+# CONFIG_WLAN_VENDOR_REALTEK is not set
+# CONFIG_WLAN_VENDOR_RSI is not set
+# CONFIG_WLAN_VENDOR_ST is not set
+# CONFIG_WLAN_VENDOR_TI is not set
+# CONFIG_WLAN_VENDOR_ZYDAS is not set
+CONFIG_WCNSS_MEM_PRE_ALLOC=y
+CONFIG_CLD_LL_CORE=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_GPIO=y
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_CORE_v26=y
+CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_RMI_DEV_v26=y
+CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_v26=y
+CONFIG_SECURE_TOUCH_SYNAPTICS_DSX_V26=y
+CONFIG_TOUCHSCREEN_FT5X06=y
+CONFIG_TOUCHSCREEN_GEN_VKEYS=y
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_HBTP_INPUT=y
+CONFIG_INPUT_QPNP_POWER_ON=y
+CONFIG_INPUT_UINPUT=y
+# CONFIG_SERIO_SERPORT is not set
+# CONFIG_VT is not set
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_DEVMEM is not set
+# CONFIG_DEVKMEM is not set
+CONFIG_SERIAL_MSM_HS=y
+CONFIG_SERIAL_MSM_SMD=y
+CONFIG_DIAG_CHAR=y
+CONFIG_DIAG_USES_SMD=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_MSM_LEGACY=y
+CONFIG_MSM_SMD_PKT=y
+CONFIG_MSM_ADSPRPC=y
+CONFIG_MSM_RDBG=m
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MSM_V2=y
+CONFIG_SPI=y
+CONFIG_SPI_QUP=y
+CONFIG_SPI_SPIDEV=y
+CONFIG_SLIMBUS_MSM_NGD=y
+CONFIG_SPMI=y
+CONFIG_PINCTRL_MSM8937=y
+CONFIG_PINCTRL_MSM8917=y
+CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_QPNP_PIN=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_QCOM=y
+CONFIG_QCOM_DLOAD_MODE=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_QPNP_FG=y
+CONFIG_SMB135X_CHARGER=y
+CONFIG_SMB1355_SLAVE_CHARGER=y
+CONFIG_SMB1351_USB_CHARGER=y
+CONFIG_QPNP_SMBCHARGER=y
+CONFIG_QPNP_TYPEC=y
+CONFIG_MSM_APM=y
+CONFIG_SENSORS_QPNP_ADC_VOLTAGE=y
+CONFIG_THERMAL=y
+CONFIG_THERMAL_WRITABLE_TRIPS=y
+CONFIG_THERMAL_GOV_USER_SPACE=y
+CONFIG_THERMAL_GOV_LOW_LIMITS=y
+CONFIG_CPU_THERMAL=y
+CONFIG_DEVFREQ_THERMAL=y
+CONFIG_THERMAL_QPNP=y
+CONFIG_THERMAL_QPNP_ADC_TM=y
+CONFIG_THERMAL_TSENS=y
+CONFIG_QTI_VIRTUAL_SENSOR=y
+CONFIG_QTI_QMI_COOLING_DEVICE=y
+CONFIG_REGULATOR_COOLING_DEVICE=y
+CONFIG_QTI_BCL_PMIC5=y
+CONFIG_QTI_BCL_SOC_DRIVER=y
+CONFIG_MFD_I2C_PMIC=y
+CONFIG_MFD_SPMI_PMIC=y
+CONFIG_MFD_SYSCON=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_PROXY_CONSUMER=y
+CONFIG_REGULATOR_CPR=y
+CONFIG_REGULATOR_MEM_ACC=y
+CONFIG_REGULATOR_QPNP_LABIBB=y
+CONFIG_REGULATOR_QPNP=y
+CONFIG_REGULATOR_RPM_SMD=y
+CONFIG_REGULATOR_SPM=y
+CONFIG_REGULATOR_STUB=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
+CONFIG_MEDIA_USB_SUPPORT=y
+CONFIG_USB_VIDEO_CLASS=y
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_MSM_CAMERA=y
+CONFIG_MSMB_CAMERA=y
+CONFIG_MSM_CAMERA_SENSOR=y
+CONFIG_MSM_CPP=y
+CONFIG_MSM_CCI=y
+CONFIG_MSM_CSI20_HEADER=y
+CONFIG_MSM_CSI22_HEADER=y
+CONFIG_MSM_CSI30_HEADER=y
+CONFIG_MSM_CSI31_HEADER=y
+CONFIG_MSM_CSIPHY=y
+CONFIG_MSM_CSID=y
+CONFIG_MSM_EEPROM=y
+CONFIG_MSM_ISPIF_V2=y
+CONFIG_IMX134=y
+CONFIG_IMX132=y
+CONFIG_OV9724=y
+CONFIG_OV5648=y
+CONFIG_GC0339=y
+CONFIG_OV8825=y
+CONFIG_OV8865=y
+CONFIG_s5k4e1=y
+CONFIG_OV12830=y
+CONFIG_MSM_V4L2_VIDEO_OVERLAY_DEVICE=y
+CONFIG_MSMB_JPEG=y
+CONFIG_MSM_FD=y
+CONFIG_MSM_VIDC_3X_V4L2=y
+CONFIG_MSM_VIDC_3X_GOVERNORS=y
+CONFIG_RADIO_IRIS=y
+CONFIG_RADIO_IRIS_TRANSPORT=y
+CONFIG_QCOM_KGSL=y
+CONFIG_FB=y
+CONFIG_FB_MSM=y
+CONFIG_FB_MSM_MDSS=y
+CONFIG_FB_MSM_MDSS_WRITEBACK=y
+CONFIG_FB_MSM_MDSS_DSI_CTRL_STATUS=y
+CONFIG_FB_MSM_MDSS_XLOG_DEBUG=y
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_DYNAMIC_MINORS=y
+CONFIG_SND_USB_AUDIO=y
+CONFIG_SND_SOC=y
+CONFIG_UHID=y
+CONFIG_HID_APPLE=y
+CONFIG_HID_ELECOM=y
+CONFIG_HID_MAGICMOUSE=y
+CONFIG_HID_MICROSOFT=y
+CONFIG_HID_MULTITOUCH=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_MSM=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_ACM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_DATAFAB=y
+CONFIG_USB_STORAGE_FREECOM=y
+CONFIG_USB_STORAGE_ISD200=y
+CONFIG_USB_STORAGE_USBAT=y
+CONFIG_USB_STORAGE_SDDR09=y
+CONFIG_USB_STORAGE_SDDR55=y
+CONFIG_USB_STORAGE_JUMPSHOT=y
+CONFIG_USB_STORAGE_ALAUDA=y
+CONFIG_USB_STORAGE_ONETOUCH=y
+CONFIG_USB_STORAGE_KARMA=y
+CONFIG_USB_STORAGE_CYPRESS_ATACB=y
+CONFIG_USB_SERIAL=y
+CONFIG_USB_EHSET_TEST_FIXTURE=y
+CONFIG_DUAL_ROLE_USB_INTF=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_DEBUG_FILES=y
+CONFIG_USB_GADGET_DEBUG_FS=y
+CONFIG_USB_GADGET_VBUS_DRAW=500
+CONFIG_USB_CI13XXX_MSM=y
+CONFIG_USB_CONFIGFS=y
+CONFIG_USB_CONFIGFS_SERIAL=y
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+CONFIG_USB_CONFIGFS_RMNET_BAM=y
+CONFIG_USB_CONFIGFS_MASS_STORAGE=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_USB_CONFIGFS_F_MTP=y
+CONFIG_USB_CONFIGFS_F_PTP=y
+CONFIG_USB_CONFIGFS_F_ACC=y
+CONFIG_USB_CONFIGFS_F_AUDIO_SRC=y
+CONFIG_USB_CONFIGFS_UEVENT=y
+CONFIG_USB_CONFIGFS_F_MIDI=y
+CONFIG_USB_CONFIGFS_F_HID=y
+CONFIG_USB_CONFIGFS_F_DIAG=y
+CONFIG_USB_CONFIGFS_F_CDEV=y
+CONFIG_USB_CONFIGFS_F_CCID=y
+CONFIG_USB_CONFIGFS_F_QDSS=y
+CONFIG_MMC=y
+CONFIG_MMC_PERF_PROFILING=y
+# CONFIG_PWRSEQ_EMMC is not set
+# CONFIG_PWRSEQ_SIMPLE is not set
+CONFIG_MMC_PARANOID_SD_INIT=y
+CONFIG_MMC_CLKGATE=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_BLOCK_DEFERRED_RESUME=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_MSM=y
+CONFIG_MMC_SDHCI_MSM_ICE=y
+CONFIG_MMC_CQ_HCI=y
+CONFIG_LEDS_QPNP=y
+CONFIG_LEDS_QPNP_FLASH=y
+CONFIG_LEDS_QPNP_WLED=y
+CONFIG_LEDS_QPNP_HAPTICS=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_EDAC=y
+CONFIG_EDAC_MM_EDAC=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_QPNP=y
+CONFIG_DMADEVICES=y
+CONFIG_QCOM_SPS_DMA=y
+CONFIG_UIO=y
+CONFIG_UIO_MSM_SHAREDMEM=y
+CONFIG_STAGING=y
+CONFIG_ASHMEM=y
+CONFIG_ANDROID_LOW_MEMORY_KILLER=y
+CONFIG_ION=y
+CONFIG_ION_MSM=y
+CONFIG_IPA=y
+CONFIG_RMNET_IPA=y
+CONFIG_RNDIS_IPA=y
+CONFIG_SPS=y
+CONFIG_SPS_SUPPORT_NDP_BAM=y
+CONFIG_QPNP_COINCELL=y
+CONFIG_QPNP_REVID=y
+CONFIG_USB_BAM=y
+CONFIG_MSM_RMNET_BAM=y
+CONFIG_MSM_MDSS_PLL=y
+CONFIG_REMOTE_SPINLOCK_MSM=y
+CONFIG_MAILBOX=y
+CONFIG_ARM_SMMU=y
+CONFIG_QCOM_LAZY_MAPPING=y
+CONFIG_QCOM_RUN_QUEUE_STATS=y
+CONFIG_MSM_SPM=y
+CONFIG_MSM_L2_SPM=y
+CONFIG_MSM_BOOT_STATS=y
+CONFIG_QCOM_WATCHDOG_V2=y
+CONFIG_QCOM_MEMORY_DUMP_V2=y
+CONFIG_MSM_RPM_SMD=y
+CONFIG_QCOM_BUS_SCALING=y
+CONFIG_QCOM_SECURE_BUFFER=y
+CONFIG_QCOM_EARLY_RANDOM=y
+CONFIG_MSM_SMEM=y
+CONFIG_MSM_SMD=y
+CONFIG_MSM_SMD_DEBUG=y
+CONFIG_MSM_TZ_SMMU=y
+CONFIG_MSM_SMP2P=y
+CONFIG_MSM_IPC_ROUTER_SMD_XPRT=y
+CONFIG_MSM_QMI_INTERFACE=y
+CONFIG_MSM_SUBSYSTEM_RESTART=y
+CONFIG_MSM_SYSMON_COMM=y
+CONFIG_MSM_PIL=y
+CONFIG_MSM_PIL_SSR_GENERIC=y
+CONFIG_MSM_PIL_MSS_QDSP6V5=y
+CONFIG_MSM_PERFORMANCE=y
+CONFIG_MSM_EVENT_TIMER=y
+CONFIG_MSM_AVTIMER=y
+CONFIG_MSM_PM=y
+CONFIG_QCOM_DCC=y
+CONFIG_QTI_RPM_STATS_LOG=y
+CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC=y
+CONFIG_MEM_SHARE_QMI_SERVICE=y
+CONFIG_MSM_BAM_DMUX=y
+CONFIG_WCNSS_CORE=y
+CONFIG_WCNSS_CORE_PRONTO=y
+CONFIG_WCNSS_REGISTER_DUMP_ON_BITE=y
+CONFIG_BIG_CLUSTER_MIN_FREQ_ADJUST=y
+CONFIG_QCOM_BIMC_BWMON=y
+CONFIG_DEVFREQ_GOV_QCOM_BW_HWMON=y
+CONFIG_DEVFREQ_SIMPLE_DEV=y
+CONFIG_QCOM_DEVFREQ_DEVBW=y
+CONFIG_SPDM_SCM=y
+CONFIG_DEVFREQ_SPDM=y
+CONFIG_IIO=y
+CONFIG_PWM=y
+CONFIG_PWM_QPNP=y
+CONFIG_QCOM_SHOW_RESUME_IRQ=y
+CONFIG_QTI_MPM=y
+CONFIG_ANDROID=y
+CONFIG_ANDROID_BINDER_IPC=y
+CONFIG_SENSORS_SSC=y
+CONFIG_MSM_TZ_LOG=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXT4_ENCRYPTION=y
+CONFIG_EXT4_FS_ENCRYPTION=y
+CONFIG_EXT4_FS_ICE_ENCRYPTION=y
+CONFIG_F2FS_FS=y
+CONFIG_F2FS_FS_SECURITY=y
+CONFIG_F2FS_FS_ENCRYPTION=y
+CONFIG_QUOTA=y
+CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QFMT_V2=y
+CONFIG_FUSE_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_SDCARD_FS=y
+# CONFIG_NETWORK_FILESYSTEMS is not set
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_INFO=y
+CONFIG_FRAME_WARN=2048
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_PANIC_TIMEOUT=5
+CONFIG_SCHED_STACK_END_CHECK=y
+# CONFIG_DEBUG_PREEMPT is not set
+CONFIG_IPC_LOGGING=y
+CONFIG_CPU_FREQ_SWITCH_PROFILER=y
+CONFIG_PFK=y
+CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
+CONFIG_SECURITY=y
+CONFIG_LSM_MMAP_MIN_ADDR=4096
+CONFIG_HARDENED_USERCOPY=y
+CONFIG_SECURITY_SELINUX=y
+CONFIG_SECURITY_SMACK=y
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_XCBC=y
+CONFIG_CRYPTO_MD4=y
+CONFIG_CRYPTO_TWOFISH=y
+CONFIG_CRYPTO_LZ4=y
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_DEV_QCOM_MSM_QCE=y
+CONFIG_CRYPTO_DEV_QCRYPTO=y
+CONFIG_CRYPTO_DEV_QCEDEV=y
+CONFIG_CRYPTO_DEV_OTA_CRYPTO=y
+CONFIG_CRYPTO_DEV_QCOM_ICE=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM_NEON=y
+CONFIG_CRYPTO_SHA2_ARM_CE=y
+CONFIG_CRYPTO_AES_ARM_BS=y
+CONFIG_CRYPTO_AES_ARM_CE=y
+CONFIG_QMI_ENCDEC=y
diff --git a/arch/arm/configs/msm8937go_defconfig b/arch/arm/configs/msm8937go_defconfig
new file mode 100644
index 0000000..458f478
--- /dev/null
+++ b/arch/arm/configs/msm8937go_defconfig
@@ -0,0 +1,702 @@
+# CONFIG_LOCALVERSION_AUTO is not set
+# CONFIG_FHANDLE is not set
+CONFIG_AUDIT=y
+CONFIG_NO_HZ=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_IRQ_TIME_ACCOUNTING=y
+CONFIG_SCHED_WALT=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_RCU_EXPERT=y
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_ALL=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_CPU_MAX_BUF_SHIFT=17
+CONFIG_CGROUP_DEBUG=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_SCHEDTUNE=y
+CONFIG_MEMCG=y
+CONFIG_MEMCG_SWAP=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_CGROUP_BPF=y
+CONFIG_SCHED_CORE_CTL=y
+CONFIG_NAMESPACES=y
+# CONFIG_UTS_NS is not set
+# CONFIG_PID_NS is not set
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_SCHED_TUNE=y
+CONFIG_DEFAULT_USE_ENERGY_AWARE=y
+CONFIG_BLK_DEV_INITRD=y
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_XZ is not set
+# CONFIG_RD_LZO is not set
+# CONFIG_RD_LZ4 is not set
+CONFIG_KALLSYMS_ALL=y
+CONFIG_BPF_SYSCALL=y
+# CONFIG_MEMBARRIER is not set
+CONFIG_EMBEDDED=y
+# CONFIG_COMPAT_BRK is not set
+CONFIG_PROFILING=y
+CONFIG_OPROFILE=m
+CONFIG_KPROBES=y
+CONFIG_CC_STACKPROTECTOR_STRONG=y
+CONFIG_ARCH_MMAP_RND_BITS=16
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_MODULE_FORCE_UNLOAD=y
+CONFIG_MODVERSIONS=y
+CONFIG_MODULE_SIG=y
+CONFIG_MODULE_SIG_FORCE=y
+CONFIG_MODULE_SIG_SHA512=y
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_IOSCHED_DEADLINE is not set
+CONFIG_ARCH_QCOM=y
+CONFIG_ARCH_MSM8937=y
+CONFIG_ARCH_MSM8917=y
+CONFIG_ARCH_SDM439=y
+CONFIG_ARCH_SDM429=y
+# CONFIG_VDSO is not set
+CONFIG_SMP=y
+CONFIG_SCHED_MC=y
+CONFIG_NR_CPUS=8
+CONFIG_ARM_PSCI=y
+CONFIG_PREEMPT=y
+CONFIG_AEABI=y
+CONFIG_HIGHMEM=y
+CONFIG_ARM_MODULE_PLTS=y
+CONFIG_CMA=y
+CONFIG_CMA_DEBUGFS=y
+CONFIG_ZSMALLOC=y
+CONFIG_PROCESS_RECLAIM=y
+CONFIG_SECCOMP=y
+CONFIG_BUILD_ARM_APPENDED_DTB_IMAGE=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
+CONFIG_CPU_BOOST=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_MSM=y
+CONFIG_CPU_IDLE=y
+CONFIG_VFP=y
+CONFIG_NEON=y
+CONFIG_KERNEL_MODE_NEON=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_PM_AUTOSLEEP=y
+CONFIG_PM_WAKELOCKS=y
+CONFIG_PM_WAKELOCKS_LIMIT=0
+# CONFIG_PM_WAKELOCKS_GC is not set
+CONFIG_PM_DEBUG=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_UNIX=y
+CONFIG_XFRM_USER=y
+CONFIG_XFRM_STATISTICS=y
+CONFIG_NET_KEY=y
+CONFIG_INET=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_VERBOSE=y
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_NET_IPVTI=y
+CONFIG_INET_AH=y
+CONFIG_INET_ESP=y
+CONFIG_INET_IPCOMP=y
+CONFIG_INET_DIAG_DESTROY=y
+CONFIG_IPV6_ROUTER_PREF=y
+CONFIG_IPV6_ROUTE_INFO=y
+CONFIG_IPV6_OPTIMISTIC_DAD=y
+CONFIG_INET6_AH=y
+CONFIG_INET6_ESP=y
+CONFIG_INET6_IPCOMP=y
+CONFIG_IPV6_MIP6=y
+CONFIG_IPV6_VTI=y
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_SECMARK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CT_PROTO_DCCP=y
+CONFIG_NF_CT_PROTO_SCTP=y
+CONFIG_NF_CT_PROTO_UDPLITE=y
+CONFIG_NF_CONNTRACK_AMANDA=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_H323=y
+CONFIG_NF_CONNTRACK_IRC=y
+CONFIG_NF_CONNTRACK_NETBIOS_NS=y
+CONFIG_NF_CONNTRACK_PPTP=y
+CONFIG_NF_CONNTRACK_SANE=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NF_CT_NETLINK=y
+CONFIG_NETFILTER_XT_TARGET_CLASSIFY=y
+CONFIG_NETFILTER_XT_TARGET_CONNMARK=y
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
+CONFIG_NETFILTER_XT_TARGET_IDLETIMER=y
+CONFIG_NETFILTER_XT_TARGET_HARDIDLETIMER=y
+CONFIG_NETFILTER_XT_TARGET_LOG=y
+CONFIG_NETFILTER_XT_TARGET_MARK=y
+CONFIG_NETFILTER_XT_TARGET_NFLOG=y
+CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
+CONFIG_NETFILTER_XT_TARGET_NOTRACK=y
+CONFIG_NETFILTER_XT_TARGET_TEE=y
+CONFIG_NETFILTER_XT_TARGET_TPROXY=y
+CONFIG_NETFILTER_XT_TARGET_TRACE=y
+CONFIG_NETFILTER_XT_TARGET_SECMARK=y
+CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
+CONFIG_NETFILTER_XT_MATCH_BPF=y
+CONFIG_NETFILTER_XT_MATCH_COMMENT=y
+CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=y
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
+CONFIG_NETFILTER_XT_MATCH_DSCP=y
+CONFIG_NETFILTER_XT_MATCH_ESP=y
+CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=y
+CONFIG_NETFILTER_XT_MATCH_HELPER=y
+CONFIG_NETFILTER_XT_MATCH_IPRANGE=y
+# CONFIG_NETFILTER_XT_MATCH_L2TP is not set
+CONFIG_NETFILTER_XT_MATCH_LENGTH=y
+CONFIG_NETFILTER_XT_MATCH_LIMIT=y
+CONFIG_NETFILTER_XT_MATCH_MAC=y
+CONFIG_NETFILTER_XT_MATCH_MARK=y
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=y
+CONFIG_NETFILTER_XT_MATCH_POLICY=y
+CONFIG_NETFILTER_XT_MATCH_PKTTYPE=y
+CONFIG_NETFILTER_XT_MATCH_QTAGUID=y
+CONFIG_NETFILTER_XT_MATCH_QUOTA=y
+CONFIG_NETFILTER_XT_MATCH_QUOTA2=y
+CONFIG_NETFILTER_XT_MATCH_SOCKET=y
+CONFIG_NETFILTER_XT_MATCH_STATE=y
+CONFIG_NETFILTER_XT_MATCH_STATISTIC=y
+CONFIG_NETFILTER_XT_MATCH_STRING=y
+CONFIG_NETFILTER_XT_MATCH_TIME=y
+CONFIG_NETFILTER_XT_MATCH_U32=y
+CONFIG_NF_CONNTRACK_IPV4=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_MATCH_AH=y
+CONFIG_IP_NF_MATCH_ECN=y
+CONFIG_IP_NF_MATCH_RPFILTER=y
+CONFIG_IP_NF_MATCH_TTL=y
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_IP_NF_NAT=y
+CONFIG_IP_NF_TARGET_MASQUERADE=y
+CONFIG_IP_NF_TARGET_NETMAP=y
+CONFIG_IP_NF_TARGET_REDIRECT=y
+CONFIG_IP_NF_MANGLE=y
+CONFIG_IP_NF_RAW=y
+CONFIG_IP_NF_SECURITY=y
+CONFIG_IP_NF_ARPTABLES=y
+CONFIG_IP_NF_ARPFILTER=y
+CONFIG_IP_NF_ARP_MANGLE=y
+CONFIG_NF_CONNTRACK_IPV6=y
+CONFIG_IP6_NF_IPTABLES=y
+CONFIG_IP6_NF_MATCH_RPFILTER=y
+CONFIG_IP6_NF_FILTER=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+CONFIG_IP6_NF_MANGLE=y
+CONFIG_IP6_NF_RAW=y
+CONFIG_BRIDGE_NF_EBTABLES=y
+CONFIG_BRIDGE_EBT_BROUTE=y
+CONFIG_L2TP=y
+CONFIG_L2TP_DEBUGFS=y
+CONFIG_L2TP_V3=y
+CONFIG_L2TP_IP=y
+CONFIG_L2TP_ETH=y
+CONFIG_BRIDGE=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_HTB=y
+CONFIG_NET_SCH_PRIO=y
+CONFIG_NET_CLS_FW=y
+CONFIG_NET_CLS_U32=y
+CONFIG_CLS_U32_MARK=y
+CONFIG_NET_CLS_FLOW=y
+CONFIG_NET_EMATCH=y
+CONFIG_NET_EMATCH_CMP=y
+CONFIG_NET_EMATCH_NBYTE=y
+CONFIG_NET_EMATCH_U32=y
+CONFIG_NET_EMATCH_META=y
+CONFIG_NET_EMATCH_TEXT=y
+CONFIG_NET_CLS_ACT=y
+CONFIG_DNS_RESOLVER=y
+CONFIG_RMNET_DATA=y
+CONFIG_RMNET_DATA_FC=y
+CONFIG_RMNET_DATA_DEBUG_PKT=y
+CONFIG_BT=y
+# CONFIG_BT_BREDR is not set
+# CONFIG_BT_LE is not set
+CONFIG_MSM_BT_POWER=y
+CONFIG_CFG80211=y
+CONFIG_CFG80211_INTERNAL_REGDB=y
+# CONFIG_CFG80211_CRDA_SUPPORT is not set
+CONFIG_RFKILL=y
+CONFIG_NFC_NQ=y
+CONFIG_IPC_ROUTER=y
+CONFIG_IPC_ROUTER_SECURITY=y
+CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y
+CONFIG_REGMAP_ALLOW_WRITE_DEBUGFS=y
+CONFIG_DMA_CMA=y
+CONFIG_ZRAM=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_BLK_DEV_RAM_SIZE=8192
+CONFIG_HDCP_QSEECOM=y
+CONFIG_QSEECOM=y
+CONFIG_UID_SYS_STATS=y
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_CHR_DEV_SG=y
+CONFIG_CHR_DEV_SCH=y
+CONFIG_SCSI_CONSTANTS=y
+CONFIG_SCSI_LOGGING=y
+CONFIG_SCSI_SCAN_ASYNC=y
+CONFIG_SCSI_UFSHCD=y
+CONFIG_SCSI_UFSHCD_PLATFORM=y
+CONFIG_SCSI_UFS_QCOM=y
+CONFIG_SCSI_UFS_QCOM_ICE=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_CRYPT=y
+CONFIG_DM_REQ_CRYPT=y
+CONFIG_DM_UEVENT=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_FEC=y
+CONFIG_DM_ANDROID_VERITY_AT_MOST_ONCE_DEFAULT_ENABLED=y
+CONFIG_NETDEVICES=y
+CONFIG_DUMMY=y
+CONFIG_TUN=y
+# CONFIG_NET_VENDOR_AMAZON is not set
+# CONFIG_NET_CADENCE is not set
+# CONFIG_NET_VENDOR_EZCHIP is not set
+# CONFIG_NET_VENDOR_HISILICON is not set
+# CONFIG_NET_VENDOR_MARVELL is not set
+# CONFIG_NET_VENDOR_NETRONOME is not set
+# CONFIG_NET_VENDOR_ROCKER is not set
+# CONFIG_NET_VENDOR_SYNOPSYS is not set
+CONFIG_PPP=y
+CONFIG_PPP_BSDCOMP=y
+CONFIG_PPP_DEFLATE=y
+CONFIG_PPP_FILTER=y
+CONFIG_PPP_MPPE=y
+CONFIG_PPP_MULTILINK=y
+CONFIG_PPPOE=y
+CONFIG_PPPOL2TP=y
+CONFIG_PPPOLAC=y
+CONFIG_PPPOPNS=y
+CONFIG_PPP_ASYNC=y
+CONFIG_PPP_SYNC_TTY=y
+CONFIG_USB_USBNET=y
+# CONFIG_WLAN_VENDOR_ADMTEK is not set
+# CONFIG_WLAN_VENDOR_ATH is not set
+# CONFIG_WLAN_VENDOR_ATMEL is not set
+# CONFIG_WLAN_VENDOR_BROADCOM is not set
+# CONFIG_WLAN_VENDOR_CISCO is not set
+# CONFIG_WLAN_VENDOR_INTEL is not set
+# CONFIG_WLAN_VENDOR_INTERSIL is not set
+# CONFIG_WLAN_VENDOR_MARVELL is not set
+# CONFIG_WLAN_VENDOR_MEDIATEK is not set
+# CONFIG_WLAN_VENDOR_RALINK is not set
+# CONFIG_WLAN_VENDOR_REALTEK is not set
+# CONFIG_WLAN_VENDOR_RSI is not set
+# CONFIG_WLAN_VENDOR_ST is not set
+# CONFIG_WLAN_VENDOR_TI is not set
+# CONFIG_WLAN_VENDOR_ZYDAS is not set
+CONFIG_WCNSS_MEM_PRE_ALLOC=y
+CONFIG_CLD_LL_CORE=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_KEYBOARD_GPIO=y
+# CONFIG_INPUT_MOUSE is not set
+CONFIG_INPUT_JOYSTICK=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_CORE_v26=y
+CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_RMI_DEV_v26=y
+CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_v26=y
+CONFIG_SECURE_TOUCH_SYNAPTICS_DSX_V26=y
+CONFIG_TOUCHSCREEN_FT5X06=y
+CONFIG_TOUCHSCREEN_GEN_VKEYS=y
+CONFIG_INPUT_MISC=y
+CONFIG_INPUT_HBTP_INPUT=y
+CONFIG_INPUT_QPNP_POWER_ON=y
+CONFIG_INPUT_UINPUT=y
+# CONFIG_SERIO_SERPORT is not set
+# CONFIG_VT is not set
+# CONFIG_LEGACY_PTYS is not set
+# CONFIG_DEVMEM is not set
+# CONFIG_DEVKMEM is not set
+CONFIG_SERIAL_MSM=y
+CONFIG_SERIAL_MSM_CONSOLE=y
+CONFIG_SERIAL_MSM_HS=y
+CONFIG_SERIAL_MSM_SMD=y
+CONFIG_DIAG_CHAR=y
+CONFIG_DIAG_USES_SMD=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_MSM_LEGACY=y
+CONFIG_MSM_SMD_PKT=y
+CONFIG_MSM_ADSPRPC=y
+CONFIG_MSM_RDBG=m
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_MSM_V2=y
+CONFIG_SPI=y
+CONFIG_SPI_QUP=y
+CONFIG_SPI_SPIDEV=y
+CONFIG_SLIMBUS_MSM_NGD=y
+CONFIG_SPMI=y
+CONFIG_PINCTRL_MSM8937=y
+CONFIG_PINCTRL_MSM8917=y
+CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_GPIO_QPNP_PIN=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_QCOM=y
+CONFIG_QCOM_DLOAD_MODE=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_QPNP_FG=y
+CONFIG_SMB135X_CHARGER=y
+CONFIG_SMB1355_SLAVE_CHARGER=y
+CONFIG_SMB1351_USB_CHARGER=y
+CONFIG_QPNP_SMBCHARGER=y
+CONFIG_QPNP_TYPEC=y
+CONFIG_MSM_APM=y
+CONFIG_SENSORS_QPNP_ADC_VOLTAGE=y
+CONFIG_THERMAL=y
+CONFIG_THERMAL_WRITABLE_TRIPS=y
+CONFIG_THERMAL_GOV_USER_SPACE=y
+CONFIG_THERMAL_GOV_LOW_LIMITS=y
+CONFIG_CPU_THERMAL=y
+CONFIG_DEVFREQ_THERMAL=y
+CONFIG_THERMAL_QPNP=y
+CONFIG_THERMAL_QPNP_ADC_TM=y
+CONFIG_THERMAL_TSENS=y
+CONFIG_QTI_VIRTUAL_SENSOR=y
+CONFIG_QTI_QMI_COOLING_DEVICE=y
+CONFIG_REGULATOR_COOLING_DEVICE=y
+CONFIG_QTI_BCL_PMIC5=y
+CONFIG_QTI_BCL_SOC_DRIVER=y
+CONFIG_MFD_I2C_PMIC=y
+CONFIG_MFD_SPMI_PMIC=y
+CONFIG_MFD_SYSCON=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_PROXY_CONSUMER=y
+CONFIG_REGULATOR_CPR=y
+CONFIG_REGULATOR_MEM_ACC=y
+CONFIG_REGULATOR_QPNP_LABIBB=y
+CONFIG_REGULATOR_QPNP=y
+CONFIG_REGULATOR_RPM_SMD=y
+CONFIG_REGULATOR_SPM=y
+CONFIG_REGULATOR_STUB=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_MEDIA_CAMERA_SUPPORT=y
+CONFIG_MEDIA_CONTROLLER=y
+CONFIG_VIDEO_V4L2_SUBDEV_API=y
+CONFIG_V4L_PLATFORM_DRIVERS=y
+CONFIG_MSM_CAMERA=y
+CONFIG_MSM_CAMERA_DEBUG=y
+CONFIG_MSMB_CAMERA=y
+CONFIG_MSMB_CAMERA_DEBUG=y
+CONFIG_MSM_CAMERA_SENSOR=y
+CONFIG_MSM_CPP=y
+CONFIG_MSM_CCI=y
+CONFIG_MSM_CSI20_HEADER=y
+CONFIG_MSM_CSI22_HEADER=y
+CONFIG_MSM_CSI30_HEADER=y
+CONFIG_MSM_CSI31_HEADER=y
+CONFIG_MSM_CSIPHY=y
+CONFIG_MSM_CSID=y
+CONFIG_MSM_EEPROM=y
+CONFIG_MSM_ISPIF_V2=y
+CONFIG_IMX134=y
+CONFIG_IMX132=y
+CONFIG_OV9724=y
+CONFIG_OV5648=y
+CONFIG_GC0339=y
+CONFIG_OV8825=y
+CONFIG_OV8865=y
+CONFIG_s5k4e1=y
+CONFIG_OV12830=y
+CONFIG_MSM_V4L2_VIDEO_OVERLAY_DEVICE=y
+CONFIG_MSMB_JPEG=y
+CONFIG_MSM_FD=y
+CONFIG_MSM_VIDC_3X_V4L2=y
+CONFIG_MSM_VIDC_3X_GOVERNORS=y
+CONFIG_RADIO_IRIS=y
+CONFIG_RADIO_IRIS_TRANSPORT=y
+CONFIG_QCOM_KGSL=y
+CONFIG_FB=y
+CONFIG_FB_VIRTUAL=y
+CONFIG_FB_MSM=y
+CONFIG_FB_MSM_MDSS=y
+CONFIG_FB_MSM_MDSS_WRITEBACK=y
+CONFIG_FB_MSM_MDSS_DSI_CTRL_STATUS=y
+CONFIG_FB_MSM_MDSS_XLOG_DEBUG=y
+CONFIG_BACKLIGHT_LCD_SUPPORT=y
+# CONFIG_BACKLIGHT_CLASS_DEVICE is not set
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_DYNAMIC_MINORS=y
+CONFIG_SND_USB_AUDIO=y
+CONFIG_SND_SOC=y
+CONFIG_UHID=y
+CONFIG_HID_APPLE=y
+CONFIG_HID_ELECOM=y
+CONFIG_HID_MAGICMOUSE=y
+CONFIG_HID_MICROSOFT=y
+CONFIG_HID_MULTITOUCH=y
+CONFIG_USB_HIDDEV=y
+CONFIG_USB=y
+CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
+CONFIG_USB_MON=y
+CONFIG_USB_EHCI_HCD=y
+CONFIG_USB_EHCI_MSM=y
+CONFIG_USB_EHCI_HCD_PLATFORM=y
+CONFIG_USB_ACM=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_STORAGE_DATAFAB=y
+CONFIG_USB_STORAGE_FREECOM=y
+CONFIG_USB_STORAGE_ISD200=y
+CONFIG_USB_STORAGE_USBAT=y
+CONFIG_USB_STORAGE_SDDR09=y
+CONFIG_USB_STORAGE_SDDR55=y
+CONFIG_USB_STORAGE_JUMPSHOT=y
+CONFIG_USB_STORAGE_ALAUDA=y
+CONFIG_USB_STORAGE_ONETOUCH=y
+CONFIG_USB_STORAGE_KARMA=y
+CONFIG_USB_STORAGE_CYPRESS_ATACB=y
+CONFIG_USB_SERIAL=y
+CONFIG_USB_EHSET_TEST_FIXTURE=y
+CONFIG_DUAL_ROLE_USB_INTF=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_GADGET_DEBUG_FILES=y
+CONFIG_USB_GADGET_DEBUG_FS=y
+CONFIG_USB_GADGET_VBUS_DRAW=500
+CONFIG_USB_CI13XXX_MSM=y
+CONFIG_USB_CONFIGFS=y
+CONFIG_USB_CONFIGFS_SERIAL=y
+CONFIG_USB_CONFIGFS_NCM=y
+CONFIG_USB_CONFIGFS_RNDIS=y
+CONFIG_USB_CONFIGFS_RMNET_BAM=y
+CONFIG_USB_CONFIGFS_MASS_STORAGE=y
+CONFIG_USB_CONFIGFS_F_FS=y
+CONFIG_USB_CONFIGFS_F_MTP=y
+CONFIG_USB_CONFIGFS_F_PTP=y
+CONFIG_USB_CONFIGFS_F_ACC=y
+CONFIG_USB_CONFIGFS_F_AUDIO_SRC=y
+CONFIG_USB_CONFIGFS_UEVENT=y
+CONFIG_USB_CONFIGFS_F_MIDI=y
+CONFIG_USB_CONFIGFS_F_HID=y
+CONFIG_USB_CONFIGFS_F_DIAG=y
+CONFIG_USB_CONFIGFS_F_CDEV=y
+CONFIG_USB_CONFIGFS_F_CCID=y
+CONFIG_USB_CONFIGFS_F_QDSS=y
+CONFIG_MMC=y
+CONFIG_MMC_PERF_PROFILING=y
+# CONFIG_PWRSEQ_EMMC is not set
+# CONFIG_PWRSEQ_SIMPLE is not set
+CONFIG_MMC_RING_BUFFER=y
+CONFIG_MMC_PARANOID_SD_INIT=y
+CONFIG_MMC_CLKGATE=y
+CONFIG_MMC_BLOCK_MINORS=32
+CONFIG_MMC_BLOCK_DEFERRED_RESUME=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_MSM=y
+CONFIG_MMC_SDHCI_MSM_ICE=y
+CONFIG_MMC_CQ_HCI=y
+CONFIG_LEDS_QPNP=y
+CONFIG_LEDS_QPNP_FLASH=y
+CONFIG_LEDS_QPNP_WLED=y
+CONFIG_LEDS_QPNP_HAPTICS=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_EDAC=y
+CONFIG_EDAC_MM_EDAC=y
+CONFIG_RTC_CLASS=y
+CONFIG_RTC_DRV_QPNP=y
+CONFIG_DMADEVICES=y
+CONFIG_QCOM_SPS_DMA=y
+CONFIG_UIO=y
+CONFIG_UIO_MSM_SHAREDMEM=y
+CONFIG_STAGING=y
+CONFIG_ASHMEM=y
+CONFIG_ANDROID_LOW_MEMORY_KILLER=y
+CONFIG_ION=y
+CONFIG_ION_MSM=y
+CONFIG_IPA=y
+CONFIG_RMNET_IPA=y
+CONFIG_RNDIS_IPA=y
+CONFIG_SPS=y
+CONFIG_SPS_SUPPORT_NDP_BAM=y
+CONFIG_QPNP_COINCELL=y
+CONFIG_QPNP_REVID=y
+CONFIG_USB_BAM=y
+CONFIG_MSM_EXT_DISPLAY=y
+CONFIG_MSM_RMNET_BAM=y
+CONFIG_MSM_MDSS_PLL=y
+CONFIG_REMOTE_SPINLOCK_MSM=y
+CONFIG_MAILBOX=y
+CONFIG_ARM_SMMU=y
+CONFIG_QCOM_LAZY_MAPPING=y
+CONFIG_IOMMU_DEBUG=y
+CONFIG_IOMMU_DEBUG_TRACKING=y
+CONFIG_IOMMU_TESTS=y
+CONFIG_QCOM_CPUSS_DUMP=y
+CONFIG_QCOM_RUN_QUEUE_STATS=y
+CONFIG_MSM_SPM=y
+CONFIG_MSM_L2_SPM=y
+CONFIG_MSM_BOOT_STATS=y
+CONFIG_MSM_CORE_HANG_DETECT=y
+CONFIG_QCOM_WATCHDOG_V2=y
+CONFIG_QCOM_MEMORY_DUMP_V2=y
+CONFIG_MSM_DEBUG_LAR_UNLOCK=y
+CONFIG_MSM_RPM_SMD=y
+CONFIG_QCOM_BUS_SCALING=y
+CONFIG_QCOM_SECURE_BUFFER=y
+CONFIG_QCOM_EARLY_RANDOM=y
+CONFIG_MSM_SMEM=y
+CONFIG_MSM_SMD=y
+CONFIG_MSM_SMD_DEBUG=y
+CONFIG_MSM_TZ_SMMU=y
+CONFIG_TRACER_PKT=y
+CONFIG_MSM_SMP2P=y
+CONFIG_MSM_IPC_ROUTER_SMD_XPRT=y
+CONFIG_MSM_QMI_INTERFACE=y
+CONFIG_MSM_SUBSYSTEM_RESTART=y
+CONFIG_MSM_SYSMON_COMM=y
+CONFIG_MSM_PIL=y
+CONFIG_MSM_PIL_SSR_GENERIC=y
+CONFIG_MSM_PIL_MSS_QDSP6V5=y
+CONFIG_MSM_PERFORMANCE=y
+CONFIG_MSM_EVENT_TIMER=y
+CONFIG_MSM_AVTIMER=y
+CONFIG_MSM_PM=y
+CONFIG_QCOM_DCC=y
+CONFIG_QTI_RPM_STATS_LOG=y
+CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC=y
+CONFIG_MEM_SHARE_QMI_SERVICE=y
+CONFIG_MSM_BAM_DMUX=y
+CONFIG_WCNSS_CORE=y
+CONFIG_WCNSS_CORE_PRONTO=y
+CONFIG_WCNSS_REGISTER_DUMP_ON_BITE=y
+CONFIG_BIG_CLUSTER_MIN_FREQ_ADJUST=y
+CONFIG_QCOM_BIMC_BWMON=y
+CONFIG_DEVFREQ_GOV_QCOM_BW_HWMON=y
+CONFIG_DEVFREQ_SIMPLE_DEV=y
+CONFIG_QCOM_DEVFREQ_DEVBW=y
+CONFIG_SPDM_SCM=y
+CONFIG_DEVFREQ_SPDM=y
+CONFIG_IIO=y
+CONFIG_PWM=y
+CONFIG_PWM_QPNP=y
+CONFIG_QCOM_SHOW_RESUME_IRQ=y
+CONFIG_QTI_MPM=y
+CONFIG_ANDROID=y
+CONFIG_ANDROID_BINDER_IPC=y
+CONFIG_STM=y
+CONFIG_SENSORS_SSC=y
+CONFIG_MSM_TZ_LOG=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_EXT4_ENCRYPTION=y
+CONFIG_EXT4_FS_ENCRYPTION=y
+CONFIG_EXT4_FS_ICE_ENCRYPTION=y
+CONFIG_F2FS_FS=y
+CONFIG_F2FS_FS_SECURITY=y
+CONFIG_F2FS_FS_ENCRYPTION=y
+CONFIG_QUOTA=y
+CONFIG_QUOTA_NETLINK_INTERFACE=y
+CONFIG_QFMT_V2=y
+CONFIG_FUSE_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_SDCARD_FS=y
+# CONFIG_NETWORK_FILESYSTEMS is not set
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_PRINTK_TIME=y
+CONFIG_DYNAMIC_DEBUG=y
+CONFIG_DEBUG_INFO=y
+CONFIG_FRAME_WARN=2048
+CONFIG_PAGE_OWNER=y
+CONFIG_PAGE_OWNER_ENABLE_DEFAULT=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_PAGEALLOC=y
+CONFIG_SLUB_DEBUG_PANIC_ON=y
+CONFIG_DEBUG_PAGEALLOC_ENABLE_DEFAULT=y
+CONFIG_PAGE_POISONING=y
+CONFIG_PAGE_POISONING_ENABLE_DEFAULT=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_FREE=y
+CONFIG_DEBUG_OBJECTS_TIMERS=y
+CONFIG_DEBUG_OBJECTS_WORK=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER=y
+CONFIG_DEBUG_KMEMLEAK=y
+CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE=4000
+CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF=y
+CONFIG_DEBUG_STACK_USAGE=y
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_LOCKUP_DETECTOR=y
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
+CONFIG_WQ_WATCHDOG=y
+CONFIG_PANIC_TIMEOUT=5
+CONFIG_PANIC_ON_SCHED_BUG=y
+CONFIG_PANIC_ON_RT_THROTTLING=y
+CONFIG_SCHED_STACK_END_CHECK=y
+# CONFIG_DEBUG_PREEMPT is not set
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_MUTEXES=y
+CONFIG_DEBUG_ATOMIC_SLEEP=y
+CONFIG_DEBUG_LIST=y
+CONFIG_FAULT_INJECTION=y
+CONFIG_FAIL_PAGE_ALLOC=y
+CONFIG_FAULT_INJECTION_DEBUG_FS=y
+CONFIG_FAULT_INJECTION_STACKTRACE_FILTER=y
+CONFIG_IPC_LOGGING=y
+CONFIG_QCOM_RTB=y
+CONFIG_QCOM_RTB_SEPARATE_CPUS=y
+CONFIG_FUNCTION_TRACER=y
+CONFIG_IRQSOFF_TRACER=y
+CONFIG_PREEMPT_TRACER=y
+CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_CPU_FREQ_SWITCH_PROFILER=y
+CONFIG_LKDTM=y
+CONFIG_MEMTEST=y
+CONFIG_PANIC_ON_DATA_CORRUPTION=y
+CONFIG_DEBUG_USER=y
+CONFIG_FORCE_PAGES=y
+CONFIG_PID_IN_CONTEXTIDR=y
+CONFIG_DEBUG_SET_MODULE_RONX=y
+CONFIG_PFK=y
+CONFIG_SECURITY_PERF_EVENTS_RESTRICT=y
+CONFIG_SECURITY=y
+CONFIG_LSM_MMAP_MIN_ADDR=4096
+CONFIG_HARDENED_USERCOPY=y
+CONFIG_SECURITY_SELINUX=y
+CONFIG_SECURITY_SMACK=y
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_XCBC=y
+CONFIG_CRYPTO_MD4=y
+CONFIG_CRYPTO_TWOFISH=y
+CONFIG_CRYPTO_LZ4=y
+CONFIG_CRYPTO_ANSI_CPRNG=y
+CONFIG_CRYPTO_DEV_QCOM_MSM_QCE=y
+CONFIG_CRYPTO_DEV_QCRYPTO=y
+CONFIG_CRYPTO_DEV_QCEDEV=y
+CONFIG_CRYPTO_DEV_OTA_CRYPTO=y
+CONFIG_CRYPTO_DEV_QCOM_ICE=y
+CONFIG_ARM_CRYPTO=y
+CONFIG_CRYPTO_SHA1_ARM_NEON=y
+CONFIG_CRYPTO_SHA2_ARM_CE=y
+CONFIG_CRYPTO_AES_ARM_BS=y
+CONFIG_CRYPTO_AES_ARM_CE=y
+CONFIG_QMI_ENCDEC=y
diff --git a/arch/arm/configs/msm8953-perf_defconfig b/arch/arm/configs/msm8953-perf_defconfig
index 344ab3d..b7fbe29 100644
--- a/arch/arm/configs/msm8953-perf_defconfig
+++ b/arch/arm/configs/msm8953-perf_defconfig
@@ -557,6 +557,8 @@
 CONFIG_MAILBOX=y
 CONFIG_ARM_SMMU=y
 CONFIG_QCOM_LAZY_MAPPING=y
+CONFIG_IOMMU_DEBUG=y
+CONFIG_IOMMU_DEBUG_TRACKING=y
 CONFIG_QCOM_RUN_QUEUE_STATS=y
 CONFIG_MSM_SPM=y
 CONFIG_MSM_L2_SPM=y
@@ -599,6 +601,7 @@
 CONFIG_QCOM_DEVFREQ_DEVBW=y
 CONFIG_SPDM_SCM=y
 CONFIG_DEVFREQ_SPDM=y
+CONFIG_EXTCON_USB_GPIO=y
 CONFIG_IIO=y
 CONFIG_PWM=y
 CONFIG_PWM_QPNP=y
@@ -615,6 +618,7 @@
 CONFIG_EXT4_FS_ICE_ENCRYPTION=y
 CONFIG_F2FS_FS=y
 CONFIG_F2FS_FS_SECURITY=y
+CONFIG_F2FS_FS_ENCRYPTION=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V2=y
@@ -636,6 +640,7 @@
 # CONFIG_DEBUG_PREEMPT is not set
 CONFIG_IPC_LOGGING=y
 CONFIG_CPU_FREQ_SWITCH_PROFILER=y
+CONFIG_DEBUG_SET_MODULE_RONX=y
 CONFIG_CORESIGHT=y
 CONFIG_CORESIGHT_LINK_AND_SINK_TMC=y
 CONFIG_CORESIGHT_REMOTE_ETM=y
diff --git a/arch/arm/configs/msm8953_defconfig b/arch/arm/configs/msm8953_defconfig
index 153cdd9..528cb27 100644
--- a/arch/arm/configs/msm8953_defconfig
+++ b/arch/arm/configs/msm8953_defconfig
@@ -633,6 +633,7 @@
 CONFIG_EXT4_FS_ICE_ENCRYPTION=y
 CONFIG_F2FS_FS=y
 CONFIG_F2FS_FS_SECURITY=y
+CONFIG_F2FS_FS_ENCRYPTION=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V2=y
diff --git a/arch/arm/configs/sdm670-perf_defconfig b/arch/arm/configs/sdm670-perf_defconfig
index 2f003b9..d5bbdcc 100644
--- a/arch/arm/configs/sdm670-perf_defconfig
+++ b/arch/arm/configs/sdm670-perf_defconfig
@@ -291,6 +291,7 @@
 # CONFIG_SERIO_SERPORT is not set
 # CONFIG_LEGACY_PTYS is not set
 CONFIG_SERIAL_MSM_GENI=y
+CONFIG_DIAG_CHAR=y
 CONFIG_HW_RANDOM=y
 CONFIG_HW_RANDOM_MSM_LEGACY=y
 CONFIG_MSM_ADSPRPC=y
@@ -497,6 +498,7 @@
 CONFIG_QCOM_SMCINVOKE=y
 CONFIG_MSM_EVENT_TIMER=y
 CONFIG_MSM_QBT1000=y
+CONFIG_QCOM_DCC_V2=y
 CONFIG_QTI_RPM_STATS_LOG=y
 CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC=y
 CONFIG_QMP_DEBUGFS_CLIENT=y
diff --git a/arch/arm/configs/sdm670_defconfig b/arch/arm/configs/sdm670_defconfig
index 702f622..baac195 100644
--- a/arch/arm/configs/sdm670_defconfig
+++ b/arch/arm/configs/sdm670_defconfig
@@ -520,6 +520,7 @@
 CONFIG_QCOM_SMCINVOKE=y
 CONFIG_MSM_EVENT_TIMER=y
 CONFIG_MSM_QBT1000=y
+CONFIG_QCOM_DCC_V2=y
 CONFIG_QTI_RPM_STATS_LOG=y
 CONFIG_QCOM_FORCE_WDOG_BITE_ON_PANIC=y
 CONFIG_QMP_DEBUGFS_CLIENT=y
diff --git a/arch/arm/configs/sdxpoorwills-perf_defconfig b/arch/arm/configs/sdxpoorwills-perf_defconfig
index cdbfebd..5ac5966 100644
--- a/arch/arm/configs/sdxpoorwills-perf_defconfig
+++ b/arch/arm/configs/sdxpoorwills-perf_defconfig
@@ -19,6 +19,7 @@
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
 # CONFIG_SLUB_DEBUG is not set
+CONFIG_SLAB_FREELIST_RANDOM=y
 CONFIG_PROFILING=y
 CONFIG_CC_STACKPROTECTOR_REGULAR=y
 CONFIG_MODULES=y
@@ -242,7 +243,6 @@
 CONFIG_SPI_SPIDEV=m
 CONFIG_SPMI=y
 CONFIG_SPMI_MSM_PMIC_ARB_DEBUG=y
-CONFIG_PTP_1588_CLOCK=y
 CONFIG_PINCTRL_SDXPOORWILLS=y
 CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
 CONFIG_DEBUG_GPIO=y
@@ -402,6 +402,7 @@
 CONFIG_PWM_QPNP=y
 CONFIG_QCOM_SHOW_RESUME_IRQ=y
 CONFIG_ANDROID=y
+CONFIG_MSM_TZ_LOG=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_SECURITY=y
 CONFIG_VFAT_FS=y
diff --git a/arch/arm/configs/sdxpoorwills_defconfig b/arch/arm/configs/sdxpoorwills_defconfig
index b3fef2f..137a3d5 100644
--- a/arch/arm/configs/sdxpoorwills_defconfig
+++ b/arch/arm/configs/sdxpoorwills_defconfig
@@ -20,6 +20,7 @@
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_EMBEDDED=y
+CONFIG_SLAB_FREELIST_RANDOM=y
 CONFIG_PROFILING=y
 CONFIG_CC_STACKPROTECTOR_REGULAR=y
 CONFIG_MODULES=y
@@ -237,7 +238,6 @@
 CONFIG_SPI_SPIDEV=m
 CONFIG_SPMI=y
 CONFIG_SPMI_MSM_PMIC_ARB_DEBUG=y
-CONFIG_PTP_1588_CLOCK=y
 CONFIG_PINCTRL_SDXPOORWILLS=y
 CONFIG_PINCTRL_QCOM_SPMI_PMIC=y
 CONFIG_POWER_RESET=y
@@ -407,6 +407,7 @@
 CONFIG_PWM_QPNP=y
 CONFIG_QCOM_SHOW_RESUME_IRQ=y
 CONFIG_ANDROID=y
+CONFIG_MSM_TZ_LOG=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_SECURITY=y
 CONFIG_VFAT_FS=y
@@ -433,6 +434,7 @@
 CONFIG_DEBUG_MUTEXES=y
 CONFIG_DEBUG_ATOMIC_SLEEP=y
 CONFIG_DEBUG_LIST=y
+CONFIG_DEBUG_CREDENTIALS=y
 CONFIG_FAULT_INJECTION=y
 CONFIG_FAIL_PAGE_ALLOC=y
 CONFIG_FAULT_INJECTION_DEBUG_FS=y
@@ -442,6 +444,7 @@
 CONFIG_IRQSOFF_TRACER=y
 CONFIG_PREEMPT_TRACER=y
 CONFIG_BLK_DEV_IO_TRACE=y
+CONFIG_PANIC_ON_DATA_CORRUPTION=y
 CONFIG_DEBUG_USER=y
 CONFIG_DEBUG_SET_MODULE_RONX=y
 CONFIG_CORESIGHT=y
@@ -461,6 +464,7 @@
 CONFIG_SECURITY=y
 CONFIG_SECURITY_NETWORK=y
 CONFIG_HARDENED_USERCOPY=y
+CONFIG_HARDENED_USERCOPY_PAGESPAN=y
 CONFIG_SECURITY_SELINUX=y
 # CONFIG_SECURITY_SELINUX_AVC_STATS is not set
 CONFIG_CRYPTO_DEV_QCOM_MSM_QCE=y
diff --git a/arch/arm/mach-qcom/Kconfig b/arch/arm/mach-qcom/Kconfig
index 6b43733..4e95a7b 100644
--- a/arch/arm/mach-qcom/Kconfig
+++ b/arch/arm/mach-qcom/Kconfig
@@ -105,7 +105,7 @@
 	select CPU_FREQ_MSM
 	select PM_DEVFREQ
 	select PM_OPP
-	select MSM_DEVFREQ_DEVBW
+	select QCOM_DEVFREQ_DEVBW
 	select DEVFREQ_SIMPLE_DEV
 	select DEVFREQ_GOV_QCOM_BW_HWMON
 	select QCOM_BIMC_BWMON
diff --git a/arch/arm64/boot/dts/qcom/Makefile b/arch/arm64/boot/dts/qcom/Makefile
index 29bd873..a80f478 100644
--- a/arch/arm64/boot/dts/qcom/Makefile
+++ b/arch/arm64/boot/dts/qcom/Makefile
@@ -185,7 +185,8 @@
 		sxr1130-usbc-external-codec-mtp-overlay.dtbo \
 		sxr1130-usbc-external-codec-pm660a-mtp-overlay.dtbo \
 		sxr1130-usbc-mtp-overlay.dtbo \
-		sxr1130-usbc-pm660a-mtp-overlay.dtbo
+		sxr1130-usbc-pm660a-mtp-overlay.dtbo \
+		sxr1130-qrd-overlay.dtbo
 
 sdm670-cdp-overlay.dtbo-base := sdm670.dtb
 sdm670-mtp-overlay.dtbo-base := sdm670.dtb
@@ -259,6 +260,7 @@
 sxr1130-usbc-external-codec-pm660a-mtp-overlay.dtbo-base := sxr1130.dtb
 sxr1130-usbc-mtp-overlay.dtbo-base := sxr1130.dtb
 sxr1130-usbc-pm660a-mtp-overlay.dtbo-base := sxr1130.dtb
+sxr1130-qrd-overlay.dtbo-base := sxr1130.dtb
 
 else
 dtb-$(CONFIG_ARCH_SDM670) += sdm670-rumi.dtb \
@@ -329,7 +331,8 @@
 	sxr1130-usbc-external-codec-mtp.dtb \
 	sxr1130-usbc-external-codec-pm660a-mtp.dtb \
 	sxr1130-usbc-mtp.dtb \
-	sxr1130-usbc-pm660a-mtp.dtb
+	sxr1130-usbc-pm660a-mtp.dtb \
+	sxr1130-qrd.dtb
 endif
 
 ifeq ($(CONFIG_BUILD_ARM64_DT_OVERLAY),y)
@@ -341,7 +344,8 @@
 	msm8917-rcm-overlay.dtbo \
 	apq8017-mtp-overlay.dtbo \
 	apq8017-cdp-overlay.dtbo \
-	apq8017-cdp-wcd-rome-overlay.dtbo
+	apq8017-cdp-wcd-rome-overlay.dtbo \
+	qm215-qrd-overlay.dtbo
 
 dtbo-$(CONFIG_ARCH_MSM8953) += msm8953-mtp-overlay.dtbo \
 	msm8953-cdp-overlay.dtbo \
@@ -387,6 +391,7 @@
 
 msm8917-qrd-overlay.dtbo-base := msm8917-pmi8937.dtb
 
+
 msm8917-cdp-ext-codec-overlay.dtbo-base := msm8917-pmi8950.dtb
 
 msm8917-cdp-ml-touch-overlay.dtbo-base := msm8917-pmi8950.dtb
@@ -408,6 +413,8 @@
 apq8017-cdp-wcd-rome-overlay.dtbo-base := apq8017-pmi8950.dtb \
 	apq8017-pmi8937.dtb
 
+qm215-qrd-overlay.dtbo-base := qm215.dtb
+
 msm8953-mtp-overlay.dtbo-base := sdm450.dtb \
 	msm8953.dtb \
 	apq8053.dtb \
@@ -469,6 +476,7 @@
 	msm8937-interposer-sdm439.dtb
 sdm439-qrd-overlay.dtbo-base := sdm439.dtb \
 	msm8937-interposer-sdm439.dtb
+
 sdm439-external-codec-mtp-overlay.dtbo-base := sdm439.dtb
 sdm439-rcm-overlay.dtbo-base := sdm439.dtb
 sdm429-mtp-overlay.dtbo-base := sdm429.dtb \
@@ -537,7 +545,8 @@
 	apq8017-pmi8937-cdp-wcd-rome.dtb \
 	msm8917-pmi8940-mtp.dtb \
 	msm8917-pmi8940-cdp.dtb \
-	msm8917-pmi8940-rcm.dtb
+	msm8917-pmi8940-rcm.dtb \
+	qm215-qrd.dtb
 
 dtb-$(CONFIG_ARCH_MSM8909) += sdw3100-msm8909w-wtp.dtb \
 	sdw3100-apq8009w-wtp.dtb \
@@ -587,7 +596,8 @@
 	sda439-mtp.dtb \
 	sda439-cdp.dtb \
 	sdm439-external-codec-mtp.dtb \
-	sdm439-rcm.dtb
+	sdm439-rcm.dtb \
+	qm215-qrd.dtb
 
 dtb-$(CONFIG_ARCH_SDM429) += sdm429-mtp.dtb \
 	sdm429-cdp.dtb \
diff --git a/arch/arm64/boot/dts/qcom/apq8009-dragon.dts b/arch/arm64/boot/dts/qcom/apq8009-dragon.dts
index 041563b..314af11 100644
--- a/arch/arm64/boot/dts/qcom/apq8009-dragon.dts
+++ b/arch/arm64/boot/dts/qcom/apq8009-dragon.dts
@@ -16,7 +16,6 @@
 #include "msm8909-mtp.dtsi"
 #include "8909-pm8916.dtsi"
 #include "msm8909-pm8916-mtp.dtsi"
-#include "apq8009-audio-external_codec.dtsi"
 
 / {
 	model = "Qualcomm Technologies, Inc. APQ8009 Dragon Board";
@@ -26,24 +25,95 @@
 };
 
 &soc {
-	ext-codec {
+	cdc_dmic_gpios: cdc_dmic_pinctrl {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&cdc_dmic0_clk_act &cdc_dmic0_data_act>;
+		pinctrl-1 = <&cdc_dmic0_clk_sus &cdc_dmic0_data_sus>;
+	};
+
+	cdc_prim_mi2s_gpios: msm_cdc_pinctrl_pri {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&pri_mi2s_sleep &pri_mi2s_ws_sleep
+			 &pri_mi2s_dout_sleep &pri_mi2s_din_sleep
+			 &ext_amp_ctrl_sleep &amp_mute_sleep>;
+		pinctrl-1 = <&pri_mi2s_active &pri_mi2s_ws_active
+			 &pri_mi2s_dout_active &pri_mi2s_din_active
+			 &ext_amp_ctrl_active &amp_mute_active>;
+
+	};
+
+	audio_codec_mtp: sound {
+		status = "ok";
+		qcom,msm-hs-micbias-type = "internal";
+		qcom,model = "msm8909-212-som-snd-card";
 		qcom,msm-mbhc-hphl-swh = <0>;
+
 		qcom,audio-routing =
-			"AIF4 VI", "MCLK",
 			"RX_BIAS", "MCLK",
-			"MADINPUT", "MCLK",
-			"AMIC2", "MIC BIAS2",
-			"MIC BIAS2", "Headset Mic",
-			"DMIC0", "MIC BIAS1",
-			"MIC BIAS1", "Digital Mic0",
-			"DMIC1", "MIC BIAS1",
-			"MIC BIAS1", "Digital Mic1",
-			"DMIC2", "MIC BIAS3",
-			"MIC BIAS3", "Digital Mic2",
-			"DMIC3", "MIC BIAS3",
-			"MIC BIAS3", "Digital Mic3",
-			"SpkrLeft IN", "SPK1 OUT",
-			"SpkrRight IN", "SPK2 OUT";
+			"SPK_RX_BIAS", "MCLK",
+			"INT_LDO_H", "MCLK",
+			"RX_I2S_CLK", "MCLK",
+			"TX_I2S_CLK", "MCLK",
+			"MIC BIAS Internal1", "Handset Mic",
+			"MIC BIAS Internal2", "Headset Mic",
+			"MIC BIAS Internal1", "Secondary Mic",
+			"AMIC1", "MIC BIAS Internal1",
+			"AMIC2", "MIC BIAS Internal2",
+			"AMIC3", "MIC BIAS Internal1",
+			"DMIC1", "DIGITAL_REGULATOR",
+			"DIGITAL_REGULATOR", "Digital Mic1",
+			"DMIC2", "DIGITAL_REGULATOR",
+			"DIGITAL_REGULATOR", "Digital Mic2";
+
+		qcom,pri-mi2s-gpios = <&cdc_prim_mi2s_gpios>;
+		qcom,cdc-dmic-gpios = <&cdc_dmic_gpios>;
+
+		qcom,afe-rxtx-lb;
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+				<&loopback>, <&compress>, <&hostless>,
+				<&afe>, <&lsm>, <&routing>, <&pcm_noirq>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+			"msm-pcm-dsp.2", "msm-voip-dsp",
+			"msm-pcm-voice", "msm-pcm-loopback",
+			"msm-compress-dsp", "msm-pcm-hostless",
+			"msm-pcm-afe", "msm-lsm-client",
+			"msm-pcm-routing", "msm-pcm-dsp-noirq";
+		asoc-cpu = <&dai_pri_auxpcm>,
+			<&dai_mi2s0>, <&dai_mi2s1>,
+			<&dai_mi2s2>, <&dai_mi2s3>,
+			<&dai_mi2s4>, <&dai_mi2s5>,
+			<&sb_0_rx>, <&sb_0_tx>, <&sb_1_rx>, <&sb_1_tx>,
+			<&sb_3_rx>, <&sb_3_tx>, <&sb_4_rx>, <&sb_4_tx>,
+			<&bt_sco_rx>, <&bt_sco_tx>,
+			<&int_fm_rx>, <&int_fm_tx>,
+			<&afe_pcm_rx>, <&afe_pcm_tx>,
+			<&afe_proxy_rx>, <&afe_proxy_tx>,
+			<&incall_record_rx>, <&incall_record_tx>,
+			<&incall_music_rx>, <&incall_music_2_rx>,
+			<&bt_a2dp_rx>, <&afe_loopback_tx>;
+
+		asoc-cpu-names = "msm-dai-q6-auxpcm.1",
+			"msm-dai-q6-mi2s.0", "msm-dai-q6-mi2s.1",
+			"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+			"msm-dai-q6-mi2s.4", "msm-dai-q6-mi2s.6",
+			"msm-dai-q6-dev.16384", "msmdai-q6-dev.16385",
+			"msm-dai-q6-dev.16386", "msm-dai-q6-dev.16387",
+			"msm-dai-q6-dev.16390", "msm-dai-q6-dev.16391",
+			"msm-dai-q6-dev.16392", "msm-dai-q6-dev.16393",
+			"msm-dai-q6-dev.12288", "msm-dai-q6-dev.12289",
+			"msm-dai-q6-dev.12292", "msm-dai-q6-dev.12293",
+			"msm-dai-q6-dev.224", "msm-dai-q6-dev.225",
+			"msm-dai-q6-dev.241", "msm-dai-q6-dev.240",
+			"msm-dai-q6-dev.32771", "msm-dai-q6-dev.32772",
+			"msm-dai-q6-dev.32773", "msm-dai-q6-dev.32770",
+			"msm-dai-q6-dev.12290", "msm-dai-q6-dev.24577";
+
+		asoc-codec = <&stub_codec>, <&msm_digital_codec>,
+				<&pmic_analog_codec>;
+		asoc-codec-names = "msm-stub-codec.1", "msm-dig-codec",
+				"analog-codec";
 	};
 
 	sound-9335 {
@@ -97,6 +167,72 @@
 	status = "disabled";
 };
 
+&pm8916_1 {
+	pmic_analog_codec: analog-codec@f000 {
+		compatible = "qcom,pmic-analog-codec";
+		reg = <0xf000 0x200>;
+		#address-cells = <2>;
+		#size-cells = <0>;
+		interrupt-parent = <&spmi_bus>;
+		interrupts = <0x1 0xf0 0x0 IRQ_TYPE_NONE>,
+			     <0x1 0xf0 0x1 IRQ_TYPE_NONE>,
+			     <0x1 0xf0 0x2 IRQ_TYPE_NONE>,
+			     <0x1 0xf0 0x3 IRQ_TYPE_NONE>,
+			     <0x1 0xf0 0x4 IRQ_TYPE_NONE>,
+			     <0x1 0xf0 0x5 IRQ_TYPE_NONE>,
+			     <0x1 0xf0 0x6 IRQ_TYPE_NONE>,
+			     <0x1 0xf0 0x7 IRQ_TYPE_NONE>,
+			     <0x1 0xf1 0x0 IRQ_TYPE_NONE>,
+			     <0x1 0xf1 0x1 IRQ_TYPE_NONE>,
+			     <0x1 0xf1 0x2 IRQ_TYPE_NONE>,
+			     <0x1 0xf1 0x3 IRQ_TYPE_NONE>,
+			     <0x1 0xf1 0x4 IRQ_TYPE_NONE>,
+			     <0x1 0xf1 0x5 IRQ_TYPE_NONE>;
+		interrupt-names = "spk_cnp_int",
+				   "spk_clip_int",
+				   "spk_ocp_int",
+				   "ins_rem_det1",
+				   "but_rel_det",
+				   "but_press_det",
+				   "ins_rem_det",
+				   "mbhc_int",
+				   "ear_ocp_int",
+				   "hphr_ocp_int",
+				   "hphl_ocp_det",
+				   "ear_cnp_int",
+				   "hphr_cnp_int",
+				   "hphl_cnp_int";
+
+		cdc-vdda-cp-supply = <&pm8916_s4>;
+		qcom,cdc-vdda-cp-voltage = <1800000 2200000>;
+		qcom,cdc-vdda-cp-current = <770000>;
+
+		cdc-vdd-pa-supply = <&pm8916_l5>;
+		qcom,cdc-vdd-pa-voltage = <1800000 1800000>;
+		qcom,cdc-vdd-pa-current = <5000>;
+
+		cdc-vdd-mic-bias-supply = <&pm8916_l13>;
+		qcom,cdc-vdd-mic-bias-voltage = <3075000 3075000>;
+		qcom,cdc-vdd-mic-bias-current = <25000>;
+
+		qcom,cdc-mclk-clk-rate = <9600000>;
+
+		qcom,cdc-static-supplies = "cdc-vdda-cp",
+					   "cdc-vdd-pa";
+
+		qcom,cdc-on-demand-supplies = "cdc-vdd-mic-bias";
+
+		msm_digital_codec: msm-dig-codec {
+			compatible = "qcom,msm-digital-codec";
+			reg = <0x0771C000 0x0>;
+			cdc-vdd-digital-supply = <&pm8916_l5>;
+			qcom,cdc-vdd-digital-voltage = <1800000 1800000>;
+			qcom,cdc-vdd-digital-current = <5000>;
+			qcom,cdc-on-demand-supplies = "cdc-vdd-digital";
+		};
+	};
+};
+
 &msm_gpio {
 	sdc2_wlan_gpio_on: sdc2_wlan_gpio_on {
 		mux {
@@ -156,8 +292,8 @@
 };
 
 &usb_otg {
-	interrupts = <0 134 0>,<0 140 0>,<0 136 0>;
-	interrupt-names = "core_irq", "async_irq", "phy_irq";
+	interrupts = <0 134 0>,<0 140 0>;
+	interrupt-names = "core_irq", "async_irq";
 	qcom,hsusb-otg-mode = <3>;
 	qcom,switch-vbus-w-id;
 	vbus_otg-supply = <&vph_pwr_vreg>;
@@ -192,7 +328,7 @@
 		qcom,recharge-thresh-mv = <100>;
 		qcom,thermal-mitigation = <1500 700 600 0>;
 		regulator-name = "smb1360_otg_vreg";
-		status= "disabled";
+		status= "okay";
 	};
 };
 
@@ -221,3 +357,7 @@
 &blsp1_uart2_hs {
 	status = "ok";
 };
+
+&blsp1_uart1 {
+	status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/apq8009-robot-pronto-refboard.dts b/arch/arm64/boot/dts/qcom/apq8009-robot-pronto-refboard.dts
index 4a625f8..3a421bf 100644
--- a/arch/arm64/boot/dts/qcom/apq8009-robot-pronto-refboard.dts
+++ b/arch/arm64/boot/dts/qcom/apq8009-robot-pronto-refboard.dts
@@ -172,7 +172,7 @@
 
 			cdc-vdda-cp-supply = <&pm8916_s4>;
 			qcom,cdc-vdda-cp-voltage = <1800000 2100000>;
-			qcom,cdc-vdda-cp-current = <1800000>;
+			qcom,cdc-vdda-cp-current = <770000>;
 
 			cdc-vdd-io-supply = <&pm8916_l5>;
 			qcom,cdc-vdd-io-voltage = <1800000 1800000>;
@@ -180,7 +180,7 @@
 
 			cdc-vdd-pa-supply = <&pm8916_s4>;
 			qcom,cdc-vdd-pa-voltage = <1800000 2100000>;
-			qcom,cdc-vdd-pa-current = <1800000>;
+			qcom,cdc-vdd-pa-current = <5000>;
 
 			cdc-vdd-mic-bias-supply = <&pm8916_l13>;
 			qcom,cdc-vdd-mic-bias-voltage = <3075000 3075000>;
@@ -298,6 +298,87 @@
 		pinctrl-0 = <&cdc_pdm_lines_act>;
 		pinctrl-1 = <&cdc_pdm_lines_sus>;
 	};
+	thermal-zones {
+		xo-therm-buf-adc {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8916_vadc 0x3c>;
+			thermal-governor = "user_space";
+
+			trips {
+				active-config0 {
+					temperature = <65000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		xo-therm-adc {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8916_vadc 0x32>;
+			thermal-governor = "user_space";
+
+			trips {
+				active-config0 {
+					temperature = <65000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pa-therm0-adc {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8916_vadc 0x36>;
+			thermal-governor = "user_space";
+
+			trips {
+				active-config0 {
+					temperature = <65000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+		mdm-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+		camera-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+		gpu-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+		cpu0-2-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+		cpu1-3-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+	};
 };
 
 &msm_gpio {
diff --git a/arch/arm64/boot/dts/qcom/apq8009-robot-rome-refboard.dts b/arch/arm64/boot/dts/qcom/apq8009-robot-rome-refboard.dts
index 0938d86..e00eb01 100644
--- a/arch/arm64/boot/dts/qcom/apq8009-robot-rome-refboard.dts
+++ b/arch/arm64/boot/dts/qcom/apq8009-robot-rome-refboard.dts
@@ -168,7 +168,7 @@
 
 			cdc-vdda-cp-supply = <&pm8916_s4>;
 			qcom,cdc-vdda-cp-voltage = <1800000 2100000>;
-			qcom,cdc-vdda-cp-current = <1800000>;
+			qcom,cdc-vdda-cp-current = <770000>;
 
 			cdc-vdd-io-supply = <&pm8916_l5>;
 			qcom,cdc-vdd-io-voltage = <1800000 1800000>;
@@ -176,7 +176,7 @@
 
 			cdc-vdd-pa-supply = <&pm8916_s4>;
 			qcom,cdc-vdd-pa-voltage = <1800000 2100000>;
-			qcom,cdc-vdd-pa-current = <1800000>;
+			qcom,cdc-vdd-pa-current = <5000>;
 
 			cdc-vdd-mic-bias-supply = <&pm8916_l13>;
 			qcom,cdc-vdd-mic-bias-voltage = <3075000 3075000>;
@@ -293,6 +293,87 @@
 		pinctrl-0 = <&cdc_pdm_lines_act>;
 		pinctrl-1 = <&cdc_pdm_lines_sus>;
 	};
+	thermal-zones {
+		xo-therm-buf-adc {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8916_vadc 0x3c>;
+			thermal-governor = "user_space";
+
+			trips {
+				active-config0 {
+					temperature = <65000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		xo-therm-adc {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8916_vadc 0x32>;
+			thermal-governor = "user_space";
+
+			trips {
+				active-config0 {
+					temperature = <65000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+
+		pa-therm0-adc {
+			polling-delay-passive = <0>;
+			polling-delay = <0>;
+			thermal-sensors = <&pm8916_vadc 0x36>;
+			thermal-governor = "user_space";
+
+			trips {
+				active-config0 {
+					temperature = <65000>;
+					hysteresis = <1000>;
+					type = "passive";
+				};
+			};
+		};
+		mdm-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+		camera-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+		gpu-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+		cpu0-2-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+		cpu1-3-lowf {
+			cooling-maps {
+				cx_vdd_cdev {
+					cooling-device = <&pm8916_cx_cdev 0 0>;
+				};
+			};
+		};
+	};
 };
 
 &wcnss {
diff --git a/arch/arm64/boot/dts/qcom/apq8017.dtsi b/arch/arm64/boot/dts/qcom/apq8017.dtsi
index fecc7ce8..f2e1a89 100644
--- a/arch/arm64/boot/dts/qcom/apq8017.dtsi
+++ b/arch/arm64/boot/dts/qcom/apq8017.dtsi
@@ -12,6 +12,8 @@
  */
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
+
 / {
 	model = "Qualcomm Technologies, Inc. APQ8017";
 	compatible = "qcom,apq8017";
diff --git a/arch/arm64/boot/dts/qcom/dsi-panel-r63417-truly-1080p-cmd.dtsi b/arch/arm64/boot/dts/qcom/dsi-panel-r63417-truly-1080p-cmd.dtsi
new file mode 100644
index 0000000..29aab25
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/dsi-panel-r63417-truly-1080p-cmd.dtsi
@@ -0,0 +1,104 @@
+/* Copyright (c) 2015-2016, 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&mdss_mdp {
+	dsi_r63417_truly_1080_cmd: qcom,mdss_dsi_r63417_truly_1080p_cmd {
+		qcom,mdss-dsi-panel-name =
+			"r63417 truly 1080p cmd mode dsi panel";
+		qcom,mdss-dsi-panel-type = "dsi_cmd_mode";
+		qcom,mdss-dsi-virtual-channel-id = <0>;
+		qcom,mdss-dsi-stream = <0>;
+		qcom,mdss-dsi-bpp = <24>;
+		qcom,mdss-dsi-underflow-color = <0xff>;
+		qcom,mdss-dsi-border-color = <0>;
+		qcom,mdss-dsi-te-pin-select = <1>;
+		qcom,mdss-dsi-te-dcs-command = <1>;
+		qcom,mdss-dsi-te-check-enable;
+		qcom,mdss-dsi-te-using-te-pin;
+		qcom,mdss-dsi-traffic-mode = "burst_mode";
+		qcom,mdss-dsi-bllp-eof-power-mode;
+		qcom,mdss-dsi-bllp-power-mode;
+		qcom,mdss-dsi-lane-0-state;
+		qcom,mdss-dsi-lane-1-state;
+		qcom,mdss-dsi-lane-2-state;
+		qcom,mdss-dsi-lane-3-state;
+		qcom,mdss-dsi-t-clk-post = <0x02>;
+		qcom,mdss-dsi-t-clk-pre = <0x2d>;
+		qcom,mdss-dsi-tx-eot-append;
+		qcom,mdss-dsi-dma-trigger = "trigger_sw";
+		qcom,mdss-dsi-bl-min-level = <1>;
+		qcom,mdss-dsi-bl-max-level = <4095>;
+		qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+		qcom,mdss-dsi-reset-sequence = <1 10>, <0 10>, <1 10>;
+		qcom,mdss-dsi-post-init-delay = <1>;
+		qcom,mdss-dsi-mdp-trigger = "none";
+
+		qcom,mdss-dsi-display-timings {
+			timing@0{
+		qcom,mdss-dsi-panel-width = <1080>;
+		qcom,mdss-dsi-panel-height = <1920>;
+		qcom,mdss-dsi-h-front-porch = <96>;
+		qcom,mdss-dsi-h-back-porch = <64>;
+		qcom,mdss-dsi-h-pulse-width = <16>;
+		qcom,mdss-dsi-h-sync-skew = <0>;
+		qcom,mdss-dsi-v-back-porch = <16>;
+		qcom,mdss-dsi-v-front-porch = <4>;
+		qcom,mdss-dsi-v-pulse-width = <1>;
+		qcom,mdss-dsi-h-sync-pulse = <0>;
+		qcom,mdss-dsi-h-left-border = <0>;
+		qcom,mdss-dsi-h-right-border = <0>;
+		qcom,mdss-dsi-v-top-border = <0>;
+		qcom,mdss-dsi-v-bottom-border = <0>;
+		qcom,mdss-dsi-panel-framerate = <60>;
+		qcom,mdss-dsi-on-command =
+			[23 01 00 00 00 00 02 d6 01
+			15 01 00 00 00 00 02 35 00
+			15 01 00 00 00 00 02 51 ff
+			15 01 00 00 00 00 02 53 2c
+			15 01 00 00 00 00 02 55 00
+			05 01 00 00 78 00 02 11 00
+			23 01 00 00 00 00 02 b0 04
+			29 01 00 00 00 00 07 b3 04 00 00 00 00 00
+			29 01 00 00 00 00 03 b6 3a d3
+			29 01 00 00 00 00 03 c0 00 00
+			29 01 00 00 00 00 23 c1 84 60 10 eb ff 6f ce ff ff 17 02
+				58 73 ae b1 20 c6 ff ff 1f f3 ff 5f 10 10 10 10
+				00 02 01 22 22 00 01
+			29 01 00 00 00 00 08 c2 31 f7 80 06 08 00 00
+			29 01 00 00 00 00 17 c4 70 00 00 00 00 04 00 00 00 0c 06
+				00 00 00 00 00 04 00 00 00 0c 06
+			29 01 00 00 00 00 29 c6 78 69 00 69 00 69 00 00 00 00 00
+				69 00 69 00 69 10 19 07 00 78 00 69 00 69 00 69
+				00 00 00 00 00 69 00 69 00 69 10 19 07
+			29 01 00 00 00 00 0a cb 31 fc 3f 8c 00 00 00 00 c0
+			23 01 00 00 00 00 02 cc 0b
+			29 01 00 00 00 00 0b d0 11 81 bb 1e 1e 4c 19 19 0c 00
+			29 01 00 00 00 00 1a d3 1b 33 bb bb b3 33 33 33 00 01 00
+				a0 d8 a0 0d 4e 4e 33 3b 22 72 07 3d bf 33
+			29 01 00 00 00 00 08 d5 06 00 00 01 51 01 32
+			29 01 00 00 00 00 1f c7 01 0a 11 18 26 33 3e 50 38 42 52
+				60 67 6e 77 01 0a 11 18 26 33 3e 50 38 42 52 60
+				67 6e 77
+			29 01 00 00 14 00 14 c8 01 00 00 00 00 fc 00 00 00 00
+				00 fc 00 00 00 00 00 fc 00
+			05 01 00 00 14 00 02 29 00];
+		qcom,mdss-dsi-off-command = [05 01 00 00 14 00 02 28 00
+				 05 01 00 00 78 00 02 10 00];
+		qcom,mdss-dsi-on-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-off-command-state = "dsi_lp_mode";
+		qcom,mdss-dsi-panel-timings =
+				[e6 38 26 00 68 6e 2a 3c 44 03 04 00];
+			};
+		};
+	};
+};
+
diff --git a/arch/arm64/boot/dts/qcom/msm8909-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/msm8909-pinctrl.dtsi
index c69e699..c22259b 100644
--- a/arch/arm64/boot/dts/qcom/msm8909-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8909-pinctrl.dtsi
@@ -14,6 +14,7 @@
 	msm_gpio: pinctrl@1000000 {
 		compatible = "qcom,msm8909-pinctrl";
 		reg = <0x1000000 0x300000>;
+		reg-names = "pinctrl_regs";
 		interrupts = <0 208 0>;
 		interrupts-extended = <&wakegic GIC_SPI 208 IRQ_TYPE_NONE>;
 		gpio-controller;
@@ -1981,7 +1982,7 @@
 				config {
 					pins = "gpio4";
 					drive-strength = <8>;
-					bias-pull-none;
+					output-high;
 				};
 			};
 
@@ -1995,6 +1996,7 @@
 					pins = "gpio4";
 					drive-strength = <2>;
 					bias-disable;
+					output-low;
 				};
 			};
 
@@ -2007,7 +2009,7 @@
 				config {
 					pins = "gpio5";
 					drive-strength = <8>;
-					bias-pull-none;
+					input-enable;
 				};
 			};
 
@@ -2084,6 +2086,62 @@
 			};
 		};
 
+		amp_mute {
+			label = "amp_mute";
+			amp_mute_active: amp_mute_active {
+				mux {
+					pins = "gpio84";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio84";
+					drive-strength = <8>;   /* 8 MA */
+					bias-pull-up;           /*  PULL UP */
+					output-high;
+				};
+			};
+
+			amp_mute_sleep: amp_mute_sleep {
+				mux {
+					pins = "gpio84";
+					function = "gpio";
+				};
+				configs {
+					pins = "gpio84";
+					drive-strength = <2>;   /* 2 MA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+		};
+
+		ext_amp_ctrl {
+			label = "ext_amp_ctrl";
+			ext_amp_ctrl_active: ext_amp_ctrl_active {
+				mux {
+					pins = "gpio25";
+					function = "gpio";
+				};
+				config {
+					pins = "gpio25";
+					drive-strength = <8>;   /* 8 MA */
+					bias-pull-up;           /*  PULL UP */
+					output-high;
+				};
+			};
+
+			ext_amp_ctrl_sleep: ext_amp_ctrl_sleep {
+				mux {
+					pins = "gpio25";
+					function = "gpio";
+				};
+				configs {
+					pins = "gpio25";
+					drive-strength = <2>;   /* 2 MA */
+					bias-pull-down;         /* PULL DOWN */
+				};
+			};
+		};
+
 		pmx_i2s_mclk {
 			label = "i2s_mclk";
 			i2s_mclk_active: i2s_mclk_active {
diff --git a/arch/arm64/boot/dts/qcom/msm8909.dtsi b/arch/arm64/boot/dts/qcom/msm8909.dtsi
index 15c6424..119d2d2 100644
--- a/arch/arm64/boot/dts/qcom/msm8909.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8909.dtsi
@@ -1465,6 +1465,12 @@
 		compatible = "qcom,msm-pcm-loopback";
 	};
 
+	pcm_noirq: qcom,msm-pcm-dsp-noirq {
+		compatible = "qcom,msm-pcm-dsp-noirq";
+		qcom,msm-pcm-low-latency;
+		qcom,latency-level = "ultra";
+	};
+
 	qcom,msm-dai-mi2s {
 		compatible = "qcom,msm-dai-mi2s";
 		dai_mi2s0: qcom,msm-dai-q6-mi2s-prim {
diff --git a/arch/arm64/boot/dts/qcom/msm8917-cdp.dtsi b/arch/arm64/boot/dts/qcom/msm8917-cdp.dtsi
index 7690931..761e2d2 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-cdp.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8917-cdp.dtsi
@@ -116,6 +116,8 @@
 
 &dsi_truly_720_vid {
 	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-min-refresh-rate = <48>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
 	qcom,mdss-dsi-pan-enable-dynamic-fps;
 	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
 };
diff --git a/arch/arm64/boot/dts/qcom/msm8917-mtp.dtsi b/arch/arm64/boot/dts/qcom/msm8917-mtp.dtsi
index 9a3b6dae..2330c76 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-mtp.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8917-mtp.dtsi
@@ -175,6 +175,8 @@
 
 &dsi_truly_720_vid {
 	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-min-refresh-rate = <48>;
+	qcom,mdss-dsi-max-refresh-rate = <60>;
 	qcom,mdss-dsi-pan-enable-dynamic-fps;
 	qcom,mdss-dsi-pan-fps-update = "dfps_immediate_porch_mode_vfp";
 };
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/msm8917-pinctrl.dtsi
index 0e613b6..8238b98 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8917-pinctrl.dtsi
@@ -15,6 +15,7 @@
 	tlmm: pinctrl@1000000 {
 		compatible = "qcom,msm8917-pinctrl";
 		reg = <0x1000000 0x300000>;
+		reg-names = "pinctrl_regs";
 		interrupts-extended = <&wakegic GIC_SPI 208 IRQ_TYPE_NONE>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8937-cdp.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8937-cdp.dts
index 9d8a2eb..be6dc5a 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8937-cdp.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8937-cdp.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-cdp.dtsi"
 #include "msm8917-pmi8937.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8937-mtp.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8937-mtp.dts
index e5207fe..4938b6a 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8937-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8937-mtp.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-mtp.dtsi"
 #include "msm8917-pmi8937.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8937-qrd-sku5.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8937-qrd-sku5.dts
index 832a0ab..746fd56 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8937-qrd-sku5.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8937-qrd-sku5.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-qrd.dtsi"
 #include "msm8917-pmi8937.dtsi"
 #include "msm8937-mdss-panels.dtsi"
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8937-rcm.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8937-rcm.dts
index c7fe115..12d3218 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8937-rcm.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8937-rcm.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-cdp.dtsi"
 #include "msm8917-pmi8937.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8937.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8937.dts
index 635705b..aa77af5 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8937.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8937.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-pmi8937.dtsi"
 
 / {
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8940-cdp.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8940-cdp.dts
index 9785a4f..a1a9956 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8940-cdp.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8940-cdp.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-cdp.dtsi"
 #include "msm8917-pmi8940.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8940-mtp.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8940-mtp.dts
index 8379228..7a29603 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8940-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8940-mtp.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-mtp.dtsi"
 #include "msm8917-pmi8940.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8940-rcm.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8940-rcm.dts
index 2cab716..2515276 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8940-rcm.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8940-rcm.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-cdp.dtsi"
 #include "msm8917-pmi8940.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8940.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8940.dts
index e4017c7..648dcb7 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8940.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8940.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-pmi8940.dtsi"
 
 / {
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-cdp-mirror-lake-touch.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-cdp-mirror-lake-touch.dts
index ae35baf..cc3e6dc 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-cdp-mirror-lake-touch.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-cdp-mirror-lake-touch.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-pmi8950.dtsi"
 #include "msm8917-cdp.dtsi"
 #include "msm8917-pmi8950-cdp-mirror-lake-touch.dtsi"
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-cdp.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-cdp.dts
index a32e2b3..74c1d4b 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-cdp.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-cdp.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-cdp.dtsi"
 #include "msm8917-pmi8950.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-ext-codec-cdp.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-ext-codec-cdp.dts
index 91c4f3a..014874b 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-ext-codec-cdp.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-ext-codec-cdp.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-cdp.dtsi"
 #include "msm8917-pmi8950.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-mtp.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-mtp.dts
index 5b458b2..b194a34 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-mtp.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-mtp.dtsi"
 #include "msm8917-pmi8950.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-rcm.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-rcm.dts
index a91bea1..79c44ac 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8950-rcm.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8950-rcm.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-cdp.dtsi"
 #include "msm8917-pmi8950.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8917-pmi8950.dts b/arch/arm64/boot/dts/qcom/msm8917-pmi8950.dts
index 4a904c6..0a254f8 100644
--- a/arch/arm64/boot/dts/qcom/msm8917-pmi8950.dts
+++ b/arch/arm64/boot/dts/qcom/msm8917-pmi8950.dts
@@ -14,6 +14,7 @@
 /dts-v1/;
 
 #include "msm8917.dtsi"
+#include "msm8917-audio.dtsi"
 #include "msm8917-pmi8950.dtsi"
 
 / {
diff --git a/arch/arm64/boot/dts/qcom/msm8917.dtsi b/arch/arm64/boot/dts/qcom/msm8917.dtsi
index 0051894..cb520bd 100644
--- a/arch/arm64/boot/dts/qcom/msm8917.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8917.dtsi
@@ -1652,7 +1652,6 @@
 #include "pm8937-rpm-regulator.dtsi"
 #include "msm8917-regulator.dtsi"
 #include "pm8937.dtsi"
-#include "msm8917-audio.dtsi"
 #include "msm-gdsc-8916.dtsi"
 #include "msm8917-thermal.dtsi"
 
diff --git a/arch/arm64/boot/dts/qcom/msm8937-coresight.dtsi b/arch/arm64/boot/dts/qcom/msm8937-coresight.dtsi
index e64af14..e599b31 100644
--- a/arch/arm64/boot/dts/qcom/msm8937-coresight.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8937-coresight.dtsi
@@ -1083,7 +1083,7 @@
 	modem_etm0 {
 		compatible = "qcom,coresight-remote-etm";
 		coresight-name = "coresight-modem-etm0";
-		qcom,inst-id = <11>;
+		qcom,inst-id = <2>;
 
 		port {
 			modem_etm0_out_funnel_right: endpoint {
diff --git a/arch/arm64/boot/dts/qcom/msm8937-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/msm8937-pinctrl.dtsi
index a730287..f07069c 100644
--- a/arch/arm64/boot/dts/qcom/msm8937-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8937-pinctrl.dtsi
@@ -15,6 +15,7 @@
 	tlmm: pinctrl@1000000 {
 		compatible = "qcom,msm8937-pinctrl";
 		reg = <0x1000000 0x300000>;
+		reg-names = "pinctrl_regs";
 		interrupts-extended = <&wakegic GIC_SPI 208 IRQ_TYPE_NONE>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/arch/arm64/boot/dts/qcom/msm8937.dtsi b/arch/arm64/boot/dts/qcom/msm8937.dtsi
index 1c13051..b440cb60 100644
--- a/arch/arm64/boot/dts/qcom/msm8937.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8937.dtsi
@@ -914,7 +914,6 @@
 		qcom,vdd-voltage-level = <0 1200000 1200000>;
 		vbus_otg-supply = <&smbcharger_charger_otg>;
 
-		qcom,hsusb-otg-phy-init-seq = <0x06 0x82 0xffffffff>;
 		qcom,hsusb-otg-phy-type = <3>; /* SNPS Femto PHY */
 		qcom,hsusb-otg-mode = <3>; /* OTG mode */
 		qcom,hsusb-otg-otg-control = <2>; /* PMIC */
diff --git a/arch/arm64/boot/dts/qcom/msm8953-camera.dtsi b/arch/arm64/boot/dts/qcom/msm8953-camera.dtsi
index b7f060a..adfc73f 100644
--- a/arch/arm64/boot/dts/qcom/msm8953-camera.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8953-camera.dtsi
@@ -328,6 +328,12 @@
 		max-clk-turbo = <465000000>;
 	};
 
+	qcom,adsp {
+		status = "ok";
+		compatible = "adsp-shmem-device";
+		memory-region = <&adsp_shmem_device_mem>;
+	};
+
 	qcom,vfe {
 		compatible = "qcom,vfe";
 		num_child = <2>;
diff --git a/arch/arm64/boot/dts/qcom/msm8953-gpu.dtsi b/arch/arm64/boot/dts/qcom/msm8953-gpu.dtsi
index 14c4d2b..f82b68d 100644
--- a/arch/arm64/boot/dts/qcom/msm8953-gpu.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8953-gpu.dtsi
@@ -231,8 +231,8 @@
 			qcom,gpu-pwrlevel@5 {
 				reg = <5>;
 				qcom,gpu-freq = <216000000>;
-				qcom,bus-freq = <3>;
-				qcom,bus-min = <2>;
+				qcom,bus-freq = <1>;
+				qcom,bus-min = <1>;
 				qcom,bus-max = <4>;
 			};
 
@@ -240,7 +240,7 @@
 			qcom,gpu-pwrlevel@6 {
 				reg = <6>;
 				qcom,gpu-freq = <133300000>;
-				qcom,bus-freq = <3>;
+				qcom,bus-freq = <1>;
 				qcom,bus-min = <1>;
 				qcom,bus-max = <4>;
 			};
diff --git a/arch/arm64/boot/dts/qcom/msm8953-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/msm8953-pinctrl.dtsi
index 72513e1..9da42f9 100644
--- a/arch/arm64/boot/dts/qcom/msm8953-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8953-pinctrl.dtsi
@@ -15,6 +15,7 @@
 	tlmm: pinctrl@1000000 {
 		compatible = "qcom,msm8953-pinctrl";
 		reg = <0x1000000 0x300000>;
+		reg-names = "pinctrl_regs";
 		interrupts = <0 208 0>;
 		interrupts-extended = <&wakegic GIC_SPI 208 IRQ_TYPE_NONE>;
 		gpio-controller;
diff --git a/arch/arm64/boot/dts/qcom/msm8953.dtsi b/arch/arm64/boot/dts/qcom/msm8953.dtsi
index cee178f..b7d72b7 100644
--- a/arch/arm64/boot/dts/qcom/msm8953.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8953.dtsi
@@ -136,6 +136,11 @@
 			label = "cont_splash_mem";
 		};
 
+		adsp_shmem_device_mem: adsp_shmem_device_region@0xc0100000 {
+			reg = <0x0 0xc0100000 0x0 0x08200000>;
+			label = "adsp_shmem_device_mem";
+		};
+
 		gpu_mem: gpu_region@0 {
 			compatible = "shared-dma-pool";
 			reusable;
diff --git a/arch/arm64/boot/dts/qcom/pmi632.dtsi b/arch/arm64/boot/dts/qcom/pmi632.dtsi
index d175b80..93516a1 100644
--- a/arch/arm64/boot/dts/qcom/pmi632.dtsi
+++ b/arch/arm64/boot/dts/qcom/pmi632.dtsi
@@ -638,6 +638,13 @@
 				regulator-min-microvolt = <4000000>;
 				regulator-max-microvolt = <6000000>;
 			};
+
+			lcdb_bst_vreg: bst {
+				label = "bst";
+				regulator-name = "lcdb_bst";
+				regulator-min-microvolt = <4700000>;
+				regulator-max-microvolt = <6275000>;
+			};
 		};
 
 		flash_led: qcom,leds@d300 {
diff --git a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dtsi b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dtsi
index 51e9e1b..e661e9b 100644
--- a/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dtsi
+++ b/arch/arm64/boot/dts/qcom/qcs605-lc-ipcamera.dtsi
@@ -83,16 +83,6 @@
 	status = "ok";
 };
 
-&usb0 {
-	dwc3@a600000 {
-		dr_mode = "host";
-	};
-};
-
-&icnss {
-	status = "disabled";
-};
-
 &msm_sdw_codec {
 	status = "disabled";
 };
diff --git a/arch/arm64/boot/dts/qcom/qcs605-lc-mtp-no-hdcp.dts b/arch/arm64/boot/dts/qcom/qcs605-lc-mtp-no-hdcp.dts
index 4348e580..513a28b 100644
--- a/arch/arm64/boot/dts/qcom/qcs605-lc-mtp-no-hdcp.dts
+++ b/arch/arm64/boot/dts/qcom/qcs605-lc-mtp-no-hdcp.dts
@@ -23,3 +23,47 @@
 	compatible = "qcom,qcs605-mtp", "qcom,qcs605", "qcom,mtp";
 	qcom,board-id = <8 8>;
 };
+
+&mdss_mdp {
+		status = "disabled";
+};
+
+&sde_rscc {
+		status = "disabled";
+};
+
+&sde_wb {
+		status = "disabled";
+};
+
+&mdss_rotator {
+		status = "disabled";
+};
+
+&mdss_dsi0 {
+		status = "disabled";
+};
+
+&mdss_dsi_phy0 {
+		status = "disabled";
+};
+
+&sde_dp {
+		status = "disabled";
+};
+
+&mdss_dsi0_pll {
+		status = "disabled";
+};
+
+&mdss_dp_pll {
+		status = "disabled";
+};
+
+&ext_disp {
+		status = "disabled";
+};
+
+&ext_dsi_bridge_display {
+		status = "disabled";
+};
diff --git a/arch/arm64/boot/dts/qcom/qm215-pm8916.dtsi b/arch/arm64/boot/dts/qcom/qm215-pm8916.dtsi
new file mode 100644
index 0000000..c2d9aea
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/qm215-pm8916.dtsi
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/* delete PMIC specific nodes */
+&soc {
+	/* delete rpm-smd base node to delete all regulator in one shot */
+	/delete-node/ qcom,rpm-smd;
+
+	/* add rpm-smd node again */
+	rpm_bus: qcom,rpm-smd {
+		compatible = "qcom,rpm-smd";
+		rpm-channel-name = "rpm_requests";
+		rpm-channel-type = <15>; /* SMD_APPS_RPM */
+	};
+
+	/* delete all pmic nodes */
+	qcom,spmi@200f000 {
+		/delete-node/ qcom,pm8937@0;
+		/delete-node/ qcom,pm8937@1;
+	};
+};
+
+/* delete all node referring PM8937 */
+&soc {
+	/delete-node/ thermal-zones;
+
+	qcom,cpu-clock-8939@b111050 {
+		/delete-property/ vdd-c1-supply;
+	};
+
+	qcom,gcc@1800000 {
+		/delete-property/ vdd_dig-supply;
+		/delete-property/ vdd_hf_dig-supply;
+		/delete-property/ vdd_hf_pll-supply;
+	};
+
+	usb@78db000 {
+		/delete-property/ hsusb_vdd_dig-supply;
+		/delete-property/ HSUSB_1p8-supply;
+		/delete-property/ HSUSB_3p3-supply;
+		/delete-property/ vbus_otg-supply;
+	};
+
+	qcom,mss@4080000 {
+		/delete-property/ vdd_mss-supply;
+		/delete-property/ vdd_cx-supply;
+		/delete-property/ vdd_mx-supply;
+		/delete-property/ vdd_pll-supply;
+	};
+
+	qcom,lpass@c200000 {
+		/delete-property/ vdd_cx-supply;
+	};
+
+	qcom,pronto@a21b000 {
+		/delete-property/ vdd_pronto_pll-supply;
+	};
+
+	qcom,wcnss-wlan@a000000 {
+		/delete-property/ qcom,pronto-vddmx-supply;
+		/delete-property/ qcom,pronto-vddcx-supply;
+		/delete-property/ qcom,pronto-vddpx-supply;
+		/delete-property/ qcom,iris-vddxo-supply;
+		/delete-property/ qcom,iris-vddrfa-supply;
+		/delete-property/ qcom,iris-vddpa-supply;
+		/delete-property/ qcom,iris-vdddig-supply;
+		/delete-property/ qcom,wcnss-adc_tm;
+	};
+
+	/delete-node/ qcom,gcc-mdss@1800000;
+
+	/delete-node/ qcom,csid@1b30000;
+	/delete-node/ qcom,csid@1b30400;
+	/delete-node/ qcom,csid@1b30800;
+
+	/delete-node/ qcom,mdss_mdp@1a00000;
+	/delete-node/ qcom,mdss_dsi@0;
+	/delete-node/ qcom,mdss_wb_panel;
+	/delete-node/ qcom,mdss_rotator;
+	/delete-node/ qcom,mdss_dsi_pll@1a94a00;
+	/delete-node/ qcom,mdss_dsi_pll@1a96a00;
+
+	/* mem_acc */
+	/delete-node/ regulator@01946004;
+	/* apc vreg */
+	/delete-node/ regulator@b018000;
+	/delete-node/ eldo2;
+	/delete-node/ adv_vreg;
+};
+
+#include "pm8916-rpm-regulator.dtsi"
+#include "pm8916.dtsi"
+
+&spmi_bus {
+	pm8916@1 {
+		/delete-node/ msm8x16_wcd_codec@f000;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/qm215-qrd-overlay.dts b/arch/arm64/boot/dts/qcom/qm215-qrd-overlay.dts
new file mode 100644
index 0000000..f3ed40c
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/qm215-qrd-overlay.dts
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include "qm215-qrd.dtsi"
+
+/ {
+	model = "QRD";
+	qcom,board-id = <0x01000b 4>;
+};
diff --git a/arch/arm64/boot/dts/qcom/qm215-qrd.dts b/arch/arm64/boot/dts/qcom/qm215-qrd.dts
new file mode 100644
index 0000000..9e56230
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/qm215-qrd.dts
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "qm215.dtsi"
+#include "qm215-pm8916.dtsi"
+#include "qm215-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. qm215 QRD";
+	compatible = "qcom,qm215-qrd", "qcom,qm215", "qcom,qrd";
+	qcom,board-id = <0x01000b 4>;
+	qcom,pmic-id = <0x010016 0x25 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/qm215-qrd.dtsi b/arch/arm64/boot/dts/qcom/qm215-qrd.dtsi
new file mode 100644
index 0000000..5731bab
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/qm215-qrd.dtsi
@@ -0,0 +1,35 @@
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+&blsp1_uart2 {
+	status = "ok";
+};
+
+&soc {
+	gpio_keys {
+		compatible = "gpio-keys";
+		input-name = "gpio-keys";
+		pinctrl-names = "default";
+		pinctrl-0 = <&gpio_key_active>;
+
+		vol_up {
+			label = "volume_up";
+			gpios = <&tlmm 91 0x1>;
+			linux,input-type = <1>;
+			linux,code = <115>;
+			debounce-interval = <15>;
+			linux,can-disable;
+			gpio-key,wakeup;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/qm215.dts b/arch/arm64/boot/dts/qcom/qm215.dts
new file mode 100644
index 0000000..3fd0064
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/qm215.dts
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+
+#include "qm215.dtsi"
+#include "qm215-pm8916.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. QM215 QRD";
+	compatible = "qcom,qm215";
+};
diff --git a/arch/arm64/boot/dts/qcom/qm215.dtsi b/arch/arm64/boot/dts/qcom/qm215.dtsi
new file mode 100644
index 0000000..2d5dd3f
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/qm215.dtsi
@@ -0,0 +1,19 @@
+/*
+ * Copyright (c) 2015-2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm8917.dtsi"
+/ {
+	model = "Qualcomm Technologies, Inc. QM215";
+	compatible = "qcom,qm215";
+	qcom,msm-id = <386 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm429.dtsi b/arch/arm64/boot/dts/qcom/sdm429.dtsi
index 9bb8a6c..0a8aab3 100644
--- a/arch/arm64/boot/dts/qcom/sdm429.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm429.dtsi
@@ -94,18 +94,6 @@
 				< 1804800 5712 >;
 		};
 	};
-
-	qcom,ion {
-		/delete-node/ qcom,ion-heap@8;
-	};
-};
-
-&secure_mem {
-	status = "disabled";
-};
-
-&kgsl_msm_iommu {
-	/delete-node/ gfx3d_secure;
 };
 
 &funnel_apss {
@@ -217,6 +205,17 @@
 
 		#clock-cells = <1>;
 	};
+
+	/* Disable secure_mem node */
+	qcom,ion {
+		/delete-node/ qcom,ion-heap@8;
+	};
+	/* delete hypervisor node for GPU*/
+	/delete-node/ qcom,kgsl-hyp;
+};
+
+&secure_mem {
+	status = "disabled";
 };
 
 &clock_gcc_mdss {
@@ -238,3 +237,8 @@
 	/* disable mem pools */
 	/delete-node/qcom,gpu-mempools;
 };
+
+/* Disable secure context for Graphics*/
+&kgsl_msm_iommu {
+	/delete-node/ gfx3d_secure;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm439.dtsi b/arch/arm64/boot/dts/qcom/sdm439.dtsi
index ef8ea1f3..ef22440 100644
--- a/arch/arm64/boot/dts/qcom/sdm439.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm439.dtsi
@@ -661,3 +661,7 @@
 		};
 	};
 };
+
+&usb_otg {
+	qcom,hsusb-otg-phy-init-seq = <0x06 0x82 0xffffffff>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sdm670-cdp.dtsi b/arch/arm64/boot/dts/qcom/sdm670-cdp.dtsi
index 95fb25a..5200fd2 100644
--- a/arch/arm64/boot/dts/qcom/sdm670-cdp.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670-cdp.dtsi
@@ -217,6 +217,22 @@
 	qcom,platform-te-gpio = <&tlmm 10 0>;
 };
 
+&dsi_sharp_1080_cmd {
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,platform-reset-gpio = <&tlmm 75 0>;
+};
+
+&dsi_r63417_truly_1080_cmd {
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,platform-reset-gpio = <&tlmm 75 0>;
+};
+
 &dsi_sim_vid {
 	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
 	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
diff --git a/arch/arm64/boot/dts/qcom/sdm670-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/sdm670-pinctrl.dtsi
index 0453cee..cfd96cb3 100644
--- a/arch/arm64/boot/dts/qcom/sdm670-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670-pinctrl.dtsi
@@ -13,7 +13,8 @@
 &soc {
 	tlmm: pinctrl@03400000 {
 		compatible = "qcom,sdm670-pinctrl";
-		reg = <0x03400000 0xc00000>;
+		reg = <0x03400000 0xc00000>, <0x179900F0 0x60>;
+		reg-names = "pinctrl_regs", "spi_cfg_regs";
 		interrupts = <0 208 0>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/arch/arm64/boot/dts/qcom/sdm670-sde-display.dtsi b/arch/arm64/boot/dts/qcom/sdm670-sde-display.dtsi
index 5d62c5a..92d4317 100644
--- a/arch/arm64/boot/dts/qcom/sdm670-sde-display.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670-sde-display.dtsi
@@ -20,6 +20,8 @@
 #include "dsi-panel-nt35597-truly-dualmipi-wqxga-cmd.dtsi"
 #include "dsi-panel-nt35597-truly-dsc-wqxga-cmd.dtsi"
 #include "dsi-panel-nt35597-truly-dsc-wqxga-video.dtsi"
+#include "dsi-panel-sharp-1080p-cmd.dtsi"
+#include "dsi-panel-r63417-truly-1080p-cmd.dtsi"
 #include "dsi-panel-nt35597-dualmipi-wqxga-video.dtsi"
 #include "dsi-panel-nt35597-dualmipi-wqxga-cmd.dtsi"
 #include "dsi-panel-nt35695b-truly-fhd-video.dtsi"
@@ -536,6 +538,55 @@
 		};
 	};
 
+	dsi_sharp_1080_cmd_display: qcom,dsi-display@19 {
+		compatible = "qcom,dsi-display";
+		label = "dsi_sharp_1080_cmd_display";
+		qcom,display-type = "primary";
+
+		qcom,dsi-ctrl = <&mdss_dsi0>;
+		qcom,dsi-phy = <&mdss_dsi_phy0>;
+		clocks = <&mdss_dsi0_pll BYTECLK_MUX_0_CLK>,
+			<&mdss_dsi0_pll PCLK_MUX_0_CLK>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&sde_dsi_active &sde_te_active>;
+		pinctrl-1 = <&sde_dsi_suspend &sde_te_suspend>;
+		qcom,platform-te-gpio = <&tlmm 10 0>;
+		qcom,platform-reset-gpio = <&tlmm 75 0>;
+		qcom,panel-mode-gpio = <&tlmm 76 0>;
+
+		qcom,dsi-panel = <&dsi_sharp_1080_cmd>;
+		vddio-supply = <&pm660_l11>;
+		lab-supply = <&lcdb_ldo_vreg>;
+		ibb-supply = <&lcdb_ncp_vreg>;
+	};
+
+	dsi_r63417_truly_1080_cmd_display: qcom,dsi-display@20 {
+		compatible = "qcom,dsi-display";
+		label = "dsi_r63417_truly_1080_cmd_display";
+		qcom,display-type = "primary";
+
+		qcom,dsi-ctrl = <&mdss_dsi0>;
+		qcom,dsi-phy = <&mdss_dsi_phy0>;
+		clocks = <&mdss_dsi0_pll BYTECLK_MUX_0_CLK>,
+			<&mdss_dsi0_pll PCLK_MUX_0_CLK>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&sde_dsi_active &sde_te_active>;
+		pinctrl-1 = <&sde_dsi_suspend &sde_te_suspend>;
+		qcom,platform-te-gpio = <&tlmm 10 0>;
+		qcom,platform-reset-gpio = <&tlmm 75 0>;
+		qcom,panel-mode-gpio = <&tlmm 76 0>;
+
+		qcom,dsi-panel = <&dsi_r63417_truly_1080_cmd>;
+		vddio-supply = <&pm660_l11>;
+		lab-supply = <&lcdb_ldo_vreg>;
+		ibb-supply = <&lcdb_ncp_vreg>;
+	};
+
+
 	sde_wb: qcom,wb-display@0 {
 		compatible = "qcom,wb-display";
 		cell-index = <0>;
@@ -667,6 +718,48 @@
 	};
 };
 
+&dsi_sharp_1080_cmd {
+	qcom,mdss-dsi-t-clk-post = <0x0c>;
+	qcom,mdss-dsi-t-clk-pre = <0x29>;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-display-timings {
+		timing@0{
+			qcom,mdss-dsi-panel-phy-timings = [00 1E 08 08 24 22 08
+				08 05 03 04 00];
+			qcom,mdss-dsi-panel-clockrate = <900000000>;
+			qcom,display-topology = <1 0 1>;
+			qcom,default-topology-index = <0>;
+		};
+	};
+};
+
+&dsi_r63417_truly_1080_cmd {
+	qcom,mdss-dsi-t-clk-post = <0x0c>;
+	qcom,mdss-dsi-t-clk-pre = <0x29>;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x1c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x1c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-display-timings {
+		timing@0{
+			qcom,mdss-dsi-panel-phy-timings = [00 1E 08 08 24 22 08
+				08 05 03 04 00];
+			qcom,mdss-dsi-panel-clockrate = <900000000>;
+			qcom,display-topology = <1 0 1>;
+			qcom,default-topology-index = <0>;
+		};
+	};
+};
+
 &dsi_sim_vid {
 	qcom,mdss-dsi-t-clk-post = <0x0d>;
 	qcom,mdss-dsi-t-clk-pre = <0x2d>;
diff --git a/arch/arm64/boot/dts/qcom/sdm670-vidc.dtsi b/arch/arm64/boot/dts/qcom/sdm670-vidc.dtsi
index f5e9489..9c53592 100644
--- a/arch/arm64/boot/dts/qcom/sdm670-vidc.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm670-vidc.dtsi
@@ -80,7 +80,7 @@
 				<&apps_smmu 0x10a0 0x8>,
 				<&apps_smmu 0x10b0 0x0>;
 			buffer-types = <0xfff>;
-			virtual-addr-pool = <0x70800000 0x6f800000>;
+			virtual-addr-pool = <0x79000000 0x28000000>;
 		};
 
 		secure_bitstream_cb {
@@ -90,7 +90,7 @@
 				<&apps_smmu 0x10a1 0x8>,
 				<&apps_smmu 0x10a5 0x8>;
 			buffer-types = <0x241>;
-			virtual-addr-pool = <0x4b000000 0x25800000>;
+			virtual-addr-pool = <0x51000000 0x28000000>;
 			qcom,secure-context-bank;
 		};
 
@@ -100,7 +100,7 @@
 			iommus =
 				<&apps_smmu 0x10a3 0x8>;
 			buffer-types = <0x106>;
-			virtual-addr-pool = <0x25800000 0x25800000>;
+			virtual-addr-pool = <0x29000000 0x28000000>;
 			qcom,secure-context-bank;
 		};
 
@@ -111,7 +111,7 @@
 				<&apps_smmu 0x10a4 0x8>,
 				<&apps_smmu 0x10b4 0x0>;
 			buffer-types = <0x480>;
-			virtual-addr-pool = <0x1000000 0x24800000>;
+			virtual-addr-pool = <0x1000000 0x28000000>;
 			qcom,secure-context-bank;
 		};
 	};
@@ -180,7 +180,7 @@
 				<&apps_smmu 0x10a0 0x8>,
 				<&apps_smmu 0x10b0 0x0>;
 			buffer-types = <0xfff>;
-			virtual-addr-pool = <0x70800000 0x6f800000>;
+			virtual-addr-pool = <0x79000000 0x28000000>;
 		};
 
 		secure_bitstream_cb {
@@ -190,7 +190,7 @@
 				<&apps_smmu 0x10a1 0x8>,
 				<&apps_smmu 0x10a5 0x8>;
 			buffer-types = <0x241>;
-			virtual-addr-pool = <0x4b000000 0x25800000>;
+			virtual-addr-pool = <0x51000000 0x28000000>;
 			qcom,secure-context-bank;
 		};
 
@@ -200,7 +200,7 @@
 			iommus =
 				<&apps_smmu 0x10a3 0x8>;
 			buffer-types = <0x106>;
-			virtual-addr-pool = <0x25800000 0x25800000>;
+			virtual-addr-pool = <0x29000000 0x28000000>;
 			qcom,secure-context-bank;
 		};
 
@@ -211,7 +211,7 @@
 				<&apps_smmu 0x10a4 0x8>,
 				<&apps_smmu 0x10b4 0x0>;
 			buffer-types = <0x480>;
-			virtual-addr-pool = <0x1000000 0x24800000>;
+			virtual-addr-pool = <0x1000000 0x28000000>;
 			qcom,secure-context-bank;
 		};
 	};
diff --git a/arch/arm64/boot/dts/qcom/sdm845-cdp.dtsi b/arch/arm64/boot/dts/qcom/sdm845-cdp.dtsi
index 2c38f51..0c0038a 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-cdp.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-cdp.dtsi
@@ -233,6 +233,14 @@
 	qcom,platform-reset-gpio = <&tlmm 6 0>;
 };
 
+&dsi_r63417_truly_1080_cmd {
+	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
+	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
+	qcom,mdss-dsi-bl-min-level = <1>;
+	qcom,mdss-dsi-bl-max-level = <4095>;
+	qcom,platform-reset-gpio = <&tlmm 6 0>;
+};
+
 &dsi_sim_vid {
 	qcom,panel-supply-entries = <&dsi_panel_pwr_supply>;
 	qcom,mdss-dsi-bl-pmic-control-type = "bl_ctrl_wled";
diff --git a/arch/arm64/boot/dts/qcom/sdm845-interposer-pm660.dtsi b/arch/arm64/boot/dts/qcom/sdm845-interposer-pm660.dtsi
index 0a02bfb..d698d1f 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-interposer-pm660.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-interposer-pm660.dtsi
@@ -72,6 +72,12 @@
 	ibb-supply = <&lcdb_ncp_vreg>;
 };
 
+&dsi_r63417_truly_1080_cmd_display {
+	vddio-supply = <&pm660_l11>;
+	lab-supply = <&lcdb_ldo_vreg>;
+	ibb-supply = <&lcdb_ncp_vreg>;
+};
+
 &dsi_dual_test_cmd_display {
 	/delete-property/ vddio-supply;
 	/delete-property/ lab-supply;
diff --git a/arch/arm64/boot/dts/qcom/sdm845-pinctrl.dtsi b/arch/arm64/boot/dts/qcom/sdm845-pinctrl.dtsi
index 019607c..53f8084 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-pinctrl.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-pinctrl.dtsi
@@ -13,7 +13,8 @@
 &soc {
 	tlmm: pinctrl@03400000 {
 		compatible = "qcom,sdm845-pinctrl";
-		reg = <0x03400000 0xc00000>;
+		reg = <0x03400000 0xc00000>, <0x179900F0 0x60>;
+		reg-names = "pinctrl_regs", "spi_cfg_regs";
 		interrupts = <0 208 0>;
 		gpio-controller;
 		#gpio-cells = <2>;
diff --git a/arch/arm64/boot/dts/qcom/sdm845-sde-display.dtsi b/arch/arm64/boot/dts/qcom/sdm845-sde-display.dtsi
index 6e0bb861..0de0331 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-sde-display.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845-sde-display.dtsi
@@ -23,6 +23,7 @@
 #include "dsi-panel-nt35597-truly-dsc-wqxga-cmd.dtsi"
 #include "dsi-panel-nt35597-truly-dsc-wqxga-video.dtsi"
 #include "dsi-panel-sharp-1080p-cmd.dtsi"
+#include "dsi-panel-r63417-truly-1080p-cmd.dtsi"
 #include "dsi-panel-sharp-dualmipi-1080p-120hz.dtsi"
 #include "dsi-panel-s6e3ha3-amoled-dualmipi-wqhd-cmd.dtsi"
 #include "dsi-panel-nt35597-dualmipi-wqxga-video.dtsi"
@@ -502,6 +503,30 @@
 		oled-vdda-supply = <&pm8998_l22>;
 	};
 
+	dsi_r63417_truly_1080_cmd_display: qcom,dsi-display@18 {
+		compatible = "qcom,dsi-display";
+		label = "dsi_r63417_truly_1080_cmd_display";
+		qcom,display-type = "primary";
+
+		qcom,dsi-ctrl = <&mdss_dsi0>;
+		qcom,dsi-phy = <&mdss_dsi_phy0>;
+		clocks = <&mdss_dsi0_pll BYTECLK_MUX_0_CLK>,
+			<&mdss_dsi0_pll PCLK_MUX_0_CLK>;
+		clock-names = "src_byte_clk", "src_pixel_clk";
+
+		pinctrl-names = "panel_active", "panel_suspend";
+		pinctrl-0 = <&sde_dsi_active &sde_te_active>;
+		pinctrl-1 = <&sde_dsi_suspend &sde_te_suspend>;
+		qcom,platform-te-gpio = <&tlmm 10 0>;
+		qcom,platform-reset-gpio = <&tlmm 6 0>;
+		qcom,panel-mode-gpio = <&tlmm 52 0>;
+
+		qcom,dsi-panel = <&dsi_r63417_truly_1080_cmd>;
+		vddio-supply = <&pm8998_l14>;
+		lab-supply = <&lab_regulator>;
+		ibb-supply = <&ibb_regulator>;
+	};
+
 	sde_wb: qcom,wb-display@0 {
 		compatible = "qcom,wb-display";
 		cell-index = <0>;
@@ -676,6 +701,34 @@
 &dsi_sharp_1080_cmd {
 	qcom,mdss-dsi-t-clk-post = <0x0c>;
 	qcom,mdss-dsi-t-clk-pre = <0x29>;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x9c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x9c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
+	qcom,mdss-dsi-display-timings {
+		timing@0{
+			qcom,mdss-dsi-panel-phy-timings = [00 1E 08 08 24 22 08
+				08 05 03 04 00];
+			qcom,mdss-dsi-panel-clockrate = <900000000>;
+			qcom,display-topology = <1 0 1>;
+			qcom,default-topology-index = <0>;
+		};
+	};
+};
+
+&dsi_r63417_truly_1080_cmd {
+	qcom,mdss-dsi-t-clk-post = <0x0c>;
+	qcom,mdss-dsi-t-clk-pre = <0x29>;
+	qcom,esd-check-enabled;
+	qcom,mdss-dsi-panel-status-check-mode = "reg_read";
+	qcom,mdss-dsi-panel-status-command = [06 01 00 01 00 00 01 0a];
+	qcom,mdss-dsi-panel-status-command-state = "dsi_hs_mode";
+	qcom,mdss-dsi-panel-status-value = <0x1c>;
+	qcom,mdss-dsi-panel-on-check-value = <0x1c>;
+	qcom,mdss-dsi-panel-status-read-length = <1>;
 	qcom,mdss-dsi-display-timings {
 		timing@0{
 			qcom,mdss-dsi-panel-phy-timings = [00 1E 08 08 24 22 08
diff --git a/arch/arm64/boot/dts/qcom/sxr1120-audio-overlay.dtsi b/arch/arm64/boot/dts/qcom/sxr1120-audio-overlay.dtsi
new file mode 100644
index 0000000..0038ae7
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sxr1120-audio-overlay.dtsi
@@ -0,0 +1,163 @@
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include "sdm670-wcd.dtsi"
+#include "sdm670-wsa881x.dtsi"
+#include "sdm670-lpi.dtsi"
+#include <dt-bindings/clock/qcom,audio-ext-clk.h>
+
+&tavil_snd {
+	qcom,msm-mi2s-master = <1>, <1>, <1>, <1>, <1>;
+	qcom,audio-routing =
+		"AIF4 VI", "MCLK",
+		"RX_BIAS", "MCLK",
+		"MADINPUT", "MCLK",
+		"hifi amp", "LINEOUT1",
+		"hifi amp", "LINEOUT2",
+		"AMIC2", "MIC BIAS2",
+		"MIC BIAS2", "Headset Mic",
+		"AMIC3", "MIC BIAS2",
+		"MIC BIAS2", "ANCRight Headset Mic",
+		"AMIC4", "MIC BIAS2",
+		"MIC BIAS2", "ANCLeft Headset Mic",
+		"AMIC5", "MIC BIAS3",
+		"MIC BIAS3", "Handset Mic",
+		"DMIC0", "MIC BIAS1",
+		"MIC BIAS1", "Digital Mic0",
+		"DMIC1", "MIC BIAS1",
+		"MIC BIAS1", "Digital Mic1",
+		"DMIC2", "MIC BIAS3",
+		"MIC BIAS3", "Digital Mic2",
+		"DMIC3", "MIC BIAS3",
+		"MIC BIAS3", "Digital Mic3",
+		"DMIC4", "MIC BIAS4",
+		"MIC BIAS4", "Digital Mic4",
+		"DMIC5", "MIC BIAS4",
+		"MIC BIAS4", "Digital Mic5",
+		"SpkrLeft IN", "SPK1 OUT",
+		"SpkrRight IN", "SPK2 OUT";
+
+	qcom,msm-mbhc-hphl-swh = <1>;
+	qcom,msm-mbhc-gnd-swh = <1>;
+	qcom,hph-en0-gpio = <&tavil_hph_en0>;
+	qcom,hph-en1-gpio = <&tavil_hph_en1>;
+	qcom,msm-mclk-freq = <9600000>;
+	asoc-codec = <&stub_codec>, <&ext_disp_audio_codec>;
+	asoc-codec-names = "msm-stub-codec.1", "msm-ext-disp-audio-codec-rx";
+	qcom,wsa-max-devs = <2>;
+	qcom,wsa-devs = <&wsa881x_0211>, <&wsa881x_0212>,
+		<&wsa881x_0213>, <&wsa881x_0214>;
+	qcom,wsa-aux-dev-prefix = "SpkrLeft", "SpkrRight",
+		"SpkrLeft", "SpkrRight";
+};
+
+&qupv3_se8_spi{
+	status = "okay";
+};
+
+&soc {
+	wcd_usbc_analog_en1_gpio: msm_cdc_pinctrl_usbc_audio_en1 {
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&wcd_usbc_analog_en1_active>;
+		pinctrl-1 = <&wcd_usbc_analog_en1_idle>;
+	};
+
+	wcd9xxx_intc: wcd9xxx-irq {
+		status = "okay";
+		compatible = "qcom,wcd9xxx-irq";
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&tlmm>;
+		qcom,gpio-connect = <&tlmm 80 0>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&wcd_intr_default>;
+	};
+
+	clock_audio_lnbb: audio_ext_clk_lnbb {
+		status = "okay";
+		compatible = "qcom,audio-ref-clk";
+		clock-names = "osr_clk";
+		clocks = <&clock_rpmh RPMH_LN_BB_CLK2>;
+		qcom,node_has_rpm_clock;
+		#clock-cells = <1>;
+	};
+
+	wcd_rst_gpio: msm_cdc_pinctrl@64 {
+		status = "okay";
+		compatible = "qcom,msm-cdc-pinctrl";
+		pinctrl-names = "aud_active", "aud_sleep";
+		pinctrl-0 = <&lpi_cdc_reset_active>;
+		pinctrl-1 = <&lpi_cdc_reset_sleep>;
+		qcom,lpi-gpios;
+	};
+
+	wdsp_mgr: qcom,wcd-dsp-mgr {
+		status = "okay";
+		compatible = "qcom,wcd-dsp-mgr";
+		qcom,wdsp-components = <&wcd934x_cdc 0>,
+				       <&wcd_spi_0 1>,
+				       <&glink_spi_xprt_wdsp 2>;
+					qcom,img-filename = "cpe_9340";
+	};
+
+	wdsp_glink: qcom,wcd-dsp-glink {
+		status = "okay";
+		compatible = "qcom,wcd-dsp-glink";
+	};
+
+};
+
+&slim_aud {
+	wcd934x_cdc: tavil_codec {
+		status = "okay";
+		compatible = "qcom,tavil-slim-pgd";
+		elemental-addr = [00 01 50 02 17 02];
+
+		interrupt-parent = <&wcd9xxx_intc>;
+		interrupts = <0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
+			      17 18 19 20 21 22 23 24 25 26 27 28 29
+			      30 31>;
+
+		qcom,wcd-rst-gpio-node = <&wcd_rst_gpio>;
+
+		clock-names = "wcd_clk";
+		clocks = <&clock_audio_lnbb AUDIO_PMIC_LNBB_CLK>;
+
+		cdc-vdd-mic-bias-supply = <&pm660_l13>;
+		qcom,cdc-vdd-mic-bias-voltage = <1696000 1904000>;
+		qcom,cdc-vdd-mic-bias-current = <30400>;
+
+		qcom,cdc-static-supplies = "cdc-vdd-mic-bias";
+
+		qcom,cdc-micbias1-mv = <1800>;
+		qcom,cdc-micbias2-mv = <1800>;
+		qcom,cdc-micbias3-mv = <1800>;
+		qcom,cdc-micbias4-mv = <1800>;
+
+		qcom,cdc-mclk-clk-rate = <9600000>;
+		qcom,cdc-slim-ifd = "tavil-slim-ifd";
+		qcom,cdc-slim-ifd-elemental-addr = [00 00 50 02 17 02];
+		qcom,cdc-dmic-sample-rate = <4800000>;
+		qcom,cdc-mad-dmic-rate = <600000>;
+
+		qcom,wdsp-cmpnt-dev-name = "tavil_codec";
+
+		wcd_spi_0: wcd_spi {
+			compatible = "qcom,wcd-spi-v2";
+			qcom,master-bus-num = <0>;
+			qcom,chip-select = <0>;
+			qcom,max-frequency = <24000000>;
+			qcom,mem-base-addr = <0x100000>;
+		};
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sxr1120-audio.dtsi b/arch/arm64/boot/dts/qcom/sxr1120-audio.dtsi
new file mode 100644
index 0000000..e5df844
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sxr1120-audio.dtsi
@@ -0,0 +1,165 @@
+/*
+ * Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "msm-audio-lpass.dtsi"
+
+&msm_audio_ion {
+	iommus = <&apps_smmu 0x1801 0x0>;
+	qcom,smmu-sid-mask = /bits/ 64 <0xf>;
+};
+
+&soc {
+	qcom,msm-audio-apr {
+		compatible = "qcom,msm-audio-apr";
+		msm_audio_apr_dummy {
+			compatible = "qcom,msm-audio-apr-dummy";
+		};
+	};
+
+	qcom,avtimer@62cf700c {
+		compatible = "qcom,avtimer";
+		reg = <0x62cf700c 0x4>,
+			<0x62cf7010 0x4>;
+		reg-names = "avtimer_lsb_addr", "avtimer_msb_addr";
+		qcom,clk-div = <192>;
+		qcom,clk-mult = <10>;
+	};
+
+	tavil_snd: sound-tavil {
+		status = "okay";
+		compatible = "qcom,sdm670-asoc-snd-tavil";
+		qcom,model = "sdm670-tavil-snd-card";
+		qcom,wcn-btfm;
+		qcom,mi2s-audio-intf;
+		qcom,auxpcm-audio-intf;
+		qcom,ext-disp-audio-rx;
+		asoc-platform = <&pcm0>, <&pcm1>, <&pcm2>, <&voip>, <&voice>,
+			<&loopback>, <&compress>, <&hostless>,
+			<&afe>, <&lsm>, <&routing>, <&cpe>, <&compr>,
+			<&pcm_noirq>;
+		asoc-platform-names = "msm-pcm-dsp.0", "msm-pcm-dsp.1",
+			"msm-pcm-dsp.2", "msm-voip-dsp",
+			"msm-pcm-voice", "msm-pcm-loopback",
+			"msm-compress-dsp", "msm-pcm-hostless",
+			"msm-pcm-afe", "msm-lsm-client",
+			"msm-pcm-routing", "msm-cpe-lsm",
+			"msm-compr-dsp", "msm-pcm-dsp-noirq";
+		asoc-cpu = <&dai_dp>, <&dai_mi2s0>, <&dai_mi2s1>,
+			<&dai_mi2s2>, <&dai_mi2s3>, <&dai_mi2s4>,
+			<&dai_pri_auxpcm>, <&dai_sec_auxpcm>,
+			<&dai_tert_auxpcm>, <&dai_quat_auxpcm>,
+			<&dai_quin_auxpcm>,
+			<&sb_0_rx>, <&sb_0_tx>, <&sb_1_rx>, <&sb_1_tx>,
+			<&sb_2_rx>, <&sb_2_tx>, <&sb_3_rx>, <&sb_3_tx>,
+			<&sb_4_rx>, <&sb_4_tx>, <&sb_5_rx>, <&sb_5_tx>,
+			<&sb_6_rx>, <&sb_7_rx>, <&sb_7_tx>,
+			<&sb_8_rx>, <&sb_8_tx>,
+			<&afe_pcm_rx>, <&afe_pcm_tx>, <&afe_proxy_rx>,
+			<&afe_proxy_tx>, <&incall_record_rx>,
+			<&incall_record_tx>, <&incall_music_rx>,
+			<&incall_music_2_rx>,
+			<&usb_audio_rx>, <&usb_audio_tx>,
+			<&dai_pri_tdm_rx_0>, <&dai_pri_tdm_tx_0>,
+			<&dai_sec_tdm_rx_0>, <&dai_sec_tdm_tx_0>,
+			<&dai_tert_tdm_rx_0>, <&dai_tert_tdm_tx_0>,
+			<&dai_quat_tdm_rx_0>, <&dai_quat_tdm_tx_0>,
+			<&dai_quin_tdm_rx_0>, <&dai_quin_tdm_tx_0>;
+		asoc-cpu-names = "msm-dai-q6-dp.24608",
+			"msm-dai-q6-mi2s.0", "msm-dai-q6-mi2s.1",
+			"msm-dai-q6-mi2s.2", "msm-dai-q6-mi2s.3",
+			"msm-dai-q6-mi2s.4",
+			"msm-dai-q6-auxpcm.1", "msm-dai-q6-auxpcm.2",
+			"msm-dai-q6-auxpcm.3", "msm-dai-q6-auxpcm.4",
+			"msm-dai-q6-auxpcm.5",
+			"msm-dai-q6-dev.16384", "msm-dai-q6-dev.16385",
+			"msm-dai-q6-dev.16386", "msm-dai-q6-dev.16387",
+			"msm-dai-q6-dev.16388", "msm-dai-q6-dev.16389",
+			"msm-dai-q6-dev.16390", "msm-dai-q6-dev.16391",
+			"msm-dai-q6-dev.16392", "msm-dai-q6-dev.16393",
+			"msm-dai-q6-dev.16394", "msm-dai-q6-dev.16395",
+			"msm-dai-q6-dev.16396",
+			"msm-dai-q6-dev.16398", "msm-dai-q6-dev.16399",
+			"msm-dai-q6-dev.16400", "msm-dai-q6-dev.16401",
+			"msm-dai-q6-dev.224", "msm-dai-q6-dev.225",
+			"msm-dai-q6-dev.241", "msm-dai-q6-dev.240",
+			"msm-dai-q6-dev.32771", "msm-dai-q6-dev.32772",
+			"msm-dai-q6-dev.32773", "msm-dai-q6-dev.32770",
+			"msm-dai-q6-dev.28672", "msm-dai-q6-dev.28673",
+			"msm-dai-q6-tdm.36864", "msm-dai-q6-tdm.36865",
+			"msm-dai-q6-tdm.36880", "msm-dai-q6-tdm.36881",
+			"msm-dai-q6-tdm.36896", "msm-dai-q6-tdm.36897",
+			"msm-dai-q6-tdm.36912", "msm-dai-q6-tdm.36913",
+			"msm-dai-q6-tdm.36928", "msm-dai-q6-tdm.36929";
+	};
+
+};
+
+&slim_aud {
+	status = "okay";
+	dai_slim: msm_dai_slim {
+		status = "okay";
+		compatible = "qcom,msm-dai-slim";
+		elemental-addr = [ff ff ff fe 17 02];
+	};
+};
+
+&msm_dai_mi2s {
+	dai_int_mi2s0: qcom,msm-dai-q6-int-mi2s0 {
+		compatible = "qcom,msm-dai-q6-mi2s";
+		qcom,msm-dai-q6-mi2s-dev-id = <7>;
+		qcom,msm-mi2s-rx-lines = <3>;
+		qcom,msm-mi2s-tx-lines = <0>;
+	};
+
+	dai_int_mi2s1: qcom,msm-dai-q6-int-mi2s1 {
+		compatible = "qcom,msm-dai-q6-mi2s";
+		qcom,msm-dai-q6-mi2s-dev-id = <8>;
+		qcom,msm-mi2s-rx-lines = <3>;
+		qcom,msm-mi2s-tx-lines = <0>;
+	};
+
+	dai_int_mi2s2: qcom,msm-dai-q6-int-mi2s2 {
+		compatible = "qcom,msm-dai-q6-mi2s";
+		qcom,msm-dai-q6-mi2s-dev-id = <9>;
+		qcom,msm-mi2s-rx-lines = <0>;
+		qcom,msm-mi2s-tx-lines = <3>;
+	};
+
+	dai_int_mi2s3: qcom,msm-dai-q6-int-mi2s3 {
+		compatible = "qcom,msm-dai-q6-mi2s";
+		qcom,msm-dai-q6-mi2s-dev-id = <10>;
+		qcom,msm-mi2s-rx-lines = <0>;
+		qcom,msm-mi2s-tx-lines = <3>;
+	};
+
+	dai_int_mi2s4: qcom,msm-dai-q6-int-mi2s4 {
+		compatible = "qcom,msm-dai-q6-mi2s";
+		qcom,msm-dai-q6-mi2s-dev-id = <11>;
+		qcom,msm-mi2s-rx-lines = <3>;
+		qcom,msm-mi2s-tx-lines = <0>;
+	};
+
+	dai_int_mi2s5: qcom,msm-dai-q6-int-mi2s5 {
+		compatible = "qcom,msm-dai-q6-mi2s";
+		qcom,msm-dai-q6-mi2s-dev-id = <12>;
+		qcom,msm-mi2s-rx-lines = <0>;
+		qcom,msm-mi2s-tx-lines = <3>;
+	};
+
+	dai_int_mi2s6: qcom,msm-dai-q6-int-mi2s6 {
+		compatible = "qcom,msm-dai-q6-mi2s";
+		qcom,msm-dai-q6-mi2s-dev-id = <13>;
+		qcom,msm-mi2s-rx-lines = <0>;
+		qcom,msm-mi2s-tx-lines = <3>;
+	};
+};
diff --git a/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-cdp-overlay.dts b/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-cdp-overlay.dts
index e90f3b4..315f43c 100644
--- a/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-cdp-overlay.dts
+++ b/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-cdp-overlay.dts
@@ -21,6 +21,8 @@
 #include <dt-bindings/interrupt-controller/arm-gic.h>
 
 #include "sxr1120-lc-cdp.dtsi"
+#include "sxr1120-audio.dtsi"
+#include "sxr1120-audio-overlay.dtsi"
 
 / {
 	model = "Qualcomm Technologies, Inc. SXR1120 LC Groot+PM8005 Ext. Audio Codec CDP";
diff --git a/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-cdp.dts b/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-cdp.dts
index 76c424d..7d5b715 100644
--- a/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-cdp.dts
+++ b/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-cdp.dts
@@ -16,6 +16,8 @@
 
 #include "sxr1120-lc.dtsi"
 #include "sxr1120-lc-cdp.dtsi"
+#include "sxr1120-audio.dtsi"
+#include "sxr1120-audio-overlay.dtsi"
 
 / {
 	model = "Qualcomm Technologies, Inc. SXR1120 LC Groot+PM8005 Ext. Audio Codec CDP";
diff --git a/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-mtp-overlay.dts b/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-mtp-overlay.dts
index 946298f..4242d5e 100644
--- a/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-mtp-overlay.dts
+++ b/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-mtp-overlay.dts
@@ -22,9 +22,12 @@
 
 #include "sxr1120-lc-mtp.dtsi"
 
+#include "sxr1120-audio.dtsi"
+#include "sxr1120-audio-overlay.dtsi"
+
 / {
 	model = "Qualcomm Technologies, Inc. SXR1120 LC Groot+PM8005 Ext. Audio Codec MTP";
 	compatible = "qcom,sxr1120-mtp", "qcom,sxr1120", "qcom,mtp";
 	qcom,msm-id = <370 0x0>;
-	qcom,board-id = <8 1>;
+	qcom,board-id = <8 9>;
 };
diff --git a/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-mtp.dts b/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-mtp.dts
index e53bbe3..164ef61 100644
--- a/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-mtp.dts
+++ b/arch/arm64/boot/dts/qcom/sxr1120-lc-external-codec-mtp.dts
@@ -16,9 +16,11 @@
 
 #include "sxr1120-lc.dtsi"
 #include "sxr1120-lc-mtp.dtsi"
+#include "sxr1120-audio.dtsi"
+#include "sxr1120-audio-overlay.dtsi"
 
 / {
 	model = "Qualcomm Technologies, Inc. SXR1120 LC Groot+PM8005 Ext. Audio Codec MTP";
 	compatible = "qcom,sxr1120-mtp", "qcom,sxr1120", "qcom,mtp";
-	qcom,board-id = <8 1>;
+	qcom,board-id = <8 9>;
 };
diff --git a/arch/arm64/boot/dts/qcom/sxr1130-qrd-overlay.dts b/arch/arm64/boot/dts/qcom/sxr1130-qrd-overlay.dts
new file mode 100644
index 0000000..d5f2a3e
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sxr1130-qrd-overlay.dts
@@ -0,0 +1,32 @@
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+/dts-v1/;
+/plugin/;
+
+#include <dt-bindings/clock/qcom,gcc-sdm845.h>
+#include <dt-bindings/clock/qcom,camcc-sdm845.h>
+#include <dt-bindings/clock/qcom,dispcc-sdm845.h>
+#include <dt-bindings/clock/qcom,rpmh.h>
+#include <dt-bindings/interrupt-controller/arm-gic.h>
+
+#include "sxr1130-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SXR1130 PM660 + PM660L QRD";
+	compatible = "qcom,sxr1130-qrd", "qcom,sxr1130", "qcom,qrd";
+	qcom,msm-id = <371 0x0>;
+	qcom,board-id = <0x0003000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+		       <0x0001001b 0x0102001a 0x0 0x0>,
+		       <0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sxr1130-qrd.dts b/arch/arm64/boot/dts/qcom/sxr1130-qrd.dts
new file mode 100644
index 0000000..dd9db95
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sxr1130-qrd.dts
@@ -0,0 +1,26 @@
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+
+/dts-v1/;
+
+#include "sxr1130.dtsi"
+#include "sxr1130-qrd.dtsi"
+
+/ {
+	model = "Qualcomm Technologies, Inc. SXR1130 PM660 + PM660L QRD";
+	compatible = "qcom,sxr1130-qrd", "qcom,sxr1130", "qcom,qrd";
+	qcom,board-id = <0x0003000b 0>;
+	qcom,pmic-id = <0x0001001b 0x0101011a 0x0 0x0>,
+		       <0x0001001b 0x0102001a 0x0 0x0>,
+		       <0x0001001b 0x0201011a 0x0 0x0>;
+};
diff --git a/arch/arm64/boot/dts/qcom/sxr1130-qrd.dtsi b/arch/arm64/boot/dts/qcom/sxr1130-qrd.dtsi
new file mode 100644
index 0000000..3d25629
--- /dev/null
+++ b/arch/arm64/boot/dts/qcom/sxr1130-qrd.dtsi
@@ -0,0 +1,13 @@
+/* Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#include "sdm670-qrd-sku1.dtsi"
diff --git a/arch/arm64/configs/msm8937-perf_defconfig b/arch/arm64/configs/msm8937-perf_defconfig
index 385714b..1e16d20 100644
--- a/arch/arm64/configs/msm8937-perf_defconfig
+++ b/arch/arm64/configs/msm8937-perf_defconfig
@@ -539,6 +539,8 @@
 CONFIG_MAILBOX=y
 CONFIG_ARM_SMMU=y
 CONFIG_QCOM_LAZY_MAPPING=y
+CONFIG_IOMMU_DEBUG=y
+CONFIG_IOMMU_DEBUG_TRACKING=y
 CONFIG_QCOM_RUN_QUEUE_STATS=y
 CONFIG_MSM_SPM=y
 CONFIG_MSM_L2_SPM=y
@@ -601,6 +603,7 @@
 CONFIG_EXT4_FS_ICE_ENCRYPTION=y
 CONFIG_F2FS_FS=y
 CONFIG_F2FS_FS_SECURITY=y
+CONFIG_F2FS_FS_ENCRYPTION=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V2=y
diff --git a/arch/arm64/configs/msm8937_defconfig b/arch/arm64/configs/msm8937_defconfig
index cbf89b2..e4ca873 100644
--- a/arch/arm64/configs/msm8937_defconfig
+++ b/arch/arm64/configs/msm8937_defconfig
@@ -330,7 +330,6 @@
 # CONFIG_SERIO_SERPORT is not set
 # CONFIG_VT is not set
 # CONFIG_LEGACY_PTYS is not set
-# CONFIG_DEVMEM is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_MSM=y
 CONFIG_SERIAL_MSM_CONSOLE=y
@@ -620,6 +619,7 @@
 CONFIG_EXT4_FS_ICE_ENCRYPTION=y
 CONFIG_F2FS_FS=y
 CONFIG_F2FS_FS_SECURITY=y
+CONFIG_F2FS_FS_ENCRYPTION=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V2=y
diff --git a/arch/arm64/configs/msm8953-perf_defconfig b/arch/arm64/configs/msm8953-perf_defconfig
index 698857a..a66ea31 100644
--- a/arch/arm64/configs/msm8953-perf_defconfig
+++ b/arch/arm64/configs/msm8953-perf_defconfig
@@ -552,6 +552,8 @@
 CONFIG_MAILBOX=y
 CONFIG_ARM_SMMU=y
 CONFIG_QCOM_LAZY_MAPPING=y
+CONFIG_IOMMU_DEBUG=y
+CONFIG_IOMMU_DEBUG_TRACKING=y
 CONFIG_QCOM_RUN_QUEUE_STATS=y
 CONFIG_MSM_SPM=y
 CONFIG_MSM_L2_SPM=y
@@ -614,6 +616,7 @@
 CONFIG_EXT4_FS_ICE_ENCRYPTION=y
 CONFIG_F2FS_FS=y
 CONFIG_F2FS_FS_SECURITY=y
+CONFIG_F2FS_FS_ENCRYPTION=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V2=y
diff --git a/arch/arm64/configs/msm8953_defconfig b/arch/arm64/configs/msm8953_defconfig
index 6434a8e..34d16db 100644
--- a/arch/arm64/configs/msm8953_defconfig
+++ b/arch/arm64/configs/msm8953_defconfig
@@ -633,6 +633,7 @@
 CONFIG_EXT4_FS_ICE_ENCRYPTION=y
 CONFIG_F2FS_FS=y
 CONFIG_F2FS_FS_SECURITY=y
+CONFIG_F2FS_FS_ENCRYPTION=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 CONFIG_QFMT_V2=y
diff --git a/arch/arm64/configs/sdm670-perf_defconfig b/arch/arm64/configs/sdm670-perf_defconfig
index ac21b63..fcecc6b 100644
--- a/arch/arm64/configs/sdm670-perf_defconfig
+++ b/arch/arm64/configs/sdm670-perf_defconfig
@@ -84,6 +84,7 @@
 # CONFIG_PM_WAKELOCKS_GC is not set
 CONFIG_CPU_IDLE=y
 CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
diff --git a/arch/arm64/configs/sdm670_defconfig b/arch/arm64/configs/sdm670_defconfig
index 9a6da1f..fa802d2 100644
--- a/arch/arm64/configs/sdm670_defconfig
+++ b/arch/arm64/configs/sdm670_defconfig
@@ -89,6 +89,7 @@
 CONFIG_PM_DEBUG=y
 CONFIG_CPU_IDLE=y
 CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
diff --git a/drivers/android/binder_alloc.c b/drivers/android/binder_alloc.c
index 1c76daa..abb56a9 100644
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -669,7 +669,7 @@
 		goto err_already_mapped;
 	}
 
-	area = get_vm_area(vma->vm_end - vma->vm_start, VM_IOREMAP);
+	area = get_vm_area(vma->vm_end - vma->vm_start, VM_ALLOC);
 	if (area == NULL) {
 		ret = -ENOMEM;
 		failure_string = "get_vm_area";
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 58f7c39..396c26e 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -755,7 +755,8 @@
 				__GFP_KSWAPD_RECLAIM |
 				__GFP_NOWARN |
 				__GFP_HIGHMEM |
-				__GFP_MOVABLE);
+				__GFP_MOVABLE |
+				__GFP_CMA);
 	if (!handle) {
 		zcomp_stream_put(zram->comp);
 		zstrm = NULL;
@@ -764,7 +765,7 @@
 
 		handle = zs_malloc(meta->mem_pool, clen,
 				GFP_NOIO | __GFP_HIGHMEM |
-				__GFP_MOVABLE);
+				__GFP_MOVABLE | __GFP_CMA);
 		if (handle)
 			goto compress_again;
 
diff --git a/drivers/bluetooth/bluetooth-power.c b/drivers/bluetooth/bluetooth-power.c
index 0574e44..0a3f24a 100644
--- a/drivers/bluetooth/bluetooth-power.c
+++ b/drivers/bluetooth/bluetooth-power.c
@@ -54,6 +54,7 @@
 static int pwr_state;
 struct class *bt_class;
 static int bt_major;
+static int soc_id;
 
 static int bt_vreg_init(struct bt_power_vreg_data *vreg)
 {
@@ -685,9 +686,16 @@
 	return 0;
 }
 
+int get_chipset_version(void)
+{
+	BT_PWR_DBG("");
+	return soc_id;
+}
+
 static long bt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	int ret = 0, pwr_cntrl = 0;
+	int chipset_version = 0;
 
 	switch (cmd) {
 	case BT_CMD_SLIM_TEST:
@@ -712,6 +720,16 @@
 			ret = 0;
 		}
 		break;
+	case BT_CMD_CHIPSET_VERS:
+		chipset_version = (int)arg;
+		BT_PWR_ERR("BT_CMD_CHIP_VERS soc_version:%x", chipset_version);
+		if (chipset_version) {
+		soc_id = chipset_version;
+		} else {
+			BT_PWR_ERR("got invalid soc version");
+			soc_id = 0;
+		}
+		break;
 	default:
 		return -EINVAL;
 	}
diff --git a/drivers/bluetooth/btfm_slim.c b/drivers/bluetooth/btfm_slim.c
index 92ea0135..a52e89b 100644
--- a/drivers/bluetooth/btfm_slim.c
+++ b/drivers/bluetooth/btfm_slim.c
@@ -307,15 +307,29 @@
 static int btfm_slim_alloc_port(struct btfmslim *btfmslim)
 {
 	int ret = -EINVAL, i;
+	int  chipset_ver;
 	struct btfmslim_ch *rx_chs;
 	struct btfmslim_ch *tx_chs;
 
 	if (!btfmslim)
 		return ret;
 
+	chipset_ver = get_chipset_version();
+	BTFMSLIM_INFO("chipset soc version:%x", chipset_ver);
+
 	rx_chs = btfmslim->rx_chs;
 	tx_chs = btfmslim->tx_chs;
-
+	if (chipset_ver ==  QCA_CHEROKEE_SOC_ID_0300) {
+		for (i = 0; (tx_chs->port != BTFM_SLIM_PGD_PORT_LAST) &&
+		(i < BTFM_SLIM_NUM_CODEC_DAIS); i++, tx_chs++) {
+			if (tx_chs->port == CHRK_SB_PGD_PORT_TX1_FM)
+				tx_chs->port = CHRKVER3_SB_PGD_PORT_TX1_FM;
+			else if (tx_chs->port == CHRK_SB_PGD_PORT_TX2_FM)
+				tx_chs->port = CHRKVER3_SB_PGD_PORT_TX2_FM;
+			BTFMSLIM_INFO("Tx port:%d", tx_chs->port);
+		}
+		tx_chs = btfmslim->tx_chs;
+	}
 	if (!rx_chs || !tx_chs)
 		return ret;
 
diff --git a/drivers/bluetooth/btfm_slim_wcn3990.c b/drivers/bluetooth/btfm_slim_wcn3990.c
index 6615189..8cebb50 100644
--- a/drivers/bluetooth/btfm_slim_wcn3990.c
+++ b/drivers/bluetooth/btfm_slim_wcn3990.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -72,6 +72,8 @@
 static inline int is_fm_port(uint8_t port_num)
 {
 	if (port_num == CHRK_SB_PGD_PORT_TX1_FM ||
+		port_num == CHRKVER3_SB_PGD_PORT_TX1_FM ||
+		port_num == CHRKVER3_SB_PGD_PORT_TX2_FM ||
 		port_num == CHRK_SB_PGD_PORT_TX2_FM)
 		return 1;
 	else
@@ -138,9 +140,16 @@
 	/* txport */
 	/* Multiple Channel Setting */
 	if (is_fm_port(port_num)) {
-		reg_val = (0x1 << CHRK_SB_PGD_PORT_TX1_FM) |
-				(0x1 << CHRK_SB_PGD_PORT_TX2_FM);
+		if (port_num == CHRKVER3_SB_PGD_PORT_TX1_FM)
+			reg_val = (0x1 << CHRKVER3_SB_PGD_PORT_TX1_FM);
+		else if (port_num == CHRKVER3_SB_PGD_PORT_TX2_FM)
+			reg_val = (0x1 << CHRKVER3_SB_PGD_PORT_TX2_FM);
+		else
+			reg_val = (0x1 << CHRK_SB_PGD_PORT_TX1_FM) |
+					(0x1 << CHRK_SB_PGD_PORT_TX2_FM);
+
 		reg = CHRK_SB_PGD_TX_PORTn_MULTI_CHNL_0(port_num);
+		BTFMSLIM_INFO("writing reg_val (%d) to reg(%x)", reg_val, reg);
 		ret = btfm_slim_write(btfmslim, reg, 1, &reg_val, IFD);
 		if (ret) {
 			BTFMSLIM_ERR("failed to write (%d) reg 0x%x", ret, reg);
diff --git a/drivers/bluetooth/btfm_slim_wcn3990.h b/drivers/bluetooth/btfm_slim_wcn3990.h
index b2723ff..694fe75 100644
--- a/drivers/bluetooth/btfm_slim_wcn3990.h
+++ b/drivers/bluetooth/btfm_slim_wcn3990.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -78,9 +78,36 @@
 #define CHRK_SB_PGD_PORT_TX_SCO			0
 #define CHRK_SB_PGD_PORT_TX1_FM			1
 #define CHRK_SB_PGD_PORT_TX2_FM			2
+#define CHRKVER3_SB_PGD_PORT_TX1_FM		4
+#define CHRKVER3_SB_PGD_PORT_TX2_FM		5
 #define CHRK_SB_PGD_PORT_RX_SCO			16
 #define CHRK_SB_PGD_PORT_RX_A2P			17
 
+enum {
+	QCA_CHEROKEE_SOC_ID_0100  = 0x40010100,
+	QCA_CHEROKEE_SOC_ID_0200  = 0x40010200,
+	QCA_CHEROKEE_SOC_ID_0201  = 0x40010201,
+	QCA_CHEROKEE_SOC_ID_0210  = 0x40010214,
+	QCA_CHEROKEE_SOC_ID_0211  = 0x40010224,
+	QCA_CHEROKEE_SOC_ID_0300  = 0x40010300,
+};
+
+enum{
+	QCA_APACHE_SOC_ID_0005  = 0x40020100,
+	QCA_APACHE_SOC_ID_0006  = 0x40020110,
+	QCA_APACHE_SOC_ID_0100  = 0x40020120,
+	QCA_APACHE_SOC_ID_0101  = 0x40020121,
+	QCA_APACHE_SOC_ID_0102  = 0x40020122,
+	QCA_APACHE_SOC_ID_0103  = 0x40020123,
+	QCA_APACHE_SOC_ID_0110  = 0x40020130,
+	QCA_APACHE_SOC_ID_0111  = 0x40020140,
+};
+
+enum {
+	QCA_COMANCHE_SOC_ID_0100  = 0x40070100,
+	QCA_COMANCHE_SOC_ID_0101  = 0x40070101,
+	QCA_COMANCHE_SOC_ID_0110  = 0x40070110,
+};
 
 /* Function Prototype */
 
diff --git a/drivers/char/hw_random/msm_rng.c b/drivers/char/hw_random/msm_rng.c
index fdcef1d..31b36b8 100644
--- a/drivers/char/hw_random/msm_rng.c
+++ b/drivers/char/hw_random/msm_rng.c
@@ -53,7 +53,7 @@
 #define MAX_HW_FIFO_DEPTH 16                     /* FIFO is 16 words deep */
 #define MAX_HW_FIFO_SIZE (MAX_HW_FIFO_DEPTH * 4) /* FIFO is 32 bits wide  */
 
-#define RETRY_MAX_CNT		5	/* max retry times to read register */
+#define RETRY_MAX_CNT		20	/* max retry times to read register */
 #define RETRY_DELAY_INTERVAL	440	/* retry delay interval in us */
 
 struct msm_rng_device {
diff --git a/drivers/clk/qcom/debugcc-sdxpoorwills.c b/drivers/clk/qcom/debugcc-sdxpoorwills.c
index d66a623..5dc454e 100644
--- a/drivers/clk/qcom/debugcc-sdxpoorwills.c
+++ b/drivers/clk/qcom/debugcc-sdxpoorwills.c
@@ -219,13 +219,15 @@
 
 static const struct of_device_id clk_debug_match_table[] = {
 	{ .compatible = "qcom,debugcc-sdxpoorwills" },
+	{ .compatible = "qcom,debugcc-sdxpoorwills-v2" },
 	{ }
 };
 
 static int clk_debug_sdxpoorwills_probe(struct platform_device *pdev)
 {
 	struct clk *clk;
-	int ret = 0;
+	int ret = 0, compatlen;
+	const char *compat = NULL;
 
 	clk = devm_clk_get(&pdev->dev, "xo_clk_src");
 	if (IS_ERR(clk)) {
@@ -234,6 +236,13 @@
 		return PTR_ERR(clk);
 	}
 
+	compat = of_get_property(pdev->dev.of_node, "compatible", &compatlen);
+	if (!compat || (compatlen <= 0))
+		return -EINVAL;
+
+	if (!strcmp(compat, "qcom,debugcc-sdxpoorwills-v2"))
+		debug_mux_priv.xo_div4_cbcr = 0x22010;
+
 	debug_mux_priv.cxo = clk;
 
 	gcc_debug_mux.regmap = devm_kcalloc(&pdev->dev, MAX_NUM_CC,
diff --git a/drivers/clk/qcom/gcc-sdxpoorwills.c b/drivers/clk/qcom/gcc-sdxpoorwills.c
index a27bd19..6732ebe 100644
--- a/drivers/clk/qcom/gcc-sdxpoorwills.c
+++ b/drivers/clk/qcom/gcc-sdxpoorwills.c
@@ -1839,15 +1839,23 @@
 
 static const struct of_device_id gcc_sdxpoorwills_match_table[] = {
 	{ .compatible = "qcom,gcc-sdxpoorwills" },
+	{ .compatible = "qcom,gcc-sdxpoorwills-v2" },
 	{ }
 };
 MODULE_DEVICE_TABLE(of, gcc_sdxpoorwills_match_table);
 
+static void gcc_fixup_sdxpoorwillsv2(void)
+{
+	gcc_blsp1_ahb_clk.clkr.enable_mask = BIT(14);
+	gcc_blsp1_sleep_clk.clkr.enable_mask = BIT(15);
+}
+
 static int gcc_sdxpoorwills_probe(struct platform_device *pdev)
 {
-	int i, ret = 0;
+	int i, ret = 0, compatlen;
 	struct clk *clk;
 	struct regmap *regmap;
+	const char *compat = NULL;
 
 	regmap = qcom_cc_map(pdev, &gcc_sdxpoorwills_desc);
 	if (IS_ERR(regmap))
@@ -1869,6 +1877,13 @@
 		return PTR_ERR(vdd_cx_ao.regulator[0]);
 	}
 
+	compat = of_get_property(pdev->dev.of_node, "compatible", &compatlen);
+	if (!compat || (compatlen <= 0))
+		return -EINVAL;
+
+	if (!strcmp(compat, "qcom,gcc-sdxpoorwills-v2"))
+		gcc_fixup_sdxpoorwillsv2();
+
 	/* Register the dummy measurement clocks */
 	for (i = 0; i < ARRAY_SIZE(gcc_sdxpoorwills_hws); i++) {
 		clk = devm_clk_register(&pdev->dev, gcc_sdxpoorwills_hws[i]);
diff --git a/drivers/clk/qcom/gpucc-sdm845.c b/drivers/clk/qcom/gpucc-sdm845.c
index 8dfdf85..94e672b 100644
--- a/drivers/clk/qcom/gpucc-sdm845.c
+++ b/drivers/clk/qcom/gpucc-sdm845.c
@@ -292,6 +292,7 @@
 	F(430000000, P_CRC_DIV,  1, 0, 0),
 	F(504000000, P_CRC_DIV,  1, 0, 0),
 	F(565000000, P_CRC_DIV,  1, 0, 0),
+	F(610000000, P_CRC_DIV,  1, 0, 0),
 	F(650000000, P_CRC_DIV,  1, 0, 0),
 	F(700000000, P_CRC_DIV,  1, 0, 0),
 	F(750000000, P_CRC_DIV,  1, 0, 0),
diff --git a/drivers/crypto/msm/ice.c b/drivers/crypto/msm/ice.c
index 199d573..3c90fe5 100644
--- a/drivers/crypto/msm/ice.c
+++ b/drivers/crypto/msm/ice.c
@@ -31,7 +31,8 @@
 #else
 #include <linux/bio.h>
 static inline int pfk_load_key_start(const struct bio *bio,
-	struct ice_crypto_setting *ice_setting, bool *is_pfe, bool async)
+	struct ice_crypto_setting *ice_setting, bool *is_pfe,
+	bool async, int ice_ver)
 {
 	return 0;
 }
@@ -132,14 +133,10 @@
 static struct ice_crypto_setting ice_data;
 
 static int qti_ice_setting_config(struct request *req,
-		struct platform_device *pdev,
+		struct ice_device *ice_dev,
 		struct ice_crypto_setting *crypto_data,
 		struct ice_data_setting *setting)
 {
-	struct ice_device *ice_dev = NULL;
-
-	ice_dev = platform_get_drvdata(pdev);
-
 	if (!ice_dev) {
 		pr_debug("%s no ICE device\n", __func__);
 
@@ -1477,12 +1474,19 @@
 	sector_t data_size;
 	union map_info *info;
 	unsigned long sec_end = 0;
+	struct ice_device *ice_dev = NULL;
+	int ice_rev = 0;
 
 	if (!pdev || !req) {
 		pr_err("%s: Invalid params passed\n", __func__);
 		return -EINVAL;
 	}
 
+	ice_dev = platform_get_drvdata(pdev);
+	if (!ice_dev) {
+		pr_err("%s: no ICE device\n", __func__);
+		return 0;
+	}
 	/*
 	 * It is not an error to have a request with no  bio
 	 * Such requests must bypass ICE. So first set bypass and then
@@ -1497,9 +1501,11 @@
 		/* It is not an error to have a request with no  bio */
 		return 0;
 	}
-    //pr_err("%s bio is %pK\n", __func__, req->bio);
 
-	ret = pfk_load_key_start(req->bio, &pfk_crypto_data, &is_pfe, async);
+	ice_rev = ICE_REV(ice_dev->ice_hw_version, MAJOR);
+
+	ret = pfk_load_key_start(req->bio, &pfk_crypto_data,
+				&is_pfe, async, ice_rev);
 	if (is_pfe) {
 		if (ret) {
 			if (ret != -EBUSY && ret != -EAGAIN)
@@ -1508,7 +1514,7 @@
 			return ret;
 		}
 
-		return qti_ice_setting_config(req, pdev,
+		return qti_ice_setting_config(req, ice_dev,
 				&pfk_crypto_data, setting);
 	}
 
@@ -1526,7 +1532,7 @@
 							__func__);
 				return -EINVAL;
 			}
-			return qti_ice_setting_config(req, pdev,
+			return qti_ice_setting_config(req, ice_dev,
 						crypto_data, setting);
 		}
 		return 0;
@@ -1548,8 +1554,8 @@
 				if ((req->__sector + data_size) > sec_end)
 					return 0;
 				else
-					return qti_ice_setting_config(req, pdev,
-						&ice_data, setting);
+					return qti_ice_setting_config(req,
+						ice_dev, &ice_data, setting);
 			}
 		}
 	}
diff --git a/drivers/crypto/msm/qce50.c b/drivers/crypto/msm/qce50.c
index 19f2289..e98bb06 100644
--- a/drivers/crypto/msm/qce50.c
+++ b/drivers/crypto/msm/qce50.c
@@ -2445,6 +2445,9 @@
 	struct sps_iovec *iovec = sps_bam_pipe->iovec +
 						sps_bam_pipe->iovec_count;
 
+	if (!sg_src)
+		return -ENOENT;
+
 	while (nbytes > 0) {
 		len = min(nbytes, sg_dma_len(sg_src));
 		nbytes -= len;
diff --git a/drivers/extcon/extcon.c b/drivers/extcon/extcon.c
index 5135571..99c0b9f 100644
--- a/drivers/extcon/extcon.c
+++ b/drivers/extcon/extcon.c
@@ -482,7 +482,7 @@
 }
 EXPORT_SYMBOL_GPL(extcon_sync);
 
-int extcon_blocking_sync(struct extcon_dev *edev, unsigned int id, bool val)
+int extcon_blocking_sync(struct extcon_dev *edev, unsigned int id, u8 val)
 {
 	int index;
 
diff --git a/drivers/gpu/drm/msm/dsi-staging/dsi_clk_manager.c b/drivers/gpu/drm/msm/dsi-staging/dsi_clk_manager.c
index 2e3828e..fdaf283 100644
--- a/drivers/gpu/drm/msm/dsi-staging/dsi_clk_manager.c
+++ b/drivers/gpu/drm/msm/dsi-staging/dsi_clk_manager.c
@@ -490,17 +490,24 @@
 	return 0;
 }
 
-static int dsi_link_lp_clk_start(struct dsi_link_lp_clk_info *link_lp_clks)
+static int dsi_link_lp_clk_start(struct dsi_link_lp_clk_info *link_lp_clks,
+	int index)
 {
 	int rc = 0;
 	struct dsi_clk_mngr *mngr;
 	struct dsi_link_clks *l_clks;
 
+	if (index >= MAX_DSI_CTRL) {
+		pr_err("Invalid DSI ctrl index\n");
+		return -EINVAL;
+	}
+
 	l_clks = container_of(link_lp_clks, struct dsi_link_clks, lp_clks);
 
-	mngr = container_of(l_clks, struct dsi_clk_mngr, link_clks[0]);
+	mngr = container_of(l_clks, struct dsi_clk_mngr, link_clks[index]);
 	if (!mngr)
 		return -EINVAL;
+
 	/*
 	 * In an ideal world, cont_splash_enabled should not be required inside
 	 * the clock manager. But, in the current driver cont_splash_enabled
@@ -618,7 +625,7 @@
 	m_clks = &clks[master_ndx];
 
 	if (l_type & DSI_LINK_LP_CLK) {
-		rc = dsi_link_lp_clk_start(&m_clks->lp_clks);
+		rc = dsi_link_lp_clk_start(&m_clks->lp_clks, master_ndx);
 		if (rc) {
 			pr_err("failed to turn on master lp link clocks, rc=%d\n",
 				rc);
@@ -642,7 +649,7 @@
 			continue;
 
 		if (l_type & DSI_LINK_LP_CLK) {
-			rc = dsi_link_lp_clk_start(&clk->lp_clks);
+			rc = dsi_link_lp_clk_start(&clk->lp_clks, i);
 			if (rc) {
 				pr_err("failed to turn on lp link clocks, rc=%d\n",
 					rc);
@@ -775,13 +782,12 @@
 	return rc;
 }
 
-static int dsi_clk_update_link_clk_state(struct dsi_link_clks *l_clks,
-	enum dsi_lclk_type l_type, u32 l_state, bool enable)
+static int dsi_clk_update_link_clk_state(struct dsi_clk_mngr *mngr,
+	struct dsi_link_clks *l_clks, enum dsi_lclk_type l_type, u32 l_state,
+	bool enable)
 {
 	int rc = 0;
-	struct dsi_clk_mngr *mngr;
 
-	mngr = container_of(l_clks, struct dsi_clk_mngr, link_clks[0]);
 	if (!mngr)
 		return -EINVAL;
 
@@ -840,23 +846,13 @@
 	return rc;
 }
 
-static int dsi_update_clk_state(struct dsi_core_clks *c_clks, u32 c_state,
-				struct dsi_link_clks *l_clks, u32 l_state)
+static int dsi_update_clk_state(struct dsi_clk_mngr *mngr,
+	struct dsi_core_clks *c_clks, u32 c_state,
+	struct dsi_link_clks *l_clks, u32 l_state)
 {
 	int rc = 0;
-	struct dsi_clk_mngr *mngr;
 	bool l_c_on = false;
 
-	if (c_clks) {
-		mngr =
-		container_of(c_clks, struct dsi_clk_mngr, core_clks[0]);
-	} else if (l_clks) {
-		mngr =
-		container_of(l_clks, struct dsi_clk_mngr, link_clks[0]);
-	} else {
-		mngr = NULL;
-	}
-
 	if (!mngr)
 		return -EINVAL;
 
@@ -898,12 +894,12 @@
 
 	if (l_clks) {
 		if (l_state == DSI_CLK_ON) {
-			rc = dsi_clk_update_link_clk_state(l_clks,
+			rc = dsi_clk_update_link_clk_state(mngr, l_clks,
 				DSI_LINK_LP_CLK, l_state, true);
 			if (rc)
 				goto error;
 
-			rc = dsi_clk_update_link_clk_state(l_clks,
+			rc = dsi_clk_update_link_clk_state(mngr, l_clks,
 				DSI_LINK_HS_CLK, l_state, true);
 			if (rc)
 				goto error;
@@ -947,12 +943,12 @@
 				pr_debug("ECG: core and Link_on\n");
 			}
 
-			rc = dsi_clk_update_link_clk_state(l_clks,
+			rc = dsi_clk_update_link_clk_state(mngr, l_clks,
 				DSI_LINK_HS_CLK, l_state, false);
 			if (rc)
 				goto error;
 
-			rc = dsi_clk_update_link_clk_state(l_clks,
+			rc = dsi_clk_update_link_clk_state(mngr, l_clks,
 				DSI_LINK_LP_CLK, l_state, false);
 			if (rc)
 				goto error;
@@ -1102,7 +1098,7 @@
 		old_l_clk_state, new_link_clk_state);
 
 	if (c_clks || l_clks) {
-		rc = dsi_update_clk_state(c_clks, new_core_clk_state,
+		rc = dsi_update_clk_state(mngr, c_clks, new_core_clk_state,
 					  l_clks, new_link_clk_state);
 		if (rc) {
 			pr_err("failed to update clock state, rc = %d\n", rc);
diff --git a/drivers/gpu/drm/msm/dsi-staging/dsi_panel.c b/drivers/gpu/drm/msm/dsi-staging/dsi_panel.c
index 85b92f59..2a70155 100644
--- a/drivers/gpu/drm/msm/dsi-staging/dsi_panel.c
+++ b/drivers/gpu/drm/msm/dsi-staging/dsi_panel.c
@@ -2075,7 +2075,7 @@
 	int target_bpp_x16;
 	int data;
 	int final_value, final_scale;
-	int ratio_index;
+	int ratio_index, mod_offset;
 
 	dsc->rc_model_size = 8192;
 
@@ -2147,7 +2147,20 @@
 		dsc->quant_incr_limit1 = 19;
 	}
 
-	dsc->slice_last_group_size = 3 - (dsc->slice_width % 3);
+	mod_offset = dsc->slice_width % 3;
+	switch (mod_offset) {
+	case 0:
+		dsc->slice_last_group_size = 2;
+		break;
+	case 1:
+		dsc->slice_last_group_size = 0;
+		break;
+	case 2:
+		dsc->slice_last_group_size = 1;
+		break;
+	default:
+		break;
+	}
 
 	dsc->det_thresh_flatness = 7 + 2*(bpc - 8);
 
diff --git a/drivers/gpu/drm/msm/sde/sde_encoder_phys.h b/drivers/gpu/drm/msm/sde/sde_encoder_phys.h
index 4e9430e..953106e 100644
--- a/drivers/gpu/drm/msm/sde/sde_encoder_phys.h
+++ b/drivers/gpu/drm/msm/sde/sde_encoder_phys.h
@@ -255,6 +255,7 @@
  * @enc_spinlock:	Virtual-Encoder-Wide Spin Lock for IRQ purposes
  * @enable_state:	Enable state tracking
  * @vblank_refcount:	Reference count of vblank request
+ * @wbirq_refcount:	Reference count of wb irq request
  * @vsync_cnt:		Vsync count for the physical encoder
  * @underrun_cnt:	Underrun count for the physical encoder
  * @pending_kickoff_cnt:	Atomic counter tracking the number of kickoffs
@@ -293,6 +294,7 @@
 	enum sde_enc_enable_state enable_state;
 	struct mutex *vblank_ctl_lock;
 	atomic_t vblank_refcount;
+	atomic_t wbirq_refcount;
 	atomic_t vsync_cnt;
 	atomic_t underrun_cnt;
 	atomic_t pending_ctlstart_cnt;
diff --git a/drivers/gpu/drm/msm/sde/sde_encoder_phys_wb.c b/drivers/gpu/drm/msm/sde/sde_encoder_phys_wb.c
index 4bbcb3a..dd9e198 100644
--- a/drivers/gpu/drm/msm/sde/sde_encoder_phys_wb.c
+++ b/drivers/gpu/drm/msm/sde/sde_encoder_phys_wb.c
@@ -904,7 +904,8 @@
 {
 
 	struct sde_encoder_phys_wb *wb_enc = to_sde_encoder_phys_wb(phys);
-	int index = 0;
+	int index = 0, refcount;
+	int ret = 0;
 
 	if (!wb_enc)
 		return;
@@ -912,17 +913,33 @@
 	if (wb_enc->bypass_irqreg)
 		return;
 
-	if (enable) {
-		sde_encoder_helper_register_irq(phys, INTR_IDX_WB_DONE);
-		if (phys->in_clone_mode) {
+	refcount = atomic_read(&phys->wbirq_refcount);
+
+	if (!enable && !refcount)
+		return;
+
+	SDE_EVT32(DRMID(phys->parent), enable,
+			atomic_read(&phys->wbirq_refcount));
+
+	if (enable && atomic_inc_return(&phys->wbirq_refcount) == 1) {
+		ret = sde_encoder_helper_register_irq(phys, INTR_IDX_WB_DONE);
+		if (ret)
+			atomic_dec_return(&phys->wbirq_refcount);
+
+	} else if (!enable &&
+			atomic_dec_return(&phys->wbirq_refcount) == 0) {
+		ret = sde_encoder_helper_unregister_irq(phys, INTR_IDX_WB_DONE);
+		if (ret)
+			atomic_inc_return(&phys->wbirq_refcount);
+	}
+
+	if (phys->in_clone_mode) {
+		if (enable) {
 			for (index = 0; index < CRTC_DUAL_MIXERS; index++)
 				sde_encoder_helper_register_irq(phys,
 						index ? INTR_IDX_PP3_OVFL
 						: INTR_IDX_PP2_OVFL);
-		}
-	} else {
-		sde_encoder_helper_unregister_irq(phys, INTR_IDX_WB_DONE);
-		if (phys->in_clone_mode) {
+		} else {
 			for (index = 0; index < CRTC_DUAL_MIXERS; index++)
 				sde_encoder_helper_unregister_irq(phys,
 						index ? INTR_IDX_PP3_OVFL
@@ -1354,10 +1371,12 @@
 
 	phys_enc->enable_state = SDE_ENC_DISABLING;
 	sde_encoder_phys_wb_prepare_for_kickoff(phys_enc, NULL);
+	sde_encoder_phys_wb_irq_ctrl(phys_enc, true);
 	if (phys_enc->hw_ctl->ops.trigger_flush)
 		phys_enc->hw_ctl->ops.trigger_flush(phys_enc->hw_ctl);
 	sde_encoder_helper_trigger_start(phys_enc);
 	sde_encoder_phys_wb_wait_for_commit_done(phys_enc);
+	sde_encoder_phys_wb_irq_ctrl(phys_enc, false);
 exit:
 	phys_enc->enable_state = SDE_ENC_DISABLED;
 	wb_enc->crtc = NULL;
@@ -1576,6 +1595,7 @@
 	phys_enc->enc_spinlock = p->enc_spinlock;
 	phys_enc->vblank_ctl_lock = p->vblank_ctl_lock;
 	atomic_set(&phys_enc->pending_retire_fence_cnt, 0);
+	atomic_set(&phys_enc->wbirq_refcount, 0);
 
 	irq = &phys_enc->irq[INTR_IDX_WB_DONE];
 	INIT_LIST_HEAD(&irq->cb.list);
diff --git a/drivers/gpu/drm/msm/sde/sde_hw_dsc.c b/drivers/gpu/drm/msm/sde/sde_hw_dsc.c
index 9fd3c25..4fa13bd 100644
--- a/drivers/gpu/drm/msm/sde/sde_hw_dsc.c
+++ b/drivers/gpu/drm/msm/sde/sde_hw_dsc.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -65,7 +65,7 @@
 		initial_lines += 1;
 
 	data |= (initial_lines << 20);
-	data |= ((dsc->slice_last_group_size - 1) << 18);
+	data |= (dsc->slice_last_group_size << 18);
 	/* bpp is 6.4 format, 4 LSBs bits are for fractional part */
 	lsb = dsc->bpp % 4;
 	bpp = dsc->bpp / 4;
diff --git a/drivers/gpu/drm/msm/sde/sde_hw_reg_dma_v1_color_proc.c b/drivers/gpu/drm/msm/sde/sde_hw_reg_dma_v1_color_proc.c
index 01d2f52..96b0838 100644
--- a/drivers/gpu/drm/msm/sde/sde_hw_reg_dma_v1_color_proc.c
+++ b/drivers/gpu/drm/msm/sde/sde_hw_reg_dma_v1_color_proc.c
@@ -287,7 +287,7 @@
 	}
 
 	if (feature_map[feature] >= REG_DMA_FEATURES_MAX) {
-		DRM_ERROR("invalid feature map %d for feature %d\n",
+		DRM_WARN("invalid feature map %d for feature %d\n",
 			feature_map[feature], feature);
 		return -ENOTSUPP;
 	}
diff --git a/drivers/gpu/msm/adreno-gpulist.h b/drivers/gpu/msm/adreno-gpulist.h
index 614b1c7..0a59334 100644
--- a/drivers/gpu/msm/adreno-gpulist.h
+++ b/drivers/gpu/msm/adreno-gpulist.h
@@ -207,11 +207,9 @@
 		.major = 0,
 		.minor = 4,
 		.patchid = ANY_ID,
-		.features = ADRENO_PREEMPTION | ADRENO_64BIT |
-			ADRENO_CONTENT_PROTECTION | ADRENO_CPZ_RETENTION,
+		.features = ADRENO_PREEMPTION | ADRENO_64BIT,
 		.pm4fw_name = "a530_pm4.fw",
 		.pfpfw_name = "a530_pfp.fw",
-		.zap_name = "a506_zap",
 		.gpudev = &adreno_a5xx_gpudev,
 		.gmem_size = (SZ_128K + SZ_8K),
 		.num_protected_regs = 0x20,
diff --git a/drivers/gpu/msm/adreno.c b/drivers/gpu/msm/adreno.c
index 2585a27..7c219fa 100644
--- a/drivers/gpu/msm/adreno.c
+++ b/drivers/gpu/msm/adreno.c
@@ -1993,6 +1993,17 @@
 		}
 	}
 
+	if (kgsl_gmu_isenabled(device) && adreno_dev->perfctr_ifpc_lo == 0) {
+		ret = adreno_perfcounter_get(adreno_dev,
+				KGSL_PERFCOUNTER_GROUP_GPMU_PWR, 4,
+				&adreno_dev->perfctr_ifpc_lo, NULL,
+				PERFCOUNTER_FLAG_KERNEL);
+		if (ret) {
+			WARN_ONCE(1, "Unable to get perf counter for IFPC\n");
+			adreno_dev->perfctr_ifpc_lo = 0;
+		}
+	}
+
 	/* Clear the busy_data stats - we're starting over from scratch */
 	adreno_dev->busy_data.gpu_busy = 0;
 	adreno_dev->busy_data.bif_ram_cycles = 0;
@@ -2001,6 +2012,7 @@
 	adreno_dev->busy_data.bif_ram_cycles_write_ch1 = 0;
 	adreno_dev->busy_data.bif_starved_ram = 0;
 	adreno_dev->busy_data.bif_starved_ram_ch1 = 0;
+	adreno_dev->busy_data.num_ifpc = 0;
 
 	/* Restore performance counter registers with saved values */
 	adreno_perfcounter_restore(adreno_dev);
@@ -3552,6 +3564,17 @@
 		stats->ram_time = ram_cycles;
 		stats->ram_wait = starved_ram;
 	}
+
+	if (adreno_dev->perfctr_ifpc_lo != 0) {
+		uint32_t num_ifpc;
+
+		num_ifpc = counter_delta(device, adreno_dev->perfctr_ifpc_lo,
+				&busy->num_ifpc);
+		adreno_dev->ifpc_count += num_ifpc;
+		if (num_ifpc > 0)
+			trace_adreno_ifpc_count(adreno_dev->ifpc_count);
+	}
+
 	if (adreno_dev->lm_threshold_count &&
 			gpudev->count_throttles)
 		gpudev->count_throttles(adreno_dev, adj);
diff --git a/drivers/gpu/msm/adreno.h b/drivers/gpu/msm/adreno.h
index fc32fb9..555856a 100644
--- a/drivers/gpu/msm/adreno.h
+++ b/drivers/gpu/msm/adreno.h
@@ -309,6 +309,7 @@
 	unsigned int bif_ram_cycles_write_ch1;
 	unsigned int bif_starved_ram;
 	unsigned int bif_starved_ram_ch1;
+	unsigned int num_ifpc;
 	unsigned int throttle_cycles[ADRENO_GPMU_THROTTLE_COUNTERS];
 };
 
@@ -467,6 +468,7 @@
  * stall cycles in case of GBIF)
  * @starved_ram_lo_ch1: Number of cycles GBIF is stalled by DDR channel 1
  * @perfctr_pwr_lo: GPU busy cycles
+ * @perfctr_ifpc_lo: IFPC count
  * @halt: Atomic variable to check whether the GPU is currently halted
  * @pending_irq_refcnt: Atomic variable to keep track of running IRQ handlers
  * @ctx_d_debugfs: Context debugfs node
@@ -484,6 +486,7 @@
  * @lm_limit: limiting value for LM
  * @lm_threshold_count: register value for counter for lm threshold breakin
  * @lm_threshold_cross: number of current peaks exceeding threshold
+ * @ifpc_count: Number of times the GPU went into IFPC
  * @speed_bin: Indicate which power level set to use
  * @csdev: Pointer to a coresight device (if applicable)
  * @gpmu_throttle_counters - counteers for number of throttled clocks
@@ -533,6 +536,7 @@
 	unsigned int starved_ram_lo;
 	unsigned int starved_ram_lo_ch1;
 	unsigned int perfctr_pwr_lo;
+	unsigned int perfctr_ifpc_lo;
 	atomic_t halt;
 	atomic_t pending_irq_refcnt;
 	struct dentry *ctx_d_debugfs;
@@ -552,6 +556,7 @@
 	uint32_t lm_limit;
 	uint32_t lm_threshold_count;
 	uint32_t lm_threshold_cross;
+	uint32_t ifpc_count;
 
 	unsigned int speed_bin;
 	unsigned int quirks;
diff --git a/drivers/gpu/msm/adreno_a6xx_preempt.c b/drivers/gpu/msm/adreno_a6xx_preempt.c
index 132fb02..89965f2 100644
--- a/drivers/gpu/msm/adreno_a6xx_preempt.c
+++ b/drivers/gpu/msm/adreno_a6xx_preempt.c
@@ -232,6 +232,38 @@
 	return NULL;
 }
 
+#define GMU_ACTIVE_STATE_RETRY_MAX 100
+
+static int adreno_gmu_wait_for_active(struct adreno_device *adreno_dev)
+{
+	unsigned int reg, num_retries = 0;
+	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
+
+	if (!kgsl_gmu_isenabled(device))
+		return 0;
+
+	kgsl_gmu_regread(device,
+		A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE, &reg);
+
+	while (reg != GPU_HW_ACTIVE) {
+		/* Wait for small time before trying again */
+		udelay(5);
+		kgsl_gmu_regread(device,
+			A6XX_GPU_GMU_CX_GMU_RPMH_POWER_STATE, &reg);
+
+		if (num_retries == GMU_ACTIVE_STATE_RETRY_MAX &&
+			reg != GPU_HW_ACTIVE) {
+			dev_err(adreno_dev->dev.dev,
+				"GMU failed to move to ACTIVE state: 0x%x\n",
+				reg);
+			return -ETIMEDOUT;
+		}
+		num_retries++;
+	}
+
+	return 0;
+}
+
 void a6xx_preemption_trigger(struct adreno_device *adreno_dev)
 {
 	struct kgsl_device *device = KGSL_DEVICE(adreno_dev);
@@ -361,6 +393,23 @@
 		upper_32_bits(gpuaddr),
 		FENCE_STATUS_WRITEDROPPED1_MASK);
 
+	/*
+	 * Above fence writes will make sure GMU comes out of
+	 * IFPC state if its was in IFPC state but it doesn't
+	 * guarantee that GMU FW actually moved to ACTIVE state
+	 * i.e. wake-up from IFPC is complete.
+	 * Wait for GMU to move to ACTIVE state before triggering
+	 * preemption. This is require to make sure CP doesn't
+	 * interrupt GMU during wake-up from IFPC.
+	 */
+	if (adreno_gmu_wait_for_active(adreno_dev)) {
+		adreno_set_preempt_state(adreno_dev, ADRENO_PREEMPT_NONE);
+
+		adreno_set_gpu_fault(adreno_dev, ADRENO_GMU_FAULT);
+		adreno_dispatcher_schedule(device);
+		return;
+	}
+
 	adreno_dev->next_rb = next;
 
 	/* Start the timer to detect a stuck preemption */
diff --git a/drivers/gpu/msm/adreno_ringbuffer.c b/drivers/gpu/msm/adreno_ringbuffer.c
index f7f01f5..b095b027 100644
--- a/drivers/gpu/msm/adreno_ringbuffer.c
+++ b/drivers/gpu/msm/adreno_ringbuffer.c
@@ -115,8 +115,11 @@
 	rb->wptr = rb->_wptr;
 	spin_unlock_irqrestore(&rb->preempt_lock, flags);
 
-	if (ret)
-		kgsl_device_snapshot(KGSL_DEVICE(adreno_dev), NULL, false);
+	if (ret) {
+		/* If WPTR update fails, set the fault and trigger recovery */
+		adreno_set_gpu_fault(adreno_dev, ADRENO_GMU_FAULT);
+		adreno_dispatcher_schedule(KGSL_DEVICE(adreno_dev));
+	}
 
 }
 
diff --git a/drivers/gpu/msm/adreno_sysfs.c b/drivers/gpu/msm/adreno_sysfs.c
index 022aa9f..a7aa939 100644
--- a/drivers/gpu/msm/adreno_sysfs.c
+++ b/drivers/gpu/msm/adreno_sysfs.c
@@ -341,6 +341,11 @@
 	return kgsl_gmu_isenabled(device) && gmu->idle_level >= GPU_HW_IFPC;
 }
 
+static unsigned int _ifpc_count_show(struct adreno_device *adreno_dev)
+{
+	return adreno_dev->ifpc_count;
+}
+
 static unsigned int _preempt_count_show(struct adreno_device *adreno_dev)
 {
 	struct adreno_preemption *preempt = &adreno_dev->preempt;
@@ -451,6 +456,7 @@
 static ADRENO_SYSFS_BOOL(hwcg);
 static ADRENO_SYSFS_BOOL(throttling);
 static ADRENO_SYSFS_BOOL(ifpc);
+static ADRENO_SYSFS_RO_U32(ifpc_count);
 
 
 
@@ -472,6 +478,7 @@
 	&adreno_attr_usesgmem.attr,
 	&adreno_attr_skipsaverestore.attr,
 	&adreno_attr_ifpc.attr,
+	&adreno_attr_ifpc_count.attr,
 	&adreno_attr_preempt_count.attr,
 	NULL,
 };
diff --git a/drivers/gpu/msm/adreno_trace.h b/drivers/gpu/msm/adreno_trace.h
index de028fa..bf5e798 100644
--- a/drivers/gpu/msm/adreno_trace.h
+++ b/drivers/gpu/msm/adreno_trace.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -609,6 +609,19 @@
 		__entry->next->id, __entry->cur->id, __entry->level
 	)
 );
+
+TRACE_EVENT(adreno_ifpc_count,
+	TP_PROTO(unsigned int ifpc_count),
+	TP_ARGS(ifpc_count),
+	TP_STRUCT__entry(
+		__field(unsigned int, ifpc_count)
+	),
+	TP_fast_assign(
+		__entry->ifpc_count = ifpc_count;
+	),
+	TP_printk("total times GMU entered IFPC = %d", __entry->ifpc_count)
+);
+
 #endif /* _ADRENO_TRACE_H */
 
 /* This part must be outside protection */
diff --git a/drivers/gpu/msm/kgsl.c b/drivers/gpu/msm/kgsl.c
index d3bbea3..eb4c29d 100644
--- a/drivers/gpu/msm/kgsl.c
+++ b/drivers/gpu/msm/kgsl.c
@@ -1397,6 +1397,45 @@
 		kgsl_context_put(context);
 		break;
 	}
+	case KGSL_PROP_SECURE_BUFFER_ALIGNMENT:
+	{
+		unsigned int align;
+
+		if (param->sizebytes != sizeof(unsigned int)) {
+			result = -EINVAL;
+			break;
+		}
+		/*
+		 * XPUv2 impose the constraint of 1MB memory alignment,
+		 * on the other hand Hypervisor does not have such
+		 * constraints. So driver should fulfill such
+		 * requirements when allocating secure memory.
+		 */
+		align = MMU_FEATURE(&dev_priv->device->mmu,
+				KGSL_MMU_HYP_SECURE_ALLOC) ? PAGE_SIZE : SZ_1M;
+
+		if (copy_to_user(param->value, &align, sizeof(align)))
+			result = -EFAULT;
+
+		break;
+	}
+	case KGSL_PROP_SECURE_CTXT_SUPPORT:
+	{
+		unsigned int secure_ctxt;
+
+		if (param->sizebytes != sizeof(unsigned int)) {
+			result = -EINVAL;
+			break;
+		}
+
+		secure_ctxt = dev_priv->device->mmu.secured ? 1 : 0;
+
+		if (copy_to_user(param->value, &secure_ctxt,
+				sizeof(secure_ctxt)))
+			result = -EFAULT;
+
+		break;
+	}
 	default:
 		if (is_compat_task())
 			result = dev_priv->device->ftbl->getproperty_compat(
diff --git a/drivers/gpu/msm/kgsl_gmu.c b/drivers/gpu/msm/kgsl_gmu.c
index dbc3d53..6e31964 100644
--- a/drivers/gpu/msm/kgsl_gmu.c
+++ b/drivers/gpu/msm/kgsl_gmu.c
@@ -1662,7 +1662,7 @@
 	if (!kgsl_gmu_isenabled(KGSL_DEVICE(adreno_dev)))
 		return 0;
 
-	for (i = 0; i < GMU_WAKEUP_RETRY_MAX; i++) {
+	for (i = 0; i < GMU_LONG_WAKEUP_RETRY_LIMIT; i++) {
 		adreno_read_gmureg(adreno_dev, ADRENO_REG_GMU_AHB_FENCE_STATUS,
 			&status);
 
@@ -1677,9 +1677,19 @@
 
 		/* Try to write the fenced register again */
 		adreno_writereg(adreno_dev, offset, val);
+
+		if (i == GMU_SHORT_WAKEUP_RETRY_LIMIT)
+			dev_err(adreno_dev->dev.dev,
+				"Waited %d usecs to write fenced register 0x%x. Continuing to wait...\n",
+				(GMU_SHORT_WAKEUP_RETRY_LIMIT *
+				GMU_WAKEUP_DELAY_US),
+				reg_offset);
 	}
 
 	dev_err(adreno_dev->dev.dev,
-		"GMU fenced register write timed out: reg 0x%x\n", reg_offset);
+		"Timed out waiting %d usecs to write fenced register 0x%x\n",
+		GMU_LONG_WAKEUP_RETRY_LIMIT * GMU_WAKEUP_DELAY_US,
+		reg_offset);
+
 	return -ETIMEDOUT;
 }
diff --git a/drivers/gpu/msm/kgsl_gmu.h b/drivers/gpu/msm/kgsl_gmu.h
index 130d400..069f835 100644
--- a/drivers/gpu/msm/kgsl_gmu.h
+++ b/drivers/gpu/msm/kgsl_gmu.h
@@ -92,8 +92,15 @@
  * the GMU will start shutting down before we try again.
  */
 #define GMU_WAKEUP_DELAY_US 10
-/* Max amount of tries to wake up the GMU. */
-#define GMU_WAKEUP_RETRY_MAX 60
+
+/* Max amount of tries to wake up the GMU. The short retry
+ * limit is half of the long retry limit. After the short
+ * number of retries, we print an informational message to say
+ * exiting IFPC is taking longer than expected. We continue
+ * to retry after this until the long retry limit.
+ */
+#define GMU_SHORT_WAKEUP_RETRY_LIMIT 100
+#define GMU_LONG_WAKEUP_RETRY_LIMIT 200
 
 /* Bits for the flags field in the gmu structure */
 enum gmu_flags {
diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
index b9b1e9c..9971fcd 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c
@@ -2073,16 +2073,16 @@
 	coresight_simple_func(struct etmv4_drvdata, etmv4_cross_read,	\
 			      name, offset)
 
-coresight_etm4x_simple_func(trcpdcr, TRCPDCR);
-coresight_etm4x_simple_func(trcpdsr, TRCPDSR);
-coresight_etm4x_simple_func(trclsr, TRCLSR);
-coresight_etm4x_simple_func(trcauthstatus, TRCAUTHSTATUS);
-coresight_etm4x_simple_func(trcdevid, TRCDEVID);
-coresight_etm4x_simple_func(trcdevtype, TRCDEVTYPE);
-coresight_etm4x_simple_func(trcpidr0, TRCPIDR0);
-coresight_etm4x_simple_func(trcpidr1, TRCPIDR1);
-coresight_etm4x_simple_func(trcpidr2, TRCPIDR2);
-coresight_etm4x_simple_func(trcpidr3, TRCPIDR3);
+coresight_etm4x_cross_read(trcpdcr, TRCPDCR);
+coresight_etm4x_cross_read(trcpdsr, TRCPDSR);
+coresight_etm4x_cross_read(trclsr, TRCLSR);
+coresight_etm4x_cross_read(trcauthstatus, TRCAUTHSTATUS);
+coresight_etm4x_cross_read(trcdevid, TRCDEVID);
+coresight_etm4x_cross_read(trcdevtype, TRCDEVTYPE);
+coresight_etm4x_cross_read(trcpidr0, TRCPIDR0);
+coresight_etm4x_cross_read(trcpidr1, TRCPIDR1);
+coresight_etm4x_cross_read(trcpidr2, TRCPIDR2);
+coresight_etm4x_cross_read(trcpidr3, TRCPIDR3);
 coresight_etm4x_cross_read(trcoslsr, TRCOSLSR);
 coresight_etm4x_cross_read(trcconfig, TRCCONFIGR);
 coresight_etm4x_cross_read(trctraceid, TRCTRACEIDR);
diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c
index caeda7b..83a590b 100644
--- a/drivers/hwtracing/coresight/coresight-stm.c
+++ b/drivers/hwtracing/coresight/coresight-stm.c
@@ -215,7 +215,7 @@
 		spin_unlock(&drvdata->spinlock);
 
 		/* Wait until the engine has completely stopped */
-		coresight_timeout(drvdata, STMTCSR, STMTCSR_BUSY_BIT, 0);
+		coresight_timeout(drvdata->base, STMTCSR, STMTCSR_BUSY_BIT, 0);
 
 		pm_runtime_put(drvdata->dev);
 
diff --git a/drivers/input/misc/qti-haptics.c b/drivers/input/misc/qti-haptics.c
index f60e835..459faf9 100644
--- a/drivers/input/misc/qti-haptics.c
+++ b/drivers/input/misc/qti-haptics.c
@@ -10,8 +10,10 @@
  * GNU General Public License for more details.
  */
 
+#include <linux/debugfs.h>
 #include <linux/device.h>
 #include <linux/err.h>
+#include <linux/fs.h>
 #include <linux/hrtimer.h>
 #include <linux/init.h>
 #include <linux/input.h>
@@ -24,8 +26,9 @@
 #include <linux/pwm.h>
 #include <linux/regmap.h>
 #include <linux/regulator/consumer.h>
-#include <linux/uaccess.h>
+#include <linux/slab.h>
 #include <linux/types.h>
+#include <linux/uaccess.h>
 
 enum actutor_type {
 	ACT_LRA,
@@ -70,6 +73,7 @@
 #define HAP_SC_DET_MAX_COUNT		5
 #define HAP_SC_DET_TIME_US		1000000
 #define FF_EFFECT_COUNT_MAX		32
+#define HAP_DISABLE_DELAY_USEC		1000
 
 /* haptics module register definitions */
 #define REG_HAP_STATUS1			0x0A
@@ -216,6 +220,8 @@
 	struct qti_hap_effect		constant;
 	struct regulator		*vdd_supply;
 	struct hrtimer			stop_timer;
+	struct hrtimer			hap_disable_timer;
+	struct dentry			*hap_debugfs;
 	spinlock_t			bus_lock;
 	ktime_t				last_sc_time;
 	int				play_irq;
@@ -524,9 +530,24 @@
 	return rc;
 }
 
-static int qti_haptics_config_brake(struct qti_hap_chip *chip, u8 *brake)
+static int qti_haptics_brake_enable(struct qti_hap_chip *chip, bool en)
 {
 	u8 addr, mask, val;
+	int rc;
+
+	addr = REG_HAP_EN_CTL2;
+	mask = HAP_BRAKE_EN_BIT;
+	val = en ? HAP_BRAKE_EN_BIT : 0;
+	rc = qti_haptics_masked_write(chip, addr, mask, val);
+	if (rc < 0)
+		dev_err(chip->dev, "write BRAKE_EN failed, rc=%d\n", rc);
+
+	return rc;
+}
+
+static int qti_haptics_config_brake(struct qti_hap_chip *chip, u8 *brake)
+{
+	u8 addr,  val;
 	int i, rc;
 
 	addr = REG_HAP_BRAKE;
@@ -543,11 +564,7 @@
 	 * Set BRAKE_EN regardless of the brake pattern, this helps to stop
 	 * playing immediately once the valid values in WF_Sx are played.
 	 */
-	addr = REG_HAP_EN_CTL2;
-	val = mask = HAP_BRAKE_EN_BIT;
-	rc = qti_haptics_masked_write(chip, addr, mask, val);
-	if (rc < 0)
-		dev_err(chip->dev, "set EN_CTL2 failed, rc=%d\n", rc);
+	rc = qti_haptics_brake_enable(chip, true);
 
 	return rc;
 }
@@ -567,16 +584,46 @@
 	return rc;
 }
 
+#define HAP_CLEAR_PLAYING_RATE_US	15
+static int qti_haptics_clear_settings(struct qti_hap_chip *chip)
+{
+	int rc;
+	u8 pattern[HAP_WAVEFORM_BUFFER_MAX] = {1, 0, 0, 0, 0, 0, 0, 0};
+
+	rc = qti_haptics_brake_enable(chip, false);
+	if (rc < 0)
+		return rc;
+
+	rc = qti_haptics_lra_auto_res_enable(chip, false);
+	if (rc < 0)
+		return rc;
+
+	rc = qti_haptics_config_play_rate_us(chip, HAP_CLEAR_PLAYING_RATE_US);
+	if (rc < 0)
+		return rc;
+
+	rc = qti_haptics_write(chip, REG_HAP_WF_S1, pattern,
+			HAP_WAVEFORM_BUFFER_MAX);
+	if (rc < 0)
+		return rc;
+
+	rc = qti_haptics_play(chip, true);
+	if (rc < 0)
+		return rc;
+
+	rc = qti_haptics_play(chip, false);
+	if (rc < 0)
+		return rc;
+
+	return 0;
+}
+
 static int qti_haptics_load_constant_waveform(struct qti_hap_chip *chip)
 {
 	struct qti_hap_play_info *play = &chip->play;
 	struct qti_hap_config *config = &chip->config;
 	int rc = 0;
 
-	rc = qti_haptics_module_en(chip, true);
-	if (rc < 0)
-		return rc;
-
 	rc = qti_haptics_config_play_rate_us(chip, config->play_rate_us);
 	if (rc < 0)
 		return rc;
@@ -604,6 +651,7 @@
 			return rc;
 
 		play->playing_pattern = false;
+		play->effect = NULL;
 	} else {
 		rc = qti_haptics_config_vmax(chip, config->vmax_mv);
 		if (rc < 0)
@@ -644,11 +692,6 @@
 
 	play->effect = &chip->predefined[effect_idx];
 	play->playing_pos = 0;
-
-	rc = qti_haptics_module_en(chip, true);
-	if (rc < 0)
-		return rc;
-
 	rc = qti_haptics_config_vmax(chip, play->vmax_mv);
 	if (rc < 0)
 		return rc;
@@ -790,15 +833,15 @@
 	struct qti_hap_play_info *play = &chip->play;
 	int rc = 0, tmp, i;
 	s16 level, data[CUSTOM_DATA_LEN];
+	ktime_t rem;
+	s64 time_us;
 
-	if (chip->vdd_supply && !chip->vdd_enabled) {
-		rc = regulator_enable(chip->vdd_supply);
-		if (rc < 0) {
-			dev_err(chip->dev, "Enable VDD supply failed, rc=%d\n",
-					rc);
-			return rc;
-		}
-		chip->vdd_enabled = true;
+	if (hrtimer_active(&chip->hap_disable_timer)) {
+		rem = hrtimer_get_remaining(&chip->hap_disable_timer);
+		time_us = ktime_to_us(rem);
+		dev_dbg(chip->dev, "waiting for playing clear sequence: %lld us\n",
+				time_us);
+		usleep_range(time_us, time_us + 100);
 	}
 
 	switch (effect->type) {
@@ -814,27 +857,22 @@
 		if (rc < 0) {
 			dev_err(chip->dev, "Play constant waveform failed, rc=%d\n",
 					rc);
-			goto disable_vdd;
+			return rc;
 		}
 		break;
 
 	case FF_PERIODIC:
-		if (chip->effects_count == 0) {
-			rc = -EINVAL;
-			goto disable_vdd;
-		}
+		if (chip->effects_count == 0)
+			return -EINVAL;
 
 		if (effect->u.periodic.waveform != FF_CUSTOM) {
 			dev_err(chip->dev, "Only accept custom waveforms\n");
-			rc = -EINVAL;
-			goto disable_vdd;
+			return -EINVAL;
 		}
 
 		if (copy_from_user(data, effect->u.periodic.custom_data,
-					sizeof(s16) * CUSTOM_DATA_LEN)) {
-			rc = -EFAULT;
-			goto disable_vdd;
-		}
+					sizeof(s16) * CUSTOM_DATA_LEN))
+			return -EFAULT;
 
 		for (i = 0; i < chip->effects_count; i++)
 			if (chip->predefined[i].id ==
@@ -844,8 +882,7 @@
 		if (i == chip->effects_count) {
 			dev_err(chip->dev, "predefined effect %d is NOT supported\n",
 					data[0]);
-			rc = -EINVAL;
-			goto disable_vdd;
+			return -EINVAL;
 		}
 
 		level = effect->u.periodic.magnitude;
@@ -858,7 +895,7 @@
 		if (rc < 0) {
 			dev_err(chip->dev, "Play predefined effect %d failed, rc=%d\n",
 					chip->predefined[i].id, rc);
-			goto disable_vdd;
+			return rc;
 		}
 
 		get_play_length(play, &play->length_us);
@@ -873,30 +910,27 @@
 		 * send stop playing command after it's done.
 		 */
 		if (copy_to_user(effect->u.periodic.custom_data, data,
-					sizeof(s16) * CUSTOM_DATA_LEN)) {
-			rc = -EFAULT;
-			goto disable_vdd;
-		}
+					sizeof(s16) * CUSTOM_DATA_LEN))
+			return -EFAULT;
 		break;
 
 	default:
 		dev_err(chip->dev, "Unsupported effect type: %d\n",
 				effect->type);
-		break;
+		return -EINVAL;
 	}
 
-	return 0;
-disable_vdd:
-	if (chip->vdd_supply && chip->vdd_enabled) {
-		rc = regulator_disable(chip->vdd_supply);
+	if (chip->vdd_supply && !chip->vdd_enabled) {
+		rc = regulator_enable(chip->vdd_supply);
 		if (rc < 0) {
-			dev_err(chip->dev, "Disable VDD supply failed, rc=%d\n",
+			dev_err(chip->dev, "Enable VDD supply failed, rc=%d\n",
 					rc);
 			return rc;
 		}
-		chip->vdd_enabled = false;
+		chip->vdd_enabled = true;
 	}
-	return rc;
+
+	return 0;
 }
 
 static int qti_haptics_playback(struct input_dev *dev, int effect_id, int val)
@@ -909,6 +943,10 @@
 
 	dev_dbg(chip->dev, "playback, val = %d\n", val);
 	if (!!val) {
+		rc = qti_haptics_module_en(chip, true);
+		if (rc < 0)
+			return rc;
+
 		rc = qti_haptics_play(chip, true);
 		if (rc < 0)
 			return rc;
@@ -939,10 +977,6 @@
 		if (rc < 0)
 			return rc;
 
-		rc = qti_haptics_module_en(chip, false);
-		if (rc < 0)
-			return rc;
-
 		if (chip->play_irq_en) {
 			disable_irq_nosync(chip->play_irq);
 			chip->play_irq_en = false;
@@ -955,7 +989,7 @@
 static int qti_haptics_erase(struct input_dev *dev, int effect_id)
 {
 	struct qti_hap_chip *chip = input_get_drvdata(dev);
-	int rc = 0;
+	int delay_us, rc = 0;
 
 	if (chip->vdd_supply && chip->vdd_enabled) {
 		rc = regulator_disable(chip->vdd_supply);
@@ -967,6 +1001,22 @@
 		chip->vdd_enabled = false;
 	}
 
+	rc = qti_haptics_clear_settings(chip);
+	if (rc < 0) {
+		dev_err(chip->dev, "clear setting failed, rc=%d\n", rc);
+		return rc;
+	}
+
+	if (chip->play.effect)
+		delay_us = chip->play.effect->play_rate_us;
+	else
+		delay_us = chip->config.play_rate_us;
+
+	delay_us += HAP_DISABLE_DELAY_USEC;
+	hrtimer_start(&chip->hap_disable_timer,
+			ktime_set(0, delay_us * NSEC_PER_USEC),
+			HRTIMER_MODE_REL);
+
 	return rc;
 }
 
@@ -1093,18 +1143,46 @@
 
 	chip->play.length_us = 0;
 	rc = qti_haptics_play(chip, false);
-	if (rc < 0) {
+	if (rc < 0)
 		dev_err(chip->dev, "Stop playing failed, rc=%d\n", rc);
-		goto err_out;
-	}
+
+	return HRTIMER_NORESTART;
+}
+
+static enum hrtimer_restart qti_hap_disable_timer(struct hrtimer *timer)
+{
+	struct qti_hap_chip *chip = container_of(timer, struct qti_hap_chip,
+			hap_disable_timer);
+	int rc;
 
 	rc = qti_haptics_module_en(chip, false);
 	if (rc < 0)
-		dev_err(chip->dev, "Disable module failed, rc=%d\n", rc);
-err_out:
+		dev_err(chip->dev, "Disable haptics module failed, rc=%d\n",
+				rc);
+
 	return HRTIMER_NORESTART;
 }
 
+static void verify_brake_setting(struct qti_hap_effect *effect)
+{
+	int i = effect->brake_pattern_length - 1;
+	u8 val = 0;
+
+	for (; i >= 0; i--) {
+		if (effect->brake[i] != 0)
+			break;
+
+		effect->brake_pattern_length--;
+	}
+
+	for (i = 0; i < effect->brake_pattern_length; i++) {
+		effect->brake[i] &= HAP_BRAKE_PATTERN_MASK;
+		val |= effect->brake[i] << (i * HAP_BRAKE_PATTERN_SHIFT);
+	}
+
+	effect->brake_en = (val != 0);
+}
+
 static int qti_haptics_parse_dt(struct qti_hap_chip *chip)
 {
 	struct qti_hap_config *config = &chip->config;
@@ -1113,7 +1191,6 @@
 	struct qti_hap_effect *effect;
 	const char *str;
 	int rc = 0, tmp, i = 0, j, m;
-	u8 val;
 
 	rc = of_property_read_u32(node, "reg", &tmp);
 	if (rc < 0) {
@@ -1353,17 +1430,7 @@
 		}
 
 		effect->brake_pattern_length = tmp;
-		for (j = tmp - 1; j >= 0; j--) {
-			if (effect->brake[j] != 0)
-				break;
-			effect->brake_pattern_length--;
-		}
-
-		for (val = 0, j = 0; j < effect->brake_pattern_length; j++)
-			val |= (effect->brake[j] & HAP_BRAKE_PATTERN_MASK)
-				<< j * HAP_BRAKE_PATTERN_SHIFT;
-
-		effect->brake_en = (val != 0);
+		verify_brake_setting(effect);
 	}
 
 	for (j = 0; j < i; j++) {
@@ -1391,6 +1458,390 @@
 	return 0;
 }
 
+#ifdef CONFIG_DEBUG_FS
+static int play_rate_dbgfs_read(void *data, u64 *val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+
+	*val = effect->play_rate_us;
+
+	return 0;
+}
+
+static int play_rate_dbgfs_write(void *data, u64 val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+
+	if (val > HAP_PLAY_RATE_US_MAX)
+		val = HAP_PLAY_RATE_US_MAX;
+
+	effect->play_rate_us = val;
+
+	return 0;
+}
+
+static int vmax_dbgfs_read(void *data, u64 *val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+
+	*val = effect->vmax_mv;
+
+	return 0;
+}
+
+static int vmax_dbgfs_write(void *data, u64 val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+
+	if (val > HAP_VMAX_MV_MAX)
+		val = HAP_VMAX_MV_MAX;
+
+	effect->vmax_mv = val;
+
+	return 0;
+}
+
+static int wf_repeat_n_dbgfs_read(void *data, u64 *val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+
+	*val = wf_repeat[effect->wf_repeat_n];
+
+	return 0;
+}
+
+static int wf_repeat_n_dbgfs_write(void *data, u64 val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(wf_repeat); i++)
+		if (val == wf_repeat[i])
+			break;
+
+	if (i == ARRAY_SIZE(wf_repeat))
+		pr_err("wf_repeat value %llu is invalid\n", val);
+	else
+		effect->wf_repeat_n = i;
+
+	return 0;
+}
+
+static int wf_s_repeat_n_dbgfs_read(void *data, u64 *val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+
+	*val = wf_s_repeat[effect->wf_s_repeat_n];
+
+	return 0;
+}
+
+static int wf_s_repeat_n_dbgfs_write(void *data, u64 val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(wf_s_repeat); i++)
+		if (val == wf_s_repeat[i])
+			break;
+
+	if (i == ARRAY_SIZE(wf_s_repeat))
+		pr_err("wf_s_repeat value %llu is invalid\n", val);
+	else
+		effect->wf_s_repeat_n = i;
+
+	return 0;
+}
+
+
+static int auto_res_dbgfs_read(void *data, u64 *val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+
+	*val = !effect->lra_auto_res_disable;
+
+	return 0;
+}
+
+static int auto_res_dbgfs_write(void *data, u64 val)
+{
+	struct qti_hap_effect *effect = (struct qti_hap_effect *)data;
+
+	effect->lra_auto_res_disable = !val;
+
+	return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(play_rate_debugfs_ops,  play_rate_dbgfs_read,
+		play_rate_dbgfs_write, "%llu\n");
+DEFINE_SIMPLE_ATTRIBUTE(vmax_debugfs_ops, vmax_dbgfs_read,
+		vmax_dbgfs_write, "%llu\n");
+DEFINE_SIMPLE_ATTRIBUTE(wf_repeat_n_debugfs_ops,  wf_repeat_n_dbgfs_read,
+		wf_repeat_n_dbgfs_write, "%llu\n");
+DEFINE_SIMPLE_ATTRIBUTE(wf_s_repeat_n_debugfs_ops,  wf_s_repeat_n_dbgfs_read,
+		wf_s_repeat_n_dbgfs_write, "%llu\n");
+DEFINE_SIMPLE_ATTRIBUTE(auto_res_debugfs_ops,  auto_res_dbgfs_read,
+		auto_res_dbgfs_write, "%llu\n");
+
+#define CHAR_PER_PATTERN 8
+static ssize_t brake_pattern_dbgfs_read(struct file *filep,
+		char __user *buf, size_t count, loff_t *ppos)
+{
+	struct qti_hap_effect *effect =
+		(struct qti_hap_effect *)filep->private_data;
+	char *kbuf, *tmp;
+	int rc, length, i, len;
+
+	kbuf = kcalloc(CHAR_PER_PATTERN, HAP_BRAKE_PATTERN_MAX, GFP_KERNEL);
+	if (!kbuf)
+		return -ENOMEM;
+
+	tmp = kbuf;
+	for (length = 0, i = 0; i < HAP_BRAKE_PATTERN_MAX; i++) {
+		len = snprintf(tmp, CHAR_PER_PATTERN, "0x%x ",
+				effect->brake[i]);
+		tmp += len;
+		length += len;
+	}
+
+	kbuf[length++] = '\n';
+	kbuf[length++] = '\0';
+
+	rc = simple_read_from_buffer(buf, count, ppos, kbuf, length);
+
+	kfree(kbuf);
+	return rc;
+}
+
+static ssize_t brake_pattern_dbgfs_write(struct file *filep,
+		const char __user *buf, size_t count, loff_t *ppos)
+{
+	struct qti_hap_effect *effect =
+		(struct qti_hap_effect *)filep->private_data;
+	char *kbuf, *token;
+	int rc = 0, i = 0, j;
+	u32 val;
+
+	kbuf = kmalloc(count + 1, GFP_KERNEL);
+	if (!kbuf)
+		return -ENOMEM;
+
+	rc = copy_from_user(kbuf, buf, count);
+	if (rc > 0) {
+		rc = -EFAULT;
+		goto err;
+	}
+
+	kbuf[count] = '\0';
+	*ppos += count;
+
+	while ((token = strsep(&kbuf, " ")) != NULL) {
+		rc = kstrtouint(token, 0, &val);
+		if (rc < 0) {
+			rc = -EINVAL;
+			goto err;
+		}
+
+		effect->brake[i++] = val & HAP_BRAKE_PATTERN_MASK;
+
+		if (i >= HAP_BRAKE_PATTERN_MAX)
+			break;
+	}
+
+	for (j = i; j < HAP_BRAKE_PATTERN_MAX; j++)
+		effect->brake[j] = 0;
+
+	effect->brake_pattern_length = i;
+	verify_brake_setting(effect);
+
+	rc = count;
+err:
+	kfree(kbuf);
+	return rc;
+}
+
+static const struct file_operations brake_pattern_dbgfs_ops = {
+	.read = brake_pattern_dbgfs_read,
+	.write = brake_pattern_dbgfs_write,
+	.owner = THIS_MODULE,
+	.open = simple_open,
+};
+
+static ssize_t pattern_dbgfs_read(struct file *filep,
+		char __user *buf, size_t count, loff_t *ppos)
+{
+	struct qti_hap_effect *effect =
+		(struct qti_hap_effect *)filep->private_data;
+	char *kbuf, *tmp;
+	int rc, length, i, len;
+
+	kbuf = kcalloc(CHAR_PER_PATTERN, effect->pattern_length, GFP_KERNEL);
+	if (!kbuf)
+		return -ENOMEM;
+
+	tmp = kbuf;
+	for (length = 0, i = 0; i < effect->pattern_length; i++) {
+		len = snprintf(tmp, CHAR_PER_PATTERN, "0x%x ",
+				effect->pattern[i]);
+		tmp += len;
+		length += len;
+	}
+
+	kbuf[length++] = '\n';
+	kbuf[length++] = '\0';
+
+	rc = simple_read_from_buffer(buf, count, ppos, kbuf, length);
+
+	kfree(kbuf);
+	return rc;
+}
+
+static ssize_t pattern_dbgfs_write(struct file *filep,
+		const char __user *buf, size_t count, loff_t *ppos)
+{
+	struct qti_hap_effect *effect =
+		(struct qti_hap_effect *)filep->private_data;
+	char *kbuf, *token;
+	int rc = 0, i = 0, j;
+	u32 val;
+
+	kbuf = kmalloc(count + 1, GFP_KERNEL);
+	if (!kbuf)
+		return -ENOMEM;
+
+	rc = copy_from_user(kbuf, buf, count);
+	if (rc > 0) {
+		rc = -EFAULT;
+		goto err;
+	}
+
+	kbuf[count] = '\0';
+	*ppos += count;
+
+	while ((token = strsep(&kbuf, " ")) != NULL) {
+		rc = kstrtouint(token, 0, &val);
+		if (rc < 0) {
+			rc = -EINVAL;
+			goto err;
+		}
+
+		effect->pattern[i++] = val & 0xff;
+
+		if (i >= effect->pattern_length)
+			break;
+	}
+
+	for (j = i; j < effect->pattern_length; j++)
+		effect->pattern[j] = 0;
+
+	rc = count;
+err:
+	kfree(kbuf);
+	return rc;
+}
+
+static const struct file_operations pattern_dbgfs_ops = {
+	.read = pattern_dbgfs_read,
+	.write = pattern_dbgfs_write,
+	.owner = THIS_MODULE,
+	.open = simple_open,
+};
+
+static int create_effect_debug_files(struct qti_hap_effect *effect,
+				struct dentry *dir)
+{
+	struct dentry *file;
+
+	file = debugfs_create_file("play_rate_us", 0644, dir,
+			effect, &play_rate_debugfs_ops);
+	if (!file) {
+		pr_err("create play-rate debugfs node failed\n");
+		return -ENOMEM;
+	}
+
+	file = debugfs_create_file("vmax_mv", 0644, dir,
+			effect, &vmax_debugfs_ops);
+	if (!file) {
+		pr_err("create vmax debugfs node failed\n");
+		return -ENOMEM;
+	}
+
+	file = debugfs_create_file("wf_repeat_n", 0644, dir,
+			effect, &wf_repeat_n_debugfs_ops);
+	if (!file) {
+		pr_err("create wf-repeat debugfs node failed\n");
+		return -ENOMEM;
+	}
+
+	file = debugfs_create_file("wf_s_repeat_n", 0644, dir,
+			effect, &wf_s_repeat_n_debugfs_ops);
+	if (!file) {
+		pr_err("create wf-s-repeat debugfs node failed\n");
+		return -ENOMEM;
+	}
+
+	file = debugfs_create_file("lra_auto_res_en", 0644, dir,
+			effect, &auto_res_debugfs_ops);
+	if (!file) {
+		pr_err("create lra-auto-res-en debugfs node failed\n");
+		return -ENOMEM;
+	}
+
+	file = debugfs_create_file("brake", 0644, dir,
+			effect, &brake_pattern_dbgfs_ops);
+	if (!file) {
+		pr_err("create brake debugfs node failed\n");
+		return -ENOMEM;
+	}
+
+	file = debugfs_create_file("pattern", 0644, dir,
+			effect, &pattern_dbgfs_ops);
+	if (!file) {
+		pr_err("create pattern debugfs node failed\n");
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
+static int qti_haptics_add_debugfs(struct qti_hap_chip *chip)
+{
+	struct dentry *hap_dir, *effect_dir;
+	char str[12] = {0};
+	int i, rc = 0;
+
+	hap_dir = debugfs_create_dir("haptics", NULL);
+	if (!hap_dir) {
+		pr_err("create haptics debugfs directory failed\n");
+		return -ENOMEM;
+	}
+
+	for (i = 0; i < chip->effects_count; i++) {
+		snprintf(str, ARRAY_SIZE(str), "effect%d", i);
+		effect_dir = debugfs_create_dir(str, hap_dir);
+		if (!effect_dir) {
+			pr_err("create %s debugfs directory failed\n", str);
+			rc = -ENOMEM;
+			goto cleanup;
+		}
+
+		rc = create_effect_debug_files(&chip->predefined[i],
+				effect_dir);
+		if (rc < 0) {
+			rc = -ENOMEM;
+			goto cleanup;
+		}
+	}
+
+	chip->hap_debugfs = hap_dir;
+	return 0;
+
+cleanup:
+	debugfs_remove_recursive(hap_dir);
+	return rc;
+}
+#endif
+
 static int qti_haptics_probe(struct platform_device *pdev)
 {
 	struct qti_hap_chip *chip;
@@ -1449,7 +1900,9 @@
 
 	hrtimer_init(&chip->stop_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
 	chip->stop_timer.function = qti_hap_stop_timer;
-
+	hrtimer_init(&chip->hap_disable_timer, CLOCK_MONOTONIC,
+						HRTIMER_MODE_REL);
+	chip->hap_disable_timer.function = qti_hap_disable_timer;
 	input_dev->name = "qti-haptics";
 	input_set_drvdata(input_dev, chip);
 	chip->input_dev = input_dev;
@@ -1486,6 +1939,11 @@
 	}
 
 	dev_set_drvdata(chip->dev, chip);
+#ifdef CONFIG_DEBUG_FS
+	rc = qti_haptics_add_debugfs(chip);
+	if (rc < 0)
+		dev_dbg(chip->dev, "create debugfs failed, rc=%d\n", rc);
+#endif
 	return 0;
 
 destroy_ff:
@@ -1497,12 +1955,35 @@
 {
 	struct qti_hap_chip *chip = dev_get_drvdata(&pdev->dev);
 
+#ifdef CONFIG_DEBUG_FS
+	debugfs_remove_recursive(chip->hap_debugfs);
+#endif
 	input_ff_destroy(chip->input_dev);
 	dev_set_drvdata(chip->dev, NULL);
 
 	return 0;
 }
 
+static void qti_haptics_shutdown(struct platform_device *pdev)
+{
+	struct qti_hap_chip *chip = dev_get_drvdata(&pdev->dev);
+	int rc;
+
+	dev_dbg(chip->dev, "Shutdown!\n");
+
+	qti_haptics_module_en(chip, false);
+
+	if (chip->vdd_supply && chip->vdd_enabled) {
+		rc = regulator_disable(chip->vdd_supply);
+		if (rc < 0) {
+			dev_err(chip->dev, "Disable VDD supply failed, rc=%d\n",
+					rc);
+			return;
+		}
+		chip->vdd_enabled = false;
+	}
+}
+
 static const struct of_device_id haptics_match_table[] = {
 	{ .compatible = "qcom,haptics" },
 	{ .compatible = "qcom,pm660-haptics" },
@@ -1513,10 +1994,12 @@
 static struct platform_driver qti_haptics_driver = {
 	.driver		= {
 		.name = "qcom,haptics",
+		.owner = THIS_MODULE,
 		.of_match_table = haptics_match_table,
 	},
 	.probe		= qti_haptics_probe,
 	.remove		= qti_haptics_remove,
+	.shutdown	= qti_haptics_shutdown,
 };
 module_platform_driver(qti_haptics_driver);
 
diff --git a/drivers/input/misc/vl53l0x/src/vl53l0x_i2c_platform.c b/drivers/input/misc/vl53l0x/src/vl53l0x_i2c_platform.c
index edc4b5c..f8633a0 100644
--- a/drivers/input/misc/vl53l0x/src/vl53l0x_i2c_platform.c
+++ b/drivers/input/misc/vl53l0x/src/vl53l0x_i2c_platform.c
@@ -178,7 +178,7 @@
 			int32_t count)
 {
 	int32_t status = STATUS_OK;
-	uint8_t *buffer;
+	uint8_t buffer[64];
 
 #ifdef VL_LOG_ENABLE
 	int32_t      i = 0;
@@ -189,7 +189,6 @@
 	if ((count + 1) > VL_MAX_I2C_XFER_SIZE)
 		return STATUS_FAIL;
 
-	buffer =  VL_GetLocalBuffer(dev, 1);
 	buffer[0] = index;
 	status = VL_I2CWrite(dev, (uint8_t *)buffer, (uint8_t)1);
 	if (!status) {
diff --git a/drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_fw_update.c
index 344f4c3..0ba4faa 100644
--- a/drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_fw_update.c
+++ b/drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_fw_update.c
@@ -44,10 +44,9 @@
 #include "synaptics_dsx_core.h"
 
 #define FW_IMAGE_NAME "synaptics/startup_fw_update.img"
-/*
+
 #define DO_STARTUP_FW_UPDATE
-*/
-/*
+
 #ifdef DO_STARTUP_FW_UPDATE
 #ifdef CONFIG_FB
 #define WAIT_FOR_FB_READY
@@ -55,7 +54,7 @@
 #define FB_READY_TIMEOUT_S 30
 #endif
 #endif
-*/
+
 #define FORCE_UPDATE false
 #define DO_LOCKDOWN false
 
@@ -3419,6 +3418,7 @@
 	enum flash_area flash_area;
 	const struct firmware *fw_entry = NULL;
 	struct synaptics_rmi4_data *rmi4_data = fwu->rmi4_data;
+	const unsigned char *image_name;
 
 	if (rmi4_data->sensor_sleep) {
 		dev_err(rmi4_data->pdev->dev.parent,
@@ -3434,9 +3434,14 @@
 	pr_notice("%s: Start of reflash process\n", __func__);
 
 	if (fwu->image == NULL) {
+		if (rmi4_data->hw_if->board_data->fw_name)
+			image_name = rmi4_data->hw_if->board_data->fw_name;
+		else
+			image_name = FW_IMAGE_NAME;
+
 		retval = secure_memcpy(fwu->image_name, MAX_IMAGE_NAME_LEN,
-				FW_IMAGE_NAME, sizeof(FW_IMAGE_NAME),
-				sizeof(FW_IMAGE_NAME));
+				image_name, strlen(image_name),
+				strlen(image_name));
 		if (retval < 0) {
 			dev_err(rmi4_data->pdev->dev.parent,
 					"%s: Failed to copy image file name\n",
diff --git a/drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_i2c.c b/drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_i2c.c
index e078853..3533f44 100644
--- a/drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_i2c.c
+++ b/drivers/input/touchscreen/synaptics_dsx_2.6/synaptics_dsx_i2c.c
@@ -210,6 +210,12 @@
 		bdata->ub_i2c_addr = -1;
 	}
 
+	retval = of_property_read_string(np, "synaptics,fw-name", &name);
+	if (retval < 0)
+		bdata->fw_name = NULL;
+	else
+		bdata->fw_name = name;
+
 	prop = of_find_property(np, "synaptics,cap-button-codes", NULL);
 	if (prop && prop->length) {
 		bdata->cap_button_map->map = devm_kzalloc(dev,
diff --git a/drivers/leds/leds-qpnp-wled.c b/drivers/leds/leds-qpnp-wled.c
index d272ca6..18a1163 100644
--- a/drivers/leds/leds-qpnp-wled.c
+++ b/drivers/leds/leds-qpnp-wled.c
@@ -2090,22 +2090,26 @@
 		return rc;
 
 	/* Configure the HYBRID THRESHOLD register */
-	if (wled->hyb_thres < QPNP_WLED_HYB_THRES_MIN)
-		wled->hyb_thres = QPNP_WLED_HYB_THRES_MIN;
-	else if (wled->hyb_thres > QPNP_WLED_HYB_THRES_MAX)
-		wled->hyb_thres = QPNP_WLED_HYB_THRES_MAX;
+	if (wled->dim_mode == QPNP_WLED_DIM_HYBRID) {
+		if (wled->hyb_thres < QPNP_WLED_HYB_THRES_MIN)
+			wled->hyb_thres = QPNP_WLED_HYB_THRES_MIN;
+		else if (wled->hyb_thres > QPNP_WLED_HYB_THRES_MAX)
+			wled->hyb_thres = QPNP_WLED_HYB_THRES_MAX;
 
-	rc = qpnp_wled_read_reg(wled, QPNP_WLED_HYB_THRES_REG(wled->sink_base),
-			&reg);
-	if (rc < 0)
-		return rc;
-	reg &= QPNP_WLED_HYB_THRES_MASK;
-	temp = fls(wled->hyb_thres / QPNP_WLED_HYB_THRES_MIN) - 1;
-	reg |= temp;
-	rc = qpnp_wled_write_reg(wled, QPNP_WLED_HYB_THRES_REG(wled->sink_base),
-			reg);
-	if (rc)
-		return rc;
+		rc = qpnp_wled_read_reg(wled,
+				QPNP_WLED_HYB_THRES_REG(wled->sink_base),
+				&reg);
+		if (rc < 0)
+			return rc;
+		reg &= QPNP_WLED_HYB_THRES_MASK;
+		temp = fls(wled->hyb_thres / QPNP_WLED_HYB_THRES_MIN) - 1;
+		reg |= temp;
+		rc = qpnp_wled_write_reg(wled,
+				QPNP_WLED_HYB_THRES_REG(wled->sink_base),
+				reg);
+		if (rc)
+			return rc;
+	}
 
 	/* Configure TEST5 register */
 	if (wled->dim_mode == QPNP_WLED_DIM_DIGITAL) {
@@ -2642,9 +2646,10 @@
 	else
 		wled->max_strings = QPNP_WLED_MAX_STRINGS;
 
+	temp_val = 0;
 	prop = of_find_property(pdev->dev.of_node,
 			"qcom,led-strings-list", &temp_val);
-	if (!prop || !temp_val || temp_val > QPNP_WLED_MAX_STRINGS) {
+	if (!prop || temp_val > QPNP_WLED_MAX_STRINGS) {
 		dev_err(&pdev->dev, "Invalid strings info, use default");
 		wled->num_strings = wled->max_strings;
 		for (i = 0; i < wled->num_strings; i++)
diff --git a/drivers/leds/leds-qti-tri-led.c b/drivers/leds/leds-qti-tri-led.c
index c303893..c494655 100644
--- a/drivers/leds/leds-qti-tri-led.c
+++ b/drivers/leds/leds-qti-tri-led.c
@@ -43,14 +43,14 @@
 #define PWM_PERIOD_DEFAULT_NS		1000000
 
 struct pwm_setting {
-	u32	pre_period_ns;
-	u32	period_ns;
-	u32	duty_ns;
+	u64	pre_period_ns;
+	u64	period_ns;
+	u64	duty_ns;
 };
 
 struct led_setting {
-	u32			on_ms;
-	u32			off_ms;
+	u64			on_ms;
+	u64			off_ms;
 	enum led_brightness	brightness;
 	bool			blink;
 	bool			breath;
@@ -164,24 +164,16 @@
 
 static int qpnp_tri_led_set(struct qpnp_led_dev *led)
 {
-	u32 on_ms, off_ms, period_ns, duty_ns;
+	u64 on_ms, off_ms, period_ns, duty_ns;
 	enum led_brightness brightness = led->led_setting.brightness;
 	int rc = 0;
 
 	if (led->led_setting.blink) {
 		on_ms = led->led_setting.on_ms;
 		off_ms = led->led_setting.off_ms;
-		if (on_ms > INT_MAX / NSEC_PER_MSEC)
-			duty_ns = INT_MAX - 1;
-		else
-			duty_ns = on_ms * NSEC_PER_MSEC;
 
-		if (on_ms + off_ms > INT_MAX / NSEC_PER_MSEC) {
-			period_ns = INT_MAX;
-			duty_ns = (period_ns / (on_ms + off_ms)) * on_ms;
-		} else {
-			period_ns = (on_ms + off_ms) * NSEC_PER_MSEC;
-		}
+		duty_ns = on_ms * NSEC_PER_MSEC;
+		period_ns = (on_ms + off_ms) * NSEC_PER_MSEC;
 
 		if (period_ns < duty_ns && duty_ns != 0)
 			period_ns = duty_ns + 1;
@@ -191,15 +183,14 @@
 
 		if (brightness == LED_OFF)
 			duty_ns = 0;
-		else if (period_ns > INT_MAX / brightness)
-			duty_ns = (period_ns / LED_FULL) * brightness;
-		else
-			duty_ns = (period_ns * brightness) / LED_FULL;
+
+		duty_ns = period_ns * brightness;
+		do_div(duty_ns, LED_FULL);
 
 		if (period_ns < duty_ns && duty_ns != 0)
 			period_ns = duty_ns + 1;
 	}
-	dev_dbg(led->chip->dev, "PWM settings for %s led: period = %dns, duty = %dns\n",
+	dev_dbg(led->chip->dev, "PWM settings for %s led: period = %lluns, duty = %lluns\n",
 				led->cdev.name, period_ns, duty_ns);
 
 	led->pwm_setting.duty_ns = duty_ns;
diff --git a/drivers/mailbox/qcom-rpmh-mailbox.c b/drivers/mailbox/qcom-rpmh-mailbox.c
index 57329f7..16afda7 100644
--- a/drivers/mailbox/qcom-rpmh-mailbox.c
+++ b/drivers/mailbox/qcom-rpmh-mailbox.c
@@ -490,6 +490,7 @@
 		} else {
 			/* Clear the enable bit for the commands */
 			write_tcs_reg(base, RSC_DRV_CMD_ENABLE, m, 0, 0);
+			write_tcs_reg(base, RSC_DRV_CMD_WAIT_FOR_CMPL, m, 0, 0);
 		}
 
 no_resp:
@@ -808,6 +809,7 @@
 static void __tcs_buffer_invalidate(void __iomem *base, int m)
 {
 	write_tcs_reg(base, RSC_DRV_CMD_ENABLE, m, 0, 0);
+	write_tcs_reg(base, RSC_DRV_CMD_WAIT_FOR_CMPL, m, 0, 0);
 }
 
 static int tcs_mbox_invalidate(struct mbox_chan *chan)
diff --git a/drivers/media/platform/msm/Kconfig b/drivers/media/platform/msm/Kconfig
index 9e4ea8d..39781a0 100644
--- a/drivers/media/platform/msm/Kconfig
+++ b/drivers/media/platform/msm/Kconfig
@@ -32,6 +32,7 @@
 menuconfig MSMB_CAMERA
     bool "QTI MSM camera and video capture 2.0 support"
     depends on ARCH_QCOM && VIDEO_V4L2 && I2C
+    select ADSP_SHMEM
     ---help---
       Say Y here to enable selecting the video adapters for
       QTI msm camera and video capture 2.0, enabling this
@@ -44,6 +45,8 @@
     ---help---
       Enable printk() debug for msm camera 2.0
 
+
+
 if MSMB_CAMERA
 source "drivers/media/platform/msm/camera_v2/Kconfig"
 endif # MSMB_CAMERA
@@ -53,4 +56,4 @@
 source "drivers/media/platform/msm/sde/Kconfig"
 source "drivers/media/platform/msm/dvb/Kconfig"
 source "drivers/media/platform/msm/broadcast/Kconfig"
-
+source "drivers/media/platform/msm/adsp_shmem/Kconfig"
diff --git a/drivers/media/platform/msm/Makefile b/drivers/media/platform/msm/Makefile
index e19da45..cba291c 100644
--- a/drivers/media/platform/msm/Makefile
+++ b/drivers/media/platform/msm/Makefile
@@ -2,6 +2,7 @@
 # Makefile for the qti specific video device drivers
 # based on V4L2.
 #
+obj-y += adsp_shmem/
 obj-$(CONFIG_MSM_VIDC_V4L2) += vidc/
 obj-$(CONFIG_MSM_VIDC_3X_V4L2) += vidc_3x/
 obj-y += sde/
diff --git a/drivers/media/platform/msm/adsp_shmem/Kconfig b/drivers/media/platform/msm/adsp_shmem/Kconfig
new file mode 100644
index 0000000..8b1cfc6
--- /dev/null
+++ b/drivers/media/platform/msm/adsp_shmem/Kconfig
@@ -0,0 +1,4 @@
+menuconfig ADSP_SHMEM
+	bool "ADSP shared memory device driver"
+	---help---
+	ADSP shared memory device driver for ADSP fast boot camera
diff --git a/drivers/media/platform/msm/adsp_shmem/Makefile b/drivers/media/platform/msm/adsp_shmem/Makefile
new file mode 100644
index 0000000..3e9f36f
--- /dev/null
+++ b/drivers/media/platform/msm/adsp_shmem/Makefile
@@ -0,0 +1 @@
+obj-$(CONFIG_ADSP_SHMEM) += adsp-shmem-device.o
diff --git a/drivers/media/platform/msm/adsp_shmem/adsp-shmem-device.c b/drivers/media/platform/msm/adsp_shmem/adsp-shmem-device.c
new file mode 100644
index 0000000..c04eff4
--- /dev/null
+++ b/drivers/media/platform/msm/adsp_shmem/adsp-shmem-device.c
@@ -0,0 +1,263 @@
+/* Copyright (c) 2018 The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/of_address.h>
+#include <linux/dma-mapping.h>
+#include <linux/vmalloc.h>
+#include <linux/memblock.h>
+#include <linux/slab.h>
+#include <linux/fs.h>
+#include <linux/cdev.h>
+#include <linux/debugfs.h>
+#include <linux/uaccess.h>
+#include <asm/pgtable.h>
+#include <media/adsp-shmem-device.h>
+
+#define DEVICE_NAME "adsp_shmem"
+#define CLASS_NAME "adsp_class"
+
+static dev_t adsp_dev;
+static struct cdev *adsp_cdev;
+static struct class *adsp_class;
+static struct device *adsp_device;
+
+static void *adsp_shmem_vaddr;
+static phys_addr_t adsp_shmem_paddr;
+static unsigned long adsp_shmem_size;
+
+int adsp_shmem_get_state(void)
+{
+	int status;
+
+	if (adsp_shmem_vaddr) {
+		struct adsp_camera_header *adsp_header_ptr = adsp_shmem_vaddr;
+
+		status = adsp_header_ptr->status;
+		if (status >= CAMERA_STATUS_STOP && status <= CAMERA_STATUS_END)
+			return status;
+	}
+
+	return CAMERA_STATUS_END;
+}
+
+void adsp_shmem_set_state(enum camera_status_state state)
+{
+	if (adsp_shmem_vaddr) {
+		struct adsp_camera_header *adsp_header_ptr = adsp_shmem_vaddr;
+
+		adsp_header_ptr->status = state;
+	}
+}
+
+const char *adsp_shmem_get_sensor_name(void)
+{
+	if (adsp_shmem_vaddr) {
+		struct adsp_camera_header *adsp_header_ptr = adsp_shmem_vaddr;
+
+		return adsp_header_ptr->sensor_name;
+	} else {
+		return NULL;
+	}
+}
+
+int adsp_shmem_is_initialized(void)
+{
+	return (adsp_shmem_vaddr) ? 1 : 0;
+}
+
+int adsp_shmem_is_working(void)
+{
+	int status = adsp_shmem_get_state();
+
+	if (status == CAMERA_STATUS_STOP || status == CAMERA_STATUS_END)
+		return false;
+
+	return true;
+}
+
+static ssize_t adsp_shmem_device_mem_read(struct device *dev,
+					  struct device_attribute *attr,
+					  char *buf)
+{
+	return scnprintf(buf, PAGE_SIZE, "%lu", adsp_shmem_size);
+}
+
+static DEVICE_ATTR(mem, 0444, adsp_shmem_device_mem_read, NULL);
+
+static int op_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+	unsigned long pfn;
+	unsigned long req_map_size = vma->vm_end - vma->vm_start;
+
+	pfn = __phys_to_pfn(adsp_shmem_paddr);
+	vma->vm_flags |= VM_IO;
+
+	if (io_remap_pfn_range(vma, vma->vm_start, pfn, req_map_size,
+			       vma->vm_page_prot)) {
+		pr_err("%s: Error io_remap_pfn_range\n", __func__);
+		return -EAGAIN;
+	}
+
+	return 0;
+}
+
+static int mmapfop_close(struct inode *inode, struct file *filp)
+{
+	return 0;
+}
+
+static int mmapfop_open(struct inode *inode, struct file *filp)
+{
+	return 0;
+}
+static const struct file_operations mmap_fops = {
+	.open = mmapfop_open,
+	.release = mmapfop_close,
+	.mmap = op_mmap,
+};
+
+static int adsp_shmem_device_probe(struct platform_device *pdev)
+{
+	int ret = 0;
+	struct device_node *node = pdev->dev.of_node;
+	struct device_node *pnode;
+	struct vm_struct *area;
+	unsigned int flags;
+	unsigned long vaddr;
+	const __be32 *basep;
+	u64 size;
+	phys_addr_t base;
+
+	ret = alloc_chrdev_region(&adsp_dev, 0, 1, DEVICE_NAME);
+	if (ret != 0)
+		return ret;
+
+	adsp_cdev = cdev_alloc();
+	if (!adsp_cdev)
+		return -ENOMEM;
+
+	cdev_init(adsp_cdev, &mmap_fops);
+
+	ret = cdev_add(adsp_cdev, adsp_dev, 1);
+	if (ret < 0)
+		goto cdev_add_error;
+
+	adsp_class = class_create(THIS_MODULE, CLASS_NAME);
+	if (IS_ERR(adsp_class)) {
+		ret = PTR_ERR(adsp_class);
+		goto class_error;
+	}
+
+	adsp_device = device_create(adsp_class, NULL, adsp_dev, NULL,
+				    DEVICE_NAME);
+	if (IS_ERR(adsp_device)) {
+		ret = PTR_ERR(adsp_device);
+		goto device_err;
+	}
+
+	pnode = of_parse_phandle(node, "memory-region", 0);
+	if (pnode) {
+		basep = of_get_address(pnode, 0, &size, &flags);
+		if (basep) {
+			base = of_translate_address(pnode, basep);
+			dev_dbg(&pdev->dev, "%s:base: 0x%x siz:%lu flgs:0x%x\n",
+				__func__, (unsigned int)base,
+				(unsigned long)size, flags);
+
+			area = get_vm_area(size, VM_IOREMAP);
+			if (!area) {
+				ret = -ENOMEM;
+				goto vm_area_error;
+			}
+
+			vaddr = (unsigned long)area->addr;
+			if (ioremap_page_range(vaddr, (vaddr + size),
+					       base, PAGE_KERNEL)) {
+				ret = -ENOMEM;
+				goto ioremap_error;
+			}
+
+			device_create_file(&pdev->dev, &dev_attr_mem);
+
+			adsp_shmem_vaddr = area->addr;
+			adsp_shmem_paddr = base;
+			adsp_shmem_size = size;
+
+			of_node_put(pnode);
+		}
+	}
+
+	return ret;
+
+ioremap_error:
+	vunmap(area->addr);
+vm_area_error:
+	of_node_put(pnode);
+	device_destroy(adsp_class, adsp_dev);
+device_err:
+	class_destroy(adsp_class);
+class_error:
+	cdev_del(adsp_cdev);
+cdev_add_error:
+	kfree(adsp_cdev);
+	return ret;
+}
+
+static int adsp_shmem_device_remove(struct platform_device *pdev)
+{
+	vunmap(adsp_shmem_vaddr);
+	device_destroy(adsp_class, adsp_dev);
+	class_destroy(adsp_class);
+	cdev_del(adsp_cdev);
+
+	device_remove_file(&pdev->dev, &dev_attr_mem);
+	return 0;
+}
+
+static const struct of_device_id adsp_shmem_device_dt_match[] = {
+	{.compatible = "adsp-shmem-device"},
+	{},
+};
+
+static struct platform_driver adsp_shmem_device_driver = {
+	.probe  = adsp_shmem_device_probe,
+	.remove = adsp_shmem_device_remove,
+	.driver = {
+		.name = "adsp-shmem-device",
+		.owner = THIS_MODULE,
+		.of_match_table = adsp_shmem_device_dt_match,
+	},
+};
+
+static int __init adsp_shmem_device_init(void)
+{
+	return platform_driver_register(&adsp_shmem_device_driver);
+}
+
+static void __exit adsp_shmem_device_exit(void)
+{
+	platform_driver_unregister(&adsp_shmem_device_driver);
+}
+
+subsys_initcall(adsp_shmem_device_init);
+module_exit(adsp_shmem_device_exit);
+
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("ADSP Shared Memory Device driver");
diff --git a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c
index cddbd83..f2796be 100644
--- a/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c
+++ b/drivers/media/platform/msm/camera/cam_cdm/cam_cdm_hw_core.c
@@ -422,7 +422,7 @@
 	}
 
 	for (i = 0; i < req->data->cmd_arrary_count ; i++) {
-		uint64_t hw_vaddr_ptr = 0;
+		dma_addr_t hw_vaddr_ptr = 0;
 		size_t len = 0;
 
 		if ((!cdm_cmd->cmd[i].len) &&
@@ -470,7 +470,7 @@
 			}
 			rc = 0;
 			hw_vaddr_ptr =
-				(uint64_t)cdm_cmd->cmd[i].bl_addr.hw_iova;
+				(dma_addr_t) cdm_cmd->cmd[i].bl_addr.hw_iova;
 			len = cdm_cmd->cmd[i].len + cdm_cmd->cmd[i].offset;
 		} else {
 			CAM_ERR(CAM_CDM,
diff --git a/drivers/media/platform/msm/camera/cam_core/cam_context.c b/drivers/media/platform/msm/camera/cam_core/cam_context.c
index 670349d..da78527 100644
--- a/drivers/media/platform/msm/camera/cam_core/cam_context.c
+++ b/drivers/media/platform/msm/camera/cam_core/cam_context.c
@@ -161,7 +161,6 @@
 		return -EINVAL;
 	}
 
-	mutex_lock(&ctx->ctx_mutex);
 	if (ctx->state_machine[ctx->state].crm_ops.apply_req) {
 		rc = ctx->state_machine[ctx->state].crm_ops.apply_req(ctx,
 			apply);
@@ -170,7 +169,6 @@
 			ctx->dev_hdl, ctx->state);
 		rc = -EPROTO;
 	}
-	mutex_unlock(&ctx->ctx_mutex);
 
 	return rc;
 }
diff --git a/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c b/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c
index 89aad8c..6c2383e 100644
--- a/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c
+++ b/drivers/media/platform/msm/camera/cam_core/cam_context_utils.c
@@ -275,7 +275,7 @@
 	uint64_t packet_addr;
 	struct cam_packet *packet;
 	size_t len = 0;
-	int32_t i = 0;
+	int32_t i = 0, j = 0;
 
 	if (!ctx || !cmd) {
 		CAM_ERR(CAM_CTXT, "Invalid input params %pK %pK", ctx, cmd);
@@ -355,6 +355,15 @@
 	req->status = 1;
 	req->req_priv = cfg.priv;
 
+	for (i = 0; i < req->num_out_map_entries; i++) {
+		rc = cam_sync_get_obj_ref(req->out_map_entries[i].sync_id);
+		if (rc) {
+			CAM_ERR(CAM_CTXT, "Can't get ref for sync %d",
+				req->out_map_entries[i].sync_id);
+			goto put_ref;
+		}
+	}
+
 	if (req->num_in_map_entries > 0) {
 		spin_lock(&ctx->lock);
 		list_add_tail(&req->list, &ctx->pending_req_list);
@@ -365,17 +374,17 @@
 				"[%s][%d] : Moving req[%llu] from free_list to pending_list",
 				ctx->dev_name, ctx->ctx_id, req->request_id);
 
-		for (i = 0; i < req->num_in_map_entries; i++) {
+		for (j = 0; j < req->num_in_map_entries; j++) {
 			cam_context_getref(ctx);
 			rc = cam_sync_register_callback(
 					cam_context_sync_callback,
 					(void *)req,
-					req->in_map_entries[i].sync_id);
+					req->in_map_entries[j].sync_id);
 			if (rc) {
 				CAM_ERR(CAM_CTXT,
 					"[%s][%d] Failed register fence cb: %d ret = %d",
 					ctx->dev_name, ctx->ctx_id,
-					req->in_map_entries[i].sync_id, rc);
+					req->in_map_entries[j].sync_id, rc);
 				spin_lock(&ctx->lock);
 				list_del_init(&req->list);
 				spin_unlock(&ctx->lock);
@@ -388,16 +397,23 @@
 
 				cam_context_putref(ctx);
 
-				goto free_req;
+				goto put_ref;
 			}
 			CAM_DBG(CAM_CTXT, "register in fence cb: %d ret = %d",
-				req->in_map_entries[i].sync_id, rc);
+				req->in_map_entries[j].sync_id, rc);
 		}
 		goto end;
 	}
 
 	return rc;
 
+put_ref:
+	for (--i; i >= 0; i--) {
+		rc = cam_sync_put_obj_ref(req->out_map_entries[i].sync_id);
+		if (rc)
+			CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d",
+				req->out_map_entries[i].sync_id);
+	}
 free_req:
 	spin_lock(&ctx->lock);
 	list_add_tail(&req->list, &ctx->free_req_list);
diff --git a/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c b/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c
index 2120650..053447e 100644
--- a/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c
+++ b/drivers/media/platform/msm/camera/cam_cpas/cam_cpas_hw.c
@@ -581,15 +581,16 @@
 				required_camnoc_bw);
 		}
 
-		required_camnoc_bw += (required_camnoc_bw *
-			soc_private->camnoc_axi_clk_bw_margin) / 100;
+		required_camnoc_bw += div64_u64((required_camnoc_bw *
+			soc_private->camnoc_axi_clk_bw_margin), 100);
 
 		if ((required_camnoc_bw > 0) &&
 			(required_camnoc_bw <
 			soc_private->camnoc_axi_min_ib_bw))
 			required_camnoc_bw = soc_private->camnoc_axi_min_ib_bw;
 
-		clk_rate = required_camnoc_bw / soc_private->camnoc_bus_width;
+		clk_rate = div64_u64(required_camnoc_bw,
+			soc_private->camnoc_bus_width);
 
 		CAM_DBG(CAM_CPAS, "Setting camnoc axi clk rate : %llu %d",
 			required_camnoc_bw, clk_rate);
diff --git a/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c b/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
index d3c39f9..09388fe 100644
--- a/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_fd/fd_hw_mgr/cam_fd_hw_mgr.c
@@ -536,7 +536,7 @@
 	int rc = -EINVAL;
 	uint32_t i, j, plane, num_out_buf, num_in_buf;
 	struct cam_buf_io_cfg *io_cfg;
-	uint64_t io_addr[CAM_PACKET_MAX_PLANES];
+	dma_addr_t io_addr[CAM_PACKET_MAX_PLANES];
 	uint64_t cpu_addr[CAM_PACKET_MAX_PLANES];
 	size_t size;
 	bool need_io_map, need_cpu_map;
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/a5_hw/a5_core.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/a5_hw/a5_core.c
index 4b5f22e..8f2c769 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/a5_hw/a5_core.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/a5_hw/a5_core.c
@@ -354,9 +354,11 @@
 		CAM_ERR_RATE_LIMIT(CAM_ICP, "watch dog interrupt from A5");
 	}
 
+	spin_lock(&a5_dev->hw_lock);
 	if (core_info->irq_cb.icp_hw_mgr_cb)
 		core_info->irq_cb.icp_hw_mgr_cb(irq_status,
 					core_info->irq_cb.data);
+	spin_unlock(&a5_dev->hw_lock);
 
 	return IRQ_HANDLED;
 }
@@ -369,6 +371,7 @@
 	struct cam_a5_device_core_info *core_info = NULL;
 	struct cam_a5_device_hw_info *hw_info = NULL;
 	struct a5_soc_info *a5_soc = NULL;
+	unsigned long flags;
 	int rc = 0;
 
 	if (!device_priv) {
@@ -414,8 +417,10 @@
 			return -EINVAL;
 		}
 
+		spin_lock_irqsave(&a5_dev->hw_lock, flags);
 		core_info->irq_cb.icp_hw_mgr_cb = irq_cb->icp_hw_mgr_cb;
 		core_info->irq_cb.data = irq_cb->data;
+		spin_unlock_irqrestore(&a5_dev->hw_lock, flags);
 		break;
 	}
 
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
index 1733017..1d5e483 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.c
@@ -50,6 +50,7 @@
 #include "cam_soc_util.h"
 #include "cam_trace.h"
 #include "cam_cpas_api.h"
+#include "cam_common_util.h"
 
 #define ICP_WORKQ_TASK_CMD_TYPE 1
 #define ICP_WORKQ_TASK_MSG_TYPE 2
@@ -599,7 +600,7 @@
 	uint64_t base_clk;
 	uint64_t mul = 1000000000;
 
-	base_clk = (frame_cycles * mul) / budget;
+	base_clk = div64_u64((frame_cycles * mul), budget);
 
 	CAM_DBG(CAM_ICP, "budget = %lld fc = %d ib = %lld base_clk = %lld",
 		budget, frame_cycles,
@@ -2001,6 +2002,11 @@
 	struct crm_workq_task *task;
 	struct hfi_msg_work_data *task_data;
 
+	if (!data) {
+		CAM_ERR(CAM_ICP, "irq cb data is NULL");
+		return rc;
+	}
+
 	spin_lock_irqsave(&hw_mgr->hw_mgr_lock, flags);
 	task = cam_req_mgr_workq_get_task(icp_hw_mgr.msg_work);
 	if (!task) {
@@ -3099,7 +3105,7 @@
 	task_data->type = ICP_WORKQ_TASK_MSG_TYPE;
 	task->process_cb = cam_icp_mgr_process_cmd;
 	size_in_words = (*(uint32_t *)task_data->data) >> 2;
-	CAM_INFO(CAM_ICP, "size_in_words %u", size_in_words);
+	CAM_DBG(CAM_ICP, "size_in_words %u", size_in_words);
 	rc = cam_req_mgr_workq_enqueue_task(task, &icp_hw_mgr,
 		CRM_TASK_PRIORITY_0);
 	if (rc)
@@ -3175,8 +3181,8 @@
 	frame_info = (struct icp_frame_info *)config_args->priv;
 	req_id = frame_info->request_id;
 	idx = cam_icp_clk_idx_from_req_id(ctx_data, req_id);
-	ctx_data->hfi_frame_process.fw_process_flag[idx] = true;
 	cam_icp_mgr_ipe_bps_clk_update(hw_mgr, ctx_data, idx);
+	ctx_data->hfi_frame_process.fw_process_flag[idx] = true;
 
 	CAM_DBG(CAM_ICP, "req_id %llu, io config %llu", req_id,
 		frame_info->io_config);
@@ -3268,7 +3274,7 @@
 {
 	int rc = 0;
 	int i, j, k;
-	uint64_t addr;
+	dma_addr_t addr;
 	size_t len;
 	struct cam_cmd_buf_desc *cmd_desc = NULL;
 	uint64_t cpu_addr = 0;
@@ -3388,6 +3394,11 @@
 			io_cfg_ptr[i].resource_type);
 	}
 
+	if (prepare_args->num_in_map_entries > 1)
+		prepare_args->num_in_map_entries =
+			cam_common_util_remove_duplicate_arr(
+			sync_in_obj, prepare_args->num_in_map_entries);
+
 	if (prepare_args->num_in_map_entries > 1) {
 		rc = cam_sync_merge(&sync_in_obj[0],
 			prepare_args->num_in_map_entries, &merged_sync_in_obj);
@@ -3490,7 +3501,7 @@
 	struct cam_packet *packet,
 	struct cam_icp_hw_ctx_data *ctx_data,
 	int32_t index,
-	uint64_t *io_buf_addr)
+	dma_addr_t *io_buf_addr)
 {
 	int i, rc = 0;
 	struct cam_cmd_buf_desc *cmd_desc = NULL;
@@ -4132,7 +4143,7 @@
 {
 	int rc = 0, bitmap_size = 0;
 	uint32_t ctx_id = 0;
-	uint64_t io_buf_addr;
+	dma_addr_t io_buf_addr;
 	size_t io_buf_size;
 	struct cam_icp_hw_mgr *hw_mgr = hw_mgr_priv;
 	struct cam_icp_hw_ctx_data *ctx_data = NULL;
diff --git a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
index 0b931f3..8c132c5 100644
--- a/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
+++ b/drivers/media/platform/msm/camera/cam_icp/icp_hw/icp_hw_mgr/cam_icp_hw_mgr.h
@@ -135,7 +135,7 @@
   */
 struct icp_frame_info {
 	uint64_t request_id;
-	uint64_t io_config;
+	dma_addr_t io_config;
 	struct hfi_cmd_ipebps_async hfi_cfg_io_cmd;
 };
 
@@ -238,7 +238,7 @@
 struct icp_cmd_generic_blob {
 	struct cam_icp_hw_ctx_data *ctx;
 	uint32_t frame_info_idx;
-	uint64_t *io_buf_addr;
+	dma_addr_t *io_buf_addr;
 };
 
 /**
diff --git a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
index 08ef0e9..5760371 100644
--- a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
+++ b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.c
@@ -25,19 +25,15 @@
 #include "cam_debug_util.h"
 
 static const char isp_dev_name[] = "isp";
-
-#define INC_STATE_MONITOR_HEAD(head) \
-	(atomic64_add_return(1, head) % \
-	CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES)
-
 static void __cam_isp_ctx_update_state_monitor_array(
 	struct cam_isp_context *ctx_isp,
 	enum cam_isp_state_change_trigger trigger_type,
 	uint32_t req_id)
 {
-	int iterator = 0;
+	uint64_t iterator = 0;
 
-	iterator = INC_STATE_MONITOR_HEAD(&ctx_isp->state_monitor_head);
+	div64_u64_rem(atomic64_add_return(1, &ctx_isp->state_monitor_head),
+		CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES, &iterator);
 	ctx_isp->cam_isp_ctx_state_monitor[iterator].curr_state =
 		ctx_isp->substate_activated;
 	ctx_isp->cam_isp_ctx_state_monitor[iterator].trigger =
@@ -96,6 +92,7 @@
 	int i = 0;
 	uint64_t state_head = 0;
 	uint64_t index;
+	struct cam_isp_context_state_monitor *cam_isp_ctx_state_monitor;
 
 	state_head = atomic64_read(&ctx_isp->state_monitor_head);
 	CAM_ERR_RATE_LIMIT(CAM_ISP,
@@ -103,17 +100,20 @@
 
 	for (i = CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES - 1; i >= 0;
 		i--) {
-		index = (((state_head - i) +
-			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES) %
-			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES);
+		div64_u64_rem(((state_head - i) +
+			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES),
+			CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES, &index);
+		cam_isp_ctx_state_monitor =
+			&ctx_isp->cam_isp_ctx_state_monitor[index];
+
 		CAM_ERR_RATE_LIMIT(CAM_ISP,
-		"time[0x%llx] req_id[%u] state[%s] evt_type[%s]",
-		ctx_isp->cam_isp_ctx_state_monitor[index].evt_time_stamp,
-		ctx_isp->cam_isp_ctx_state_monitor[index].req_id,
-		__cam_isp_ctx_substate_val_to_type(
-		ctx_isp->cam_isp_ctx_state_monitor[index].curr_state),
-		__cam_isp_hw_evt_val_to_type(
-		ctx_isp->cam_isp_ctx_state_monitor[index].trigger));
+			"time[0x%llx] req_id[%u] state[%s] evt_type[%s]",
+			cam_isp_ctx_state_monitor->evt_time_stamp,
+			cam_isp_ctx_state_monitor->req_id,
+			__cam_isp_ctx_substate_val_to_type(
+			cam_isp_ctx_state_monitor->curr_state),
+			__cam_isp_hw_evt_val_to_type(
+			cam_isp_ctx_state_monitor->trigger));
 	}
 }
 
@@ -524,11 +524,11 @@
 	struct cam_context      *ctx = ctx_isp->base;
 	struct cam_isp_ctx_req  *req_isp;
 
-	if (list_empty(&ctx->pending_req_list)) {
-		CAM_ERR(CAM_ISP, "Reg upd ack with no pending request");
+	if (list_empty(&ctx->wait_req_list)) {
+		CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request");
 		goto end;
 	}
-	req = list_first_entry(&ctx->pending_req_list,
+	req = list_first_entry(&ctx->wait_req_list,
 			struct cam_ctx_request, list);
 	list_del_init(&req->list);
 
@@ -686,24 +686,16 @@
 	 * This is for the first update. The initial setting will
 	 * cause the reg_upd in the first frame.
 	 */
-	if (!list_empty(&ctx->pending_req_list)) {
-		req = list_first_entry(&ctx->pending_req_list,
+	if (!list_empty(&ctx->wait_req_list)) {
+		req = list_first_entry(&ctx->wait_req_list,
 			struct cam_ctx_request, list);
 		list_del_init(&req->list);
 		req_isp = (struct cam_isp_ctx_req *) req->req_priv;
-		if (req_isp->num_fence_map_out == req_isp->num_acked) {
+		if (req_isp->num_fence_map_out == req_isp->num_acked)
 			list_add_tail(&req->list, &ctx->free_req_list);
-		} else {
-			/* need to handle the buf done */
-			list_add_tail(&req->list, &ctx->active_req_list);
-			ctx_isp->active_req_cnt++;
-			CAM_DBG(CAM_REQ,
-				"move request %lld to active list(cnt = %d)",
-				 req->request_id,
-				ctx_isp->active_req_cnt);
-			ctx_isp->substate_activated =
-				CAM_ISP_CTX_ACTIVATED_EPOCH;
-		}
+		else
+			CAM_ERR(CAM_ISP,
+				"receive rup in unexpected state");
 	}
 	if (req != NULL) {
 		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
@@ -722,12 +714,12 @@
 	struct cam_context        *ctx = ctx_isp->base;
 	uint64_t  request_id = 0;
 
-	if (list_empty(&ctx->pending_req_list)) {
+	if (list_empty(&ctx->wait_req_list)) {
 		/*
-		 * If no pending req in epoch, this is an error case.
+		 * If no wait req in epoch, this is an error case.
 		 * The recovery is to go back to sof state
 		 */
-		CAM_ERR(CAM_ISP, "No pending request");
+		CAM_ERR(CAM_ISP, "No wait request");
 		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
 
 		/* Send SOF event as empty frame*/
@@ -737,7 +729,7 @@
 		goto end;
 	}
 
-	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
 		list);
 	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
 
@@ -746,6 +738,9 @@
 		ctx->ctx_crm_intf->notify_err) {
 		struct cam_req_mgr_error_notify notify;
 
+		list_del_init(&req->list);
+		list_add(&req->list, &ctx->pending_req_list);
+
 		notify.link_hdl = ctx->link_hdl;
 		notify.dev_hdl = ctx->dev_hdl;
 		notify.req_id = req->request_id;
@@ -826,8 +821,10 @@
 
 	req = list_last_entry(&ctx->active_req_list,
 		struct cam_ctx_request, list);
-	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
-		CAM_ISP_STATE_CHANGE_TRIGGER_SOF, ctx->req_list->request_id);
+	if (req)
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_SOF,
+			ctx->req_list->request_id);
 	CAM_DBG(CAM_ISP, "next substate %d",
 		ctx_isp->substate_activated);
 
@@ -869,7 +866,7 @@
 	 * transition to BUBBLE state again.
 	 */
 
-	if (list_empty(&ctx->pending_req_list)) {
+	if (list_empty(&ctx->wait_req_list)) {
 		/*
 		 * If no pending req in epoch, this is an error case.
 		 * Just go back to the bubble state.
@@ -882,14 +879,16 @@
 		goto end;
 	}
 
-	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
+	req = list_first_entry(&ctx->wait_req_list, struct cam_ctx_request,
 		list);
 	req_isp = (struct cam_isp_ctx_req *)req->req_priv;
+	list_del_init(&req->list);
 
 	if (req_isp->bubble_report && ctx->ctx_crm_intf &&
 		ctx->ctx_crm_intf->notify_err) {
 		struct cam_req_mgr_error_notify notify;
 
+		list_add(&req->list, &ctx->pending_req_list);
 		notify.link_hdl = ctx->link_hdl;
 		notify.dev_hdl = ctx->dev_hdl;
 		notify.req_id = req->request_id;
@@ -903,7 +902,6 @@
 		 * If we can not report bubble, then treat it as if no bubble
 		 * report. Just move the req to active list.
 		 */
-		list_del_init(&req->list);
 		list_add_tail(&req->list, &ctx->active_req_list);
 		ctx_isp->active_req_cnt++;
 		CAM_DBG(CAM_ISP, "move request %lld to active list(cnt = %d)",
@@ -929,8 +927,9 @@
 end:
 	req = list_last_entry(&ctx->active_req_list, struct cam_ctx_request,
 		list);
-	__cam_isp_ctx_update_state_monitor_array(ctx_isp,
-		CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, req->request_id);
+	if (req)
+		__cam_isp_ctx_update_state_monitor_array(ctx_isp,
+			CAM_ISP_STATE_CHANGE_TRIGGER_EPOCH, req->request_id);
 	return 0;
 }
 
@@ -1079,30 +1078,6 @@
 	return rc;
 }
 
-static int __cam_isp_ctx_sof_in_flush(
-	struct cam_isp_context *ctx_isp, void *evt_data)
-{
-	int rc = 0;
-	struct cam_isp_hw_sof_event_data      *sof_event_data = evt_data;
-
-	if (!evt_data) {
-		CAM_ERR(CAM_ISP, "in valid sof event data");
-		return -EINVAL;
-	}
-	ctx_isp->frame_id++;
-	ctx_isp->sof_timestamp_val = sof_event_data->timestamp;
-	ctx_isp->boot_timestamp = sof_event_data->boot_time;
-	CAM_DBG(CAM_ISP, "frame id: %lld time stamp:0x%llx",
-		ctx_isp->frame_id, ctx_isp->sof_timestamp_val);
-
-	if (--ctx_isp->frame_skip_count == 0)
-		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_SOF;
-	else
-		CAM_ERR(CAM_ISP, "Skip currect SOF");
-
-	return rc;
-}
-
 static struct cam_isp_ctx_irq_ops
 	cam_isp_ctx_activated_state_machine_irq[CAM_ISP_CTX_ACTIVATED_MAX] = {
 	/* SOF */
@@ -1174,17 +1149,6 @@
 	/* HALT */
 	{
 	},
-	/* FLUSH */
-	{
-		.irq_ops = {
-			NULL,
-			__cam_isp_ctx_sof_in_flush,
-			NULL,
-			NULL,
-			NULL,
-			__cam_isp_ctx_buf_done_in_applied,
-		},
-	},
 };
 
 static int __cam_isp_ctx_apply_req_in_activated_state(
@@ -1193,7 +1157,7 @@
 {
 	int rc = 0;
 	struct cam_ctx_request          *req;
-	struct cam_ctx_request          *active_req;
+	struct cam_ctx_request          *active_req = NULL;
 	struct cam_isp_ctx_req          *req_isp;
 	struct cam_isp_ctx_req          *active_req_isp;
 	struct cam_isp_context          *ctx_isp = NULL;
@@ -1213,8 +1177,10 @@
 	 *
 	 */
 	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
+	spin_lock_bh(&ctx->lock);
 	req = list_first_entry(&ctx->pending_req_list, struct cam_ctx_request,
 		list);
+	spin_unlock_bh(&ctx->lock);
 
 	/*
 	 * Check whehter the request id is matching the tip, if not, this means
@@ -1237,19 +1203,25 @@
 			"Reject apply request (id %lld) due to congestion(cnt = %d)",
 			req->request_id,
 			ctx_isp->active_req_cnt);
-		if (!list_empty(&ctx->active_req_list)) {
+
+		spin_lock_bh(&ctx->lock);
+		if (!list_empty(&ctx->active_req_list))
 			active_req = list_first_entry(&ctx->active_req_list,
 				struct cam_ctx_request, list);
-			active_req_isp =
-				(struct cam_isp_ctx_req *) active_req->req_priv;
-			__cam_isp_ctx_handle_buf_done_fail_log(active_req_isp);
-		} else {
+		else
 			CAM_ERR_RATE_LIMIT(CAM_ISP,
 				"WARNING: should not happen (cnt = %d) but active_list empty",
 				ctx_isp->active_req_cnt);
+		spin_unlock_bh(&ctx->lock);
+
+		if (active_req) {
+			active_req_isp =
+				(struct cam_isp_ctx_req *) active_req->req_priv;
+			__cam_isp_ctx_handle_buf_done_fail_log(active_req_isp);
 		}
-			rc = -EFAULT;
-			goto end;
+
+		rc = -EFAULT;
+		goto end;
 	}
 	req_isp->bubble_report = apply->report_if_bubble;
 
@@ -1267,6 +1239,8 @@
 		spin_lock_bh(&ctx->lock);
 		ctx_isp->substate_activated = next_state;
 		ctx_isp->last_applied_req_id = apply->request_id;
+		list_del_init(&req->list);
+		list_add_tail(&req->list, &ctx->wait_req_list);
 		CAM_DBG(CAM_ISP, "new substate state %d, applied req %lld",
 			next_state, ctx_isp->last_applied_req_id);
 		spin_unlock_bh(&ctx->lock);
@@ -1341,7 +1315,11 @@
 	INIT_LIST_HEAD(&flush_list);
 	if (list_empty(req_list)) {
 		CAM_DBG(CAM_ISP, "request list is empty");
-		return 0;
+		if (flush_req->type == CAM_REQ_MGR_FLUSH_TYPE_CANCEL_REQ) {
+			CAM_ERR(CAM_ISP, "no request to cancel");
+			return -EINVAL;
+		} else
+			return 0;
 	}
 
 	CAM_DBG(CAM_REQ, "Flush [%u] in progress for req_id %llu",
@@ -1450,28 +1428,6 @@
 	return rc;
 }
 
-static int __cam_isp_ctx_flush_req_in_activated(
-	struct cam_context *ctx,
-	struct cam_req_mgr_flush_request *flush_req)
-{
-	int rc = 0;
-	struct cam_isp_context *ctx_isp;
-
-	ctx_isp = (struct cam_isp_context *) ctx->ctx_priv;
-
-	CAM_DBG(CAM_ISP, "Flush request in state %d", ctx->state);
-	rc = __cam_isp_ctx_flush_req(ctx, &ctx->pending_req_list, flush_req);
-
-	/* only if request is found in pending queue, move to flush state*/
-	if (!rc) {
-		spin_lock_bh(&ctx->lock);
-		ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_FLUSH;
-		ctx_isp->frame_skip_count = 2;
-		spin_unlock_bh(&ctx->lock);
-	}
-	return rc;
-}
-
 static int __cam_isp_ctx_flush_req_in_ready(
 	struct cam_context *ctx,
 	struct cam_req_mgr_flush_request *flush_req)
@@ -1544,12 +1500,6 @@
 		.crm_ops = {},
 		.irq_ops = NULL,
 	},
-	/* FLUSH */
-	{
-		.ioctl_ops = {},
-		.crm_ops = {},
-		.irq_ops = NULL,
-	},
 };
 
 static int __cam_isp_ctx_rdi_only_sof_in_top_state(
@@ -1807,11 +1757,11 @@
 	ctx_isp->substate_activated = CAM_ISP_CTX_ACTIVATED_EPOCH;
 	/* notify reqmgr with sof signal*/
 	if (ctx->ctx_crm_intf && ctx->ctx_crm_intf->notify_trigger) {
-		if (list_empty(&ctx->pending_req_list)) {
-			CAM_ERR(CAM_ISP, "Reg upd ack with no pending request");
+		if (list_empty(&ctx->wait_req_list)) {
+			CAM_ERR(CAM_ISP, "Reg upd ack with no waiting request");
 			goto error;
 		}
-		req = list_first_entry(&ctx->pending_req_list,
+		req = list_first_entry(&ctx->wait_req_list,
 				struct cam_ctx_request, list);
 		list_del_init(&req->list);
 
@@ -1934,17 +1884,6 @@
 	/* HALT */
 	{
 	},
-	/* FLUSH */
-	{
-		.irq_ops = {
-			NULL,
-			__cam_isp_ctx_sof_in_flush,
-			NULL,
-			NULL,
-			NULL,
-			__cam_isp_ctx_buf_done_in_applied,
-		},
-	},
 };
 
 static int __cam_isp_ctx_rdi_only_apply_req_top_state(
@@ -2012,12 +1951,6 @@
 		.crm_ops = {},
 		.irq_ops = NULL,
 	},
-	/* FLUSHED */
-	{
-		.ioctl_ops = {},
-		.crm_ops = {},
-		.irq_ops = NULL,
-	},
 };
 
 /* top level state machine */
@@ -2072,7 +2005,7 @@
 static int __cam_isp_ctx_config_dev_in_top_state(
 	struct cam_context *ctx, struct cam_config_dev_cmd *cmd)
 {
-	int rc = 0;
+	int rc = 0, i;
 	struct cam_ctx_request           *req = NULL;
 	struct cam_isp_ctx_req           *req_isp;
 	uint64_t                          packet_addr;
@@ -2148,6 +2081,15 @@
 	req_isp->num_fence_map_in = cfg.num_in_map_entries;
 	req_isp->num_acked = 0;
 
+	for (i = 0; i < req_isp->num_fence_map_out; i++) {
+		rc = cam_sync_get_obj_ref(req_isp->fence_map_out[i].sync_id);
+		if (rc) {
+			CAM_ERR(CAM_ISP, "Can't get ref for fence %d",
+				req_isp->fence_map_out[i].sync_id);
+			goto put_ref;
+		}
+	}
+
 	CAM_DBG(CAM_ISP, "num_entry: %d, num fence out: %d, num fence in: %d",
 		req_isp->num_cfg, req_isp->num_fence_map_out,
 		req_isp->num_fence_map_in);
@@ -2189,7 +2131,7 @@
 		}
 	}
 	if (rc)
-		goto free_req;
+		goto put_ref;
 
 	CAM_DBG(CAM_REQ,
 		"Preprocessing Config req_id %lld successful on ctx %u",
@@ -2197,6 +2139,13 @@
 
 	return rc;
 
+put_ref:
+	for (--i; i >= 0; i--) {
+		rc = cam_sync_put_obj_ref(req_isp->fence_map_out[i].sync_id);
+		if (rc)
+			CAM_ERR(CAM_CTXT, "Failed to put ref of fence %d",
+				req_isp->fence_map_out[i].sync_id);
+	}
 free_req:
 	spin_lock_bh(&ctx->lock);
 	list_add_tail(&req->list, &ctx->free_req_list);
@@ -2473,9 +2422,13 @@
 	}
 	CAM_DBG(CAM_ISP, "start device success ctx %u", ctx->ctx_id);
 
+	list_del_init(&req->list);
+
 	if (req_isp->num_fence_map_out) {
-		list_del_init(&req->list);
 		list_add_tail(&req->list, &ctx->active_req_list);
+		ctx_isp->active_req_cnt++;
+	} else {
+		list_add_tail(&req->list, &ctx->wait_req_list);
 	}
 end:
 	return rc;
@@ -2817,7 +2770,7 @@
 		.crm_ops = {
 			.unlink = __cam_isp_ctx_unlink_in_activated,
 			.apply_req = __cam_isp_ctx_apply_req,
-			.flush_req = __cam_isp_ctx_flush_req_in_activated,
+			.flush_req = __cam_isp_ctx_flush_req_in_top_state,
 			.process_evt = __cam_isp_ctx_process_evt,
 		},
 		.irq_ops = __cam_isp_ctx_handle_irq_in_activated,
diff --git a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h
index a939f2d..4592e42 100644
--- a/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h
+++ b/drivers/media/platform/msm/camera/cam_isp/cam_isp_context.h
@@ -57,7 +57,6 @@
 	CAM_ISP_CTX_ACTIVATED_BUBBLE_APPLIED,
 	CAM_ISP_CTX_ACTIVATED_HW_ERROR,
 	CAM_ISP_CTX_ACTIVATED_HALT,
-	CAM_ISP_CTX_ACTIVATED_FLUSH,
 	CAM_ISP_CTX_ACTIVATED_MAX,
 };
 
@@ -155,7 +154,6 @@
  * @subscribe_event:           The irq event mask that CRM subscribes to, IFE
  *                             will invoke CRM cb at those event.
  * @last_applied_req_id:       Last applied request id
- * @frame_skip_count:          Number of frame to skip before change state
  * @state_monitor_head:        Write index to the state monitoring array
  * @cam_isp_ctx_state_monitor: State monitoring array
  * @rdi_only_context:          Get context type information.
@@ -180,7 +178,6 @@
 	int64_t                          reported_req_id;
 	uint32_t                         subscribe_event;
 	int64_t                          last_applied_req_id;
-	uint32_t                         frame_skip_count;
 	atomic64_t                       state_monitor_head;
 	struct cam_isp_context_state_monitor cam_isp_ctx_state_monitor[
 		CAM_ISP_CTX_STATE_MONITOR_MAX_ENTRIES];
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
index abc6bb0..eaa7325 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/hw_utils/cam_isp_packet_parser.c
@@ -434,7 +434,7 @@
 	bool                                  fill_fence)
 {
 	int rc = 0;
-	uint64_t                            io_addr[CAM_PACKET_MAX_PLANES];
+	dma_addr_t                          io_addr[CAM_PACKET_MAX_PLANES];
 	struct cam_buf_io_cfg              *io_cfg;
 	struct cam_isp_resource_node       *res;
 	struct cam_ife_hw_mgr_res          *hw_mgr_res;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
index e5fb03f..c3431ca 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.c
@@ -42,6 +42,9 @@
 #define CAM_IFE_CSID_QTIMER_MUL_FACTOR                 10000
 #define CAM_IFE_CSID_QTIMER_DIV_FACTOR                 192
 
+/* Max number of sof irq's triggered in case of SOF freeze */
+#define CAM_CSID_IRQ_SOF_DEBUG_CNT_MAX 6
+
 static int cam_ife_csid_is_ipp_format_supported(
 	uint32_t in_format)
 {
@@ -2370,6 +2373,10 @@
 		goto end;
 	}
 
+	/* Reset sof irq debug fields */
+	csid_hw->sof_irq_triggered = false;
+	csid_hw->irq_debug_cnt = 0;
+
 	CAM_DBG(CAM_ISP, "CSID:%d res_type :%d res_id:%d",
 		csid_hw->hw_intf->hw_idx, res->res_type, res->res_id);
 
@@ -2520,10 +2527,13 @@
 		}
 	}
 
-	if (sof_irq_enable)
+	if (sof_irq_enable) {
 		csid_hw->csid_debug |= CSID_DEBUG_ENABLE_SOF_IRQ;
-	else
+		csid_hw->sof_irq_triggered = true;
+	} else {
 		csid_hw->csid_debug &= ~CSID_DEBUG_ENABLE_SOF_IRQ;
+		csid_hw->sof_irq_triggered = false;
+	}
 
 	CAM_INFO(CAM_ISP, "SOF freeze: CSID SOF irq %s",
 		(sof_irq_enable == true) ? "enabled" : "disabled");
@@ -2575,7 +2585,7 @@
 	struct cam_ife_csid_csi2_rx_reg_offset *csi2_reg;
 	uint32_t i, irq_status_top, irq_status_rx, irq_status_ipp = 0;
 	uint32_t irq_status_rdi[4] = {0, 0, 0, 0};
-	uint32_t val;
+	uint32_t val, sof_irq_disable = 0;
 
 	csid_hw = (struct cam_ife_csid_hw *)data;
 
@@ -2687,22 +2697,22 @@
 
 	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOT_IRQ) {
 		if (irq_status_rx & CSID_CSI2_RX_INFO_PHY_DL0_EOT_CAPTURED) {
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID:%d PHY_DL0_EOT_CAPTURED",
 				csid_hw->hw_intf->hw_idx);
 		}
 		if (irq_status_rx & CSID_CSI2_RX_INFO_PHY_DL1_EOT_CAPTURED) {
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID:%d PHY_DL1_EOT_CAPTURED",
 				csid_hw->hw_intf->hw_idx);
 		}
 		if (irq_status_rx & CSID_CSI2_RX_INFO_PHY_DL2_EOT_CAPTURED) {
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID:%d PHY_DL2_EOT_CAPTURED",
 				csid_hw->hw_intf->hw_idx);
 		}
 		if (irq_status_rx & CSID_CSI2_RX_INFO_PHY_DL3_EOT_CAPTURED) {
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID:%d PHY_DL3_EOT_CAPTURED",
 				csid_hw->hw_intf->hw_idx);
 		}
@@ -2710,22 +2720,22 @@
 
 	if (csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOT_IRQ) {
 		if (irq_status_rx & CSID_CSI2_RX_INFO_PHY_DL0_SOT_CAPTURED) {
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID:%d PHY_DL0_SOT_CAPTURED",
 				csid_hw->hw_intf->hw_idx);
 		}
 		if (irq_status_rx & CSID_CSI2_RX_INFO_PHY_DL1_SOT_CAPTURED) {
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID:%d PHY_DL1_SOT_CAPTURED",
 				csid_hw->hw_intf->hw_idx);
 		}
 		if (irq_status_rx & CSID_CSI2_RX_INFO_PHY_DL2_SOT_CAPTURED) {
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID:%d PHY_DL2_SOT_CAPTURED",
 				csid_hw->hw_intf->hw_idx);
 		}
 		if (irq_status_rx & CSID_CSI2_RX_INFO_PHY_DL3_SOT_CAPTURED) {
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID:%d PHY_DL3_SOT_CAPTURED",
 				csid_hw->hw_intf->hw_idx);
 		}
@@ -2733,44 +2743,48 @@
 
 	if ((csid_hw->csid_debug & CSID_DEBUG_ENABLE_LONG_PKT_CAPTURE) &&
 		(irq_status_rx & CSID_CSI2_RX_INFO_LONG_PKT_CAPTURED)) {
-		CAM_ERR(CAM_ISP, "CSID:%d LONG_PKT_CAPTURED",
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d LONG_PKT_CAPTURED",
 			csid_hw->hw_intf->hw_idx);
 		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
 			csi2_reg->csid_csi2_rx_captured_long_pkt_0_addr);
-		CAM_ERR(CAM_ISP, "CSID:%d long packet VC :%d DT:%d WC:%d",
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d long packet VC :%d DT:%d WC:%d",
 			csid_hw->hw_intf->hw_idx,
 			(val >> 22), ((val >> 16) & 0x3F), (val & 0xFFFF));
 		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
 			csi2_reg->csid_csi2_rx_captured_long_pkt_1_addr);
-		CAM_ERR(CAM_ISP, "CSID:%d long packet ECC :%d",
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d long packet ECC :%d",
 			csid_hw->hw_intf->hw_idx, val);
 		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
 			csi2_reg->csid_csi2_rx_captured_long_pkt_ftr_addr);
-		CAM_ERR(CAM_ISP, "CSID:%d long pkt cal CRC:%d expected CRC:%d",
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d long pkt cal CRC:%d expected CRC:%d",
 			csid_hw->hw_intf->hw_idx, (val >> 16), (val & 0xFFFF));
 	}
 	if ((csid_hw->csid_debug & CSID_DEBUG_ENABLE_SHORT_PKT_CAPTURE) &&
 		(irq_status_rx & CSID_CSI2_RX_INFO_SHORT_PKT_CAPTURED)) {
-		CAM_ERR(CAM_ISP, "CSID:%d SHORT_PKT_CAPTURED",
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d SHORT_PKT_CAPTURED",
 			csid_hw->hw_intf->hw_idx);
 		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
 			csi2_reg->csid_csi2_rx_captured_short_pkt_0_addr);
-		CAM_ERR(CAM_ISP, "CSID:%d short pkt VC :%d DT:%d LC:%d",
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d short pkt VC :%d DT:%d LC:%d",
 			csid_hw->hw_intf->hw_idx,
 			(val >> 22), ((val >> 16) & 0x1F), (val & 0xFFFF));
 		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
 			csi2_reg->csid_csi2_rx_captured_short_pkt_1_addr);
-		CAM_ERR(CAM_ISP, "CSID:%d short packet ECC :%d",
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d short packet ECC :%d",
 			csid_hw->hw_intf->hw_idx, val);
 	}
 
 	if ((csid_hw->csid_debug & CSID_DEBUG_ENABLE_CPHY_PKT_CAPTURE) &&
 		(irq_status_rx & CSID_CSI2_RX_INFO_CPHY_PKT_HDR_CAPTURED)) {
-		CAM_ERR(CAM_ISP, "CSID:%d CPHY_PKT_HDR_CAPTURED",
+		CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d CPHY_PKT_HDR_CAPTURED",
 			csid_hw->hw_intf->hw_idx);
 		val = cam_io_r_mb(soc_info->reg_map[0].mem_base +
 			csi2_reg->csid_csi2_rx_captured_cphy_pkt_hdr_addr);
-		CAM_ERR(CAM_ISP, "CSID:%d cphy packet VC :%d DT:%d WC:%d",
+		CAM_INFO_RATE_LIMIT(CAM_ISP,
+			"CSID:%d cphy packet VC :%d DT:%d WC:%d",
 			csid_hw->hw_intf->hw_idx,
 			(val >> 22), ((val >> 16) & 0x1F), (val & 0xFFFF));
 	}
@@ -2785,13 +2799,16 @@
 		}
 
 		if ((irq_status_ipp & CSID_PATH_INFO_INPUT_SOF) &&
-			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ))
-			CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d IPP SOF received",
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d IPP SOF received",
 				csid_hw->hw_intf->hw_idx);
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
 
 		if ((irq_status_ipp & CSID_PATH_INFO_INPUT_EOF) &&
 			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOF_IRQ))
-			CAM_ERR_RATE_LIMIT(CAM_ISP, "CSID:%d IPP EOF received",
+			CAM_INFO_RATE_LIMIT(CAM_ISP, "CSID:%d IPP EOF received",
 				csid_hw->hw_intf->hw_idx);
 
 		if (irq_status_ipp & CSID_PATH_ERROR_FIFO_OVERFLOW) {
@@ -2813,13 +2830,16 @@
 		}
 
 		if ((irq_status_rdi[i] & CSID_PATH_INFO_INPUT_SOF) &&
-			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ))
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_SOF_IRQ)) {
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID RDI:%d SOF received", i);
+			if (csid_hw->sof_irq_triggered)
+				csid_hw->irq_debug_cnt++;
+		}
 
 		if ((irq_status_rdi[i]  & CSID_PATH_INFO_INPUT_EOF) &&
 			(csid_hw->csid_debug & CSID_DEBUG_ENABLE_EOF_IRQ))
-			CAM_ERR_RATE_LIMIT(CAM_ISP,
+			CAM_INFO_RATE_LIMIT(CAM_ISP,
 				"CSID RDI:%d EOF received", i);
 
 		if (irq_status_rdi[i] & CSID_PATH_ERROR_FIFO_OVERFLOW) {
@@ -2833,6 +2853,11 @@
 		}
 	}
 
+	if (csid_hw->irq_debug_cnt >= CAM_CSID_IRQ_SOF_DEBUG_CNT_MAX) {
+		cam_ife_csid_sof_irq_debug(csid_hw, &sof_irq_disable);
+		csid_hw->irq_debug_cnt = 0;
+	}
+
 	CAM_DBG(CAM_ISP, "IRQ Handling exit");
 	return IRQ_HANDLED;
 }
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h
index 681a47f..ad993eb 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/ife_csid_hw/cam_ife_csid_core.h
@@ -435,6 +435,9 @@
  * @csid_debug:               csid debug information to enable the SOT, EOT,
  *                            SOF, EOF, measure etc in the csid hw
  * @clk_rate                  Clock rate
+ * @sof_irq_triggered:        Flag is set on receiving event to enable sof irq
+ *                            incase of SOF freeze.
+ * @irq_debug_cnt:            Counter to track sof irq's when above flag is set.
  *
  */
 struct cam_ife_csid_hw {
@@ -456,6 +459,8 @@
 	struct completion    csid_rdin_complete[CAM_IFE_CSID_RDI_MAX];
 	uint64_t                         csid_debug;
 	uint64_t                         clk_rate;
+	bool                             sof_irq_triggered;
+	uint32_t                         irq_debug_cnt;
 };
 
 int cam_ife_csid_hw_probe_init(struct cam_hw_intf  *csid_hw_intf,
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
index 70e0467..28cfcc8 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_isp_hw.h
@@ -177,7 +177,7 @@
  *
  */
 struct cam_isp_hw_get_wm_update {
-	uint64_t                       *image_buf;
+	dma_addr_t                     *image_buf;
 	uint32_t                        num_buf;
 	struct cam_buf_io_cfg          *io_cfg;
 };
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
index 05c3c61..84f30f3 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/include/cam_vfe_hw_intf.h
@@ -237,6 +237,7 @@
  *
  * @list:                    list_head node for the payload
  * @core_index:              Index of VFE HW that generated this IRQ event
+ * @debug_status_0:          Value of debug status_0 register at time of IRQ
  * @evt_id:                  IRQ event
  * @irq_reg_val:             IRQ and Error register values, read when IRQ was
  *                           handled
@@ -247,6 +248,7 @@
 struct cam_vfe_bus_irq_evt_payload {
 	struct list_head            list;
 	uint32_t                    core_index;
+	uint32_t                    debug_status_0;
 	uint32_t                    evt_id;
 	uint32_t                    irq_reg_val[CAM_IFE_BUS_IRQ_REGISTERS_MAX];
 	uint32_t                    error_type;
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe170/cam_vfe170.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe170/cam_vfe170.h
index 984adf7..c7d3aa2 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe170/cam_vfe170.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe170/cam_vfe170.h
@@ -234,6 +234,8 @@
 		.addr_sync_cfg                = 0x0000207C,
 		.addr_sync_frame_hdr          = 0x00002080,
 		.addr_sync_no_sync            = 0x00002084,
+		.debug_status_cfg             = 0x0000226C,
+		.debug_status_0               = 0x00002270,
 	},
 	.num_client = 20,
 	.bus_client_reg = {
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
index 206b3a3..0bb1374 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.c
@@ -36,6 +36,8 @@
 
 #define CAM_VFE_BUS_VER2_PAYLOAD_MAX             256
 
+#define CAM_VFE_BUS_SET_DEBUG_REG                0x82
+
 #define CAM_VFE_RDI_BUS_DEFAULT_WIDTH               0xFF01
 #define CAM_VFE_RDI_BUS_DEFAULT_STRIDE              0xFF01
 #define CAM_VFE_BUS_INTRA_CLIENT_MASK               0x3
@@ -205,6 +207,7 @@
 
 	uint32_t                            irq_handle;
 	uint32_t                            error_irq_handle;
+	void                               *tasklet_info;
 };
 
 static int cam_vfe_bus_process_cmd(
@@ -1227,6 +1230,99 @@
 	return rc;
 }
 
+
+static int cam_vfe_bus_err_bottom_half(void *ctx_priv,
+	void *evt_payload_priv)
+{
+	struct cam_vfe_bus_irq_evt_payload *evt_payload;
+	struct cam_vfe_bus_ver2_common_data *common_data;
+	uint32_t val = 0;
+
+	if (!ctx_priv || !evt_payload_priv)
+		return -EINVAL;
+
+	evt_payload = evt_payload_priv;
+	common_data = evt_payload->ctx;
+
+	val = evt_payload->debug_status_0;
+	CAM_ERR(CAM_ISP, "Bus Violation: debug_status_0 = 0x%x", val);
+
+	if (val & 0x01)
+		CAM_INFO(CAM_ISP, "RDI 0 violation");
+
+	if (val & 0x02)
+		CAM_INFO(CAM_ISP, "RDI 1 violation");
+
+	if (val & 0x04)
+		CAM_INFO(CAM_ISP, "RDI 2 violation");
+
+	if (val & 0x08)
+		CAM_INFO(CAM_ISP, "VID Y 1:1 UBWC violation");
+
+	if (val & 0x010)
+		CAM_INFO(CAM_ISP, "VID C 1:1 UBWC violation");
+
+	if (val & 0x020)
+		CAM_INFO(CAM_ISP, "VID YC 4:1 violation");
+
+	if (val & 0x040)
+		CAM_INFO(CAM_ISP, "VID YC 16:1 violation");
+
+	if (val & 0x080)
+		CAM_INFO(CAM_ISP, "FD Y violation");
+
+	if (val & 0x0100)
+		CAM_INFO(CAM_ISP, "FD C violation");
+
+	if (val & 0x0200)
+		CAM_INFO(CAM_ISP, "RAW DUMP violation");
+
+	if (val & 0x0400)
+		CAM_INFO(CAM_ISP, "PDAF violation");
+
+	if (val & 0x0800)
+		CAM_INFO(CAM_ISP, "STATs HDR BE violation");
+
+	if (val & 0x01000)
+		CAM_INFO(CAM_ISP, "STATs HDR BHIST violation");
+
+	if (val & 0x02000)
+		CAM_INFO(CAM_ISP, "STATs TINTLESS BG violation");
+
+	if (val & 0x04000)
+		CAM_INFO(CAM_ISP, "STATs BF violation");
+
+	if (val & 0x08000)
+		CAM_INFO(CAM_ISP, "STATs AWB BG UBWC violation");
+
+	if (val & 0x010000)
+		CAM_INFO(CAM_ISP, "STATs BHIST violation");
+
+	if (val & 0x020000)
+		CAM_INFO(CAM_ISP, "STATs RS violation");
+
+	if (val & 0x040000)
+		CAM_INFO(CAM_ISP, "STATs CS violation");
+
+	if (val & 0x080000)
+		CAM_INFO(CAM_ISP, "STATs IHIST violation");
+
+	if (val & 0x0100000)
+		CAM_INFO(CAM_ISP, "DISP Y 1:1 UBWC violation");
+
+	if (val & 0x0200000)
+		CAM_INFO(CAM_ISP, "DISP C 1:1 UBWC violation");
+
+	if (val & 0x0400000)
+		CAM_INFO(CAM_ISP, "DISP YC 4:1 violation");
+
+	if (val & 0x0800000)
+		CAM_INFO(CAM_ISP, "DISP YC 16:1 violation");
+
+	cam_vfe_bus_put_evt_payload(common_data, &evt_payload);
+	return 0;
+}
+
 static int cam_vfe_bus_init_wm_resource(uint32_t index,
 	struct cam_vfe_bus_ver2_priv    *ver2_bus_priv,
 	struct cam_vfe_bus_ver2_hw_info *ver2_hw_info,
@@ -1927,6 +2023,7 @@
 	}
 	mutex_unlock(&rsrc_data->common_data->bus_mutex);
 
+	ver2_bus_priv->tasklet_info = acq_args->tasklet;
 	rsrc_data->num_wm = num_wm;
 	rsrc_node->res_id = out_acquire_args->out_port_info->res_type;
 	rsrc_node->tasklet_info = acq_args->tasklet;
@@ -2267,9 +2364,10 @@
 static int cam_vfe_bus_error_irq_top_half(uint32_t evt_id,
 	struct cam_irq_th_payload *th_payload)
 {
-	int i = 0;
+	int i = 0, rc = 0;
 	struct cam_vfe_bus_ver2_priv *bus_priv =
 		th_payload->handler_priv;
+	struct cam_vfe_bus_irq_evt_payload *evt_payload;
 
 	CAM_ERR_RATE_LIMIT(CAM_ISP, "Bus Err IRQ");
 	for (i = 0; i < th_payload->num_registers; i++) {
@@ -2280,8 +2378,25 @@
 	cam_irq_controller_disable_irq(bus_priv->common_data.bus_irq_controller,
 		bus_priv->error_irq_handle);
 
-	/* Returning error stops from enqueuing bottom half */
-	return -EFAULT;
+	rc  = cam_vfe_bus_get_evt_payload(&bus_priv->common_data, &evt_payload);
+	if (rc) {
+		CAM_ERR_RATE_LIMIT(CAM_ISP, "Cannot get payload");
+		return rc;
+	}
+
+	for (i = 0; i < th_payload->num_registers; i++)
+		evt_payload->irq_reg_val[i] = th_payload->evt_status_arr[i];
+
+	evt_payload->core_index = bus_priv->common_data.core_index;
+	evt_payload->evt_id  = evt_id;
+	evt_payload->ctx = &bus_priv->common_data;
+	evt_payload->debug_status_0 = cam_io_r_mb(
+		bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->debug_status_0);
+
+	th_payload->evt_payload_priv = evt_payload;
+
+	return rc;
 }
 
 static int cam_vfe_bus_update_wm(void *priv, void *cmd_args,
@@ -2767,15 +2882,19 @@
 		bus_error_irq_mask,
 		bus_priv,
 		cam_vfe_bus_error_irq_top_half,
-		NULL,
-		NULL,
-		NULL);
+		cam_vfe_bus_err_bottom_half,
+		bus_priv->tasklet_info,
+		&tasklet_bh_api);
 
 	if (bus_priv->irq_handle <= 0) {
 		CAM_ERR(CAM_ISP, "Failed to subscribe BUS IRQ");
 		return -EFAULT;
 	}
 
+	/*Set Debug Registers*/
+	cam_io_w_mb(CAM_VFE_BUS_SET_DEBUG_REG, bus_priv->common_data.mem_base +
+		bus_priv->common_data.common_reg->debug_status_cfg);
+
 	/* BUS_WR_INPUT_IF_ADDR_SYNC_FRAME_HEADER */
 	cam_io_w_mb(0x0, bus_priv->common_data.mem_base +
 		bus_priv->common_data.common_reg->addr_sync_frame_hdr);
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.h b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.h
index 5a12f74..9986342 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.h
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_bus/cam_vfe_bus_ver2.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -83,6 +83,8 @@
 	uint32_t addr_sync_cfg;
 	uint32_t addr_sync_frame_hdr;
 	uint32_t addr_sync_no_sync;
+	uint32_t debug_status_cfg;
+	uint32_t debug_status_0;
 };
 
 /*
diff --git a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
index b554fe4..73b4ee7 100644
--- a/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
+++ b/drivers/media/platform/msm/camera/cam_isp/isp_hw_mgr/isp_hw/vfe_hw/vfe_top/cam_vfe_camif_ver2.c
@@ -24,6 +24,8 @@
 #include "cam_cdm_util.h"
 #include "cam_cpas_api.h"
 
+#define CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX 2
+
 struct cam_vfe_mux_camif_data {
 	void __iomem                                *mem_base;
 	struct cam_hw_intf                          *hw_intf;
@@ -40,6 +42,7 @@
 	uint32_t                           last_pixel;
 	uint32_t                           last_line;
 	bool                               enable_sof_irq_debug;
+	uint32_t                           irq_debug_cnt;
 };
 
 static int cam_vfe_camif_validate_pix_pattern(uint32_t pattern)
@@ -266,6 +269,10 @@
 	CAM_DBG(CAM_ISP, "hw id:%d RUP val:%d", camif_res->hw_intf->hw_idx,
 		rsrc_data->reg_data->reg_update_cmd_data);
 
+	/* disable sof irq debug flag */
+	rsrc_data->enable_sof_irq_debug = false;
+	rsrc_data->irq_debug_cnt = 0;
+
 	CAM_DBG(CAM_ISP, "Start Camif IFE %d Done", camif_res->hw_intf->hw_idx);
 	return 0;
 }
@@ -440,11 +447,21 @@
 	switch (payload->evt_id) {
 	case CAM_ISP_HW_EVENT_SOF:
 		if (irq_status0 & camif_priv->reg_data->sof_irq_mask) {
-			if (camif_priv->enable_sof_irq_debug)
-				CAM_ERR_RATE_LIMIT(CAM_ISP, "Received SOF");
-			else
-				CAM_DBG(CAM_ISP, "Received SOF");
+			if ((camif_priv->enable_sof_irq_debug) &&
+				(camif_priv->irq_debug_cnt <=
+				CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX)) {
+				CAM_INFO_RATE_LIMIT(CAM_ISP, "Received SOF");
 
+				camif_priv->irq_debug_cnt++;
+				if (camif_priv->irq_debug_cnt ==
+					CAM_VFE_CAMIF_IRQ_SOF_DEBUG_CNT_MAX) {
+					camif_priv->enable_sof_irq_debug =
+						false;
+					camif_priv->irq_debug_cnt = 0;
+				}
+			} else {
+				CAM_DBG(CAM_ISP, "Received SOF");
+			}
 			ret = CAM_VFE_IRQ_STATUS_SUCCESS;
 		}
 		break;
diff --git a/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c b/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
index 0f34c9f..fa8984c 100644
--- a/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_lrme/lrme_hw_mgr/cam_lrme_hw_mgr.c
@@ -150,7 +150,7 @@
 	int rc = -EINVAL;
 	uint32_t num_in_buf, num_out_buf, i, j, plane;
 	struct cam_buf_io_cfg *io_cfg;
-	uint64_t io_addr[CAM_PACKET_MAX_PLANES];
+	dma_addr_t io_addr[CAM_PACKET_MAX_PLANES];
 	size_t size;
 
 	num_in_buf = 0;
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
index d192018..0e77a4c 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c
@@ -147,7 +147,7 @@
 }
 
 int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
-	uint64_t *iova_ptr, size_t *len_ptr)
+	dma_addr_t *iova_ptr, size_t *len_ptr)
 {
 	int rc = 0, idx;
 
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h
index 7588c17..14b1a67 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr_api.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -82,7 +82,7 @@
  * @return Status of operation. Negative in case of error. Zero otherwise.
  */
 int cam_mem_get_io_buf(int32_t buf_handle, int32_t mmu_handle,
-	uint64_t *iova_ptr, size_t *len_ptr);
+	dma_addr_t *iova_ptr, size_t *len_ptr);
 /**
  * @brief: Returns CPU address information about buffer
  *
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
index 61fd7a8..460b3df 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_core.c
@@ -1283,7 +1283,8 @@
 				rc = dev->ops->link_setup(&link_data);
 				if (rc)
 					CAM_ERR(CAM_CRM,
-						"Unlink failed dev_hdl %d",
+						"Unlink failed dev name %s hdl %x",
+						dev->dev_info.name,
 						dev->dev_hdl);
 			}
 			dev->dev_hdl = 0;
@@ -2350,8 +2351,8 @@
 	/* Destroy the link handle */
 	rc = cam_destroy_device_hdl(link->link_hdl);
 	if (rc < 0) {
-		CAM_ERR(CAM_CRM, "error while destroying dev handle %d %x",
-			rc, link->link_hdl);
+		CAM_ERR(CAM_CRM, "error destroying link hdl %x rc %d",
+			link->link_hdl, rc);
 	}
 
 	mutex_unlock(&link->lock);
@@ -2552,8 +2553,7 @@
 	rc = __cam_req_mgr_unlink(link);
 
 	/* Free curent link and put back into session's free pool of links */
-	if (!rc)
-		__cam_req_mgr_unreserve_link(cam_session, link);
+	__cam_req_mgr_unreserve_link(cam_session, link);
 
 done:
 	mutex_unlock(&g_crm_core_dev->crm_lock);
diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_dev.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_dev.c
index 543e332..0d21064 100644
--- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_dev.c
+++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_req_mgr_dev.c
@@ -584,7 +584,6 @@
 static int cam_req_mgr_remove(struct platform_device *pdev)
 {
 	cam_req_mgr_core_device_deinit();
-	cam_mem_mgr_deinit();
 	cam_req_mgr_util_deinit();
 	cam_media_device_cleanup();
 	cam_video_device_cleanup();
@@ -624,12 +623,6 @@
 		goto req_mgr_util_fail;
 	}
 
-	rc = cam_mem_mgr_init();
-	if (rc) {
-		CAM_ERR(CAM_CRM, "mem mgr init failed");
-		goto mem_mgr_init_fail;
-	}
-
 	rc = cam_req_mgr_core_device_init();
 	if (rc) {
 		CAM_ERR(CAM_CRM, "core device setup failed");
@@ -654,8 +647,6 @@
 	return rc;
 
 req_mgr_core_fail:
-	cam_mem_mgr_deinit();
-mem_mgr_init_fail:
 	cam_req_mgr_util_deinit();
 req_mgr_util_fail:
 	mutex_destroy(&g_dev.dev_lock);
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_core.c
index 058e352..f859484 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_core.c
@@ -870,8 +870,8 @@
 	struct cam_cci_ctrl *c_ctrl)
 {
 	int32_t rc = 0;
-	uint32_t val = 0, i = 0;
-	unsigned long rem_jiffies;
+	uint32_t val = 0, i = 0, j = 0;
+	unsigned long rem_jiffies, flags;
 	int32_t read_words = 0, exp_words = 0;
 	int32_t index = 0, first_byte = 0, total_read_words = 0;
 	enum cci_i2c_master_t master;
@@ -990,11 +990,13 @@
 
 	val = 1 << ((master * 2) + queue);
 	cam_io_w_mb(val, base + CCI_QUEUE_START_ADDR);
-	exp_words = ((read_cfg->num_byte / 4) + 1);
 
-	while (exp_words != total_read_words) {
+	exp_words = ((read_cfg->num_byte / 4) + 1);
+	CAM_DBG(CAM_CCI, "waiting for threshold [exp_words %d]", exp_words);
+
+	while (total_read_words != exp_words) {
 		rem_jiffies = wait_for_completion_timeout(
-			&cci_dev->cci_master_info[master].reset_complete,
+			&cci_dev->cci_master_info[master].th_complete,
 			CCI_TIMEOUT);
 		if (!rem_jiffies) {
 			rc = -ETIMEDOUT;
@@ -1013,8 +1015,16 @@
 
 		read_words = cam_io_r_mb(base +
 			CCI_I2C_M0_READ_BUF_LEVEL_ADDR + master * 0x100);
+		if (read_words <= 0) {
+			CAM_DBG(CAM_CCI, "FIFO Buffer lvl is 0");
+			continue;
+		}
+
+		j++;
+		CAM_DBG(CAM_CCI, "Iteration: %u read_words %d", j, read_words);
+
 		total_read_words += read_words;
-		do {
+		while (read_words > 0) {
 			val = cam_io_r_mb(base +
 				CCI_I2C_M0_READ_DATA_ADDR + master * 0x100);
 			for (i = 0; (i < 4) &&
@@ -1032,9 +1042,57 @@
 					index++;
 				}
 			}
-		} while (--read_words > 0);
+			read_words--;
+		}
+
+		CAM_DBG(CAM_CCI, "Iteraion:%u total_read_words %d",
+			j, total_read_words);
+
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		if (cci_dev->irq_status1) {
+			CAM_DBG(CAM_CCI, "clear irq_status1:%x",
+				cci_dev->irq_status1);
+			cam_io_w_mb(cci_dev->irq_status1,
+				base + CCI_IRQ_CLEAR_1_ADDR);
+			cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
+			cci_dev->irq_status1 = 0;
+		}
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+
+		if (total_read_words == exp_words) {
+		   /*
+		    * This wait is for RD_DONE irq, if RD_DONE is
+		    * triggered we will call complete on both threshold
+		    * & read done waits. As part of the threshold wait
+		    * we will be draining the entire buffer out. This
+		    * wait is to compensate for the complete invoked for
+		    * RD_DONE exclusively.
+		    */
+			rem_jiffies = wait_for_completion_timeout(
+			&cci_dev->cci_master_info[master].reset_complete,
+			CCI_TIMEOUT);
+			if (!rem_jiffies) {
+				rc = -ETIMEDOUT;
+				val = cam_io_r_mb(base +
+					CCI_I2C_M0_READ_BUF_LEVEL_ADDR +
+					master * 0x100);
+				CAM_ERR(CAM_CCI,
+					"Failed to receive RD_DONE irq rc = %d FIFO buf_lvl:0x%x",
+					rc, val);
+				#ifdef DUMP_CCI_REGISTERS
+					cam_cci_dump_registers(cci_dev,
+						master, queue);
+				#endif
+					cam_cci_flush_queue(cci_dev, master);
+				goto rel_mutex;
+			}
+			break;
+		}
 	}
 
+	CAM_DBG(CAM_CCI, "Burst read successful words_read %d",
+		total_read_words);
+
 rel_mutex:
 	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[queue]);
 	return rc;
@@ -1166,7 +1224,8 @@
 
 	val = 1 << ((master * 2) + queue);
 	cam_io_w_mb(val, base + CCI_QUEUE_START_ADDR);
-	CAM_DBG(CAM_CCI, "wait_for_completion_timeout");
+	CAM_DBG(CAM_CCI,
+		"waiting_for_rd_done [exp_words: %d]", exp_words);
 
 	rc = wait_for_completion_timeout(
 		&cci_dev->cci_master_info[master].reset_complete, CCI_TIMEOUT);
@@ -1200,7 +1259,7 @@
 	index = 0;
 	CAM_DBG(CAM_CCI, "index %d num_type %d", index, read_cfg->num_byte);
 	first_byte = 0;
-	do {
+	while (read_words > 0) {
 		val = cam_io_r_mb(base +
 			CCI_I2C_M0_READ_DATA_ADDR + master * 0x100);
 		CAM_DBG(CAM_CCI, "read val 0x%x", val);
@@ -1217,10 +1276,10 @@
 				index++;
 			}
 		}
-	} while (--read_words > 0);
+		read_words--;
+	}
 rel_mutex:
 	mutex_unlock(&cci_dev->cci_master_info[master].mutex_q[queue]);
-
 	return rc;
 }
 
@@ -1399,23 +1458,34 @@
 	}
 
 	read_bytes = read_cfg->num_byte;
+
+	/*
+	 * To avoid any conflicts due to back to back trigger of
+	 * THRESHOLD irq's, we reinit the threshold wait before
+	 * we load the burst read cmd.
+	 */
+	reinit_completion(&cci_dev->cci_master_info[master].th_complete);
+
+	CAM_DBG(CAM_CCI, "Bytes to read %u", read_bytes);
 	do {
-		if (read_bytes > CCI_I2C_MAX_BYTE_COUNT)
+		if (read_bytes >= CCI_I2C_MAX_BYTE_COUNT)
 			read_cfg->num_byte = CCI_I2C_MAX_BYTE_COUNT;
 		else
 			read_cfg->num_byte = read_bytes;
 
-		if (read_cfg->num_byte > CCI_READ_MAX)
+		if (read_cfg->num_byte >= CCI_READ_MAX) {
+			cci_dev->is_burst_read = true;
 			rc = cam_cci_burst_read(sd, c_ctrl);
-		else
+		} else {
+			cci_dev->is_burst_read = false;
 			rc = cam_cci_read(sd, c_ctrl);
-
+		}
 		if (rc) {
 			CAM_ERR(CAM_CCI, "failed to read rc:%d", rc);
 			goto ERROR;
 		}
 
-		if (read_bytes > CCI_I2C_MAX_BYTE_COUNT) {
+		if (read_bytes >= CCI_I2C_MAX_BYTE_COUNT) {
 			read_cfg->addr += (CCI_I2C_MAX_BYTE_COUNT /
 				read_cfg->data_type);
 			read_cfg->data += CCI_I2C_MAX_BYTE_COUNT;
@@ -1426,6 +1496,7 @@
 	} while (read_bytes);
 
 ERROR:
+	cci_dev->is_burst_read = false;
 	return rc;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c
index ce7ac3f..958737f 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.c
@@ -65,15 +65,12 @@
 		&cci_dev->soc_info;
 	void __iomem *base = soc_info->reg_map[0].mem_base;
 	unsigned long flags;
-	bool burst_read_assert = false;
+	bool rd_done_th_assert = false;
 
 	irq_status0 = cam_io_r_mb(base + CCI_IRQ_STATUS_0_ADDR);
 	irq_status1 = cam_io_r_mb(base + CCI_IRQ_STATUS_1_ADDR);
-	cam_io_w_mb(irq_status0, base + CCI_IRQ_CLEAR_0_ADDR);
-	cam_io_w_mb(irq_status1, base + CCI_IRQ_CLEAR_1_ADDR);
-	cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
-
 	CAM_DBG(CAM_CCI, "irq0:%x irq1:%x", irq_status0, irq_status1);
+
 	if (irq_status0 & CCI_IRQ_STATUS_0_RST_DONE_ACK_BMSK) {
 		if (cci_dev->cci_master_info[MASTER_0].reset_pending == TRUE) {
 			cci_dev->cci_master_info[MASTER_0].reset_pending =
@@ -92,18 +89,23 @@
 	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) &&
 		(irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD)) {
 		cci_dev->cci_master_info[MASTER_0].status = 0;
+		rd_done_th_assert = true;
+		complete(&cci_dev->cci_master_info[MASTER_0].th_complete);
 		complete(&cci_dev->cci_master_info[MASTER_0].reset_complete);
-		burst_read_assert = true;
 	}
 	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK) &&
-		(!burst_read_assert)) {
+		(!rd_done_th_assert)) {
 		cci_dev->cci_master_info[MASTER_0].status = 0;
+		rd_done_th_assert = true;
+		if (cci_dev->is_burst_read)
+			complete(
+			&cci_dev->cci_master_info[MASTER_0].th_complete);
 		complete(&cci_dev->cci_master_info[MASTER_0].reset_complete);
 	}
 	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD) &&
-		(!burst_read_assert)) {
+		(!rd_done_th_assert)) {
 		cci_dev->cci_master_info[MASTER_0].status = 0;
-		complete(&cci_dev->cci_master_info[MASTER_0].reset_complete);
+		complete(&cci_dev->cci_master_info[MASTER_0].th_complete);
 	}
 	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0_REPORT_BMSK) {
 		struct cam_cci_master_info *cci_master_info;
@@ -142,18 +144,23 @@
 	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) &&
 		(irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD)) {
 		cci_dev->cci_master_info[MASTER_1].status = 0;
+		rd_done_th_assert = true;
+		complete(&cci_dev->cci_master_info[MASTER_1].th_complete);
 		complete(&cci_dev->cci_master_info[MASTER_1].reset_complete);
-		burst_read_assert = true;
 	}
 	if ((irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK) &&
-		(!burst_read_assert)) {
+		(!rd_done_th_assert)) {
 		cci_dev->cci_master_info[MASTER_1].status = 0;
+		rd_done_th_assert = true;
+		if (cci_dev->is_burst_read)
+			complete(
+			&cci_dev->cci_master_info[MASTER_1].th_complete);
 		complete(&cci_dev->cci_master_info[MASTER_1].reset_complete);
 	}
 	if ((irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD) &&
-		(!burst_read_assert)) {
+		(!rd_done_th_assert)) {
 		cci_dev->cci_master_info[MASTER_1].status = 0;
-		complete(&cci_dev->cci_master_info[MASTER_1].reset_complete);
+		complete(&cci_dev->cci_master_info[MASTER_1].th_complete);
 	}
 	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M1_Q0_REPORT_BMSK) {
 		struct cam_cci_master_info *cci_master_info;
@@ -189,6 +196,12 @@
 			&cci_dev->cci_master_info[MASTER_1].lock_q[QUEUE_1],
 			flags);
 	}
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M0_RD_PAUSE)
+		CAM_DBG(CAM_CCI, "RD_PAUSE ON MASTER_0");
+
+	if (irq_status1 & CCI_IRQ_STATUS_1_I2C_M1_RD_PAUSE)
+		CAM_DBG(CAM_CCI, "RD_PAUSE ON MASTER_1");
+
 	if (irq_status0 & CCI_IRQ_STATUS_0_I2C_M0_Q0Q1_HALT_ACK_BMSK) {
 		cci_dev->cci_master_info[MASTER_0].reset_pending = TRUE;
 		cam_io_w_mb(CCI_M0_RESET_RMSK,
@@ -211,6 +224,19 @@
 			base + CCI_HALT_REQ_ADDR);
 		CAM_DBG(CAM_CCI, "MASTER_1 error 0x%x", irq_status0);
 	}
+
+	if ((rd_done_th_assert) || (!cci_dev->is_burst_read)) {
+		cam_io_w_mb(irq_status1, base + CCI_IRQ_CLEAR_1_ADDR);
+		CAM_DBG(CAM_CCI, "clear irq_status0:%x irq_status1:%x",
+			irq_status0, irq_status1);
+	} else {
+		spin_lock_irqsave(&cci_dev->lock_status, flags);
+		cci_dev->irq_status1 |= irq_status1;
+		spin_unlock_irqrestore(&cci_dev->lock_status, flags);
+	}
+
+	cam_io_w_mb(irq_status0, base + CCI_IRQ_CLEAR_0_ADDR);
+	cam_io_w_mb(0x1, base + CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR);
 	return IRQ_HANDLED;
 }
 
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.h b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.h
index d48ffd1..aec86ba 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.h
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_dev.h
@@ -137,6 +137,7 @@
 	uint8_t reset_pending;
 	struct mutex mutex;
 	struct completion reset_complete;
+	struct completion th_complete;
 	struct mutex mutex_q[NUM_QUEUES];
 	struct completion report_q[NUM_QUEUES];
 	atomic_t done_pending[NUM_QUEUES];
@@ -192,6 +193,11 @@
  * @cci_wait_sync_cfg: CCI sync config
  * @cycles_per_us: Cycles per micro sec
  * @payload_size: CCI packet payload size
+ * @irq_status1: Store irq_status1 to be cleared after
+ *               draining FIFO buffer for burst read
+ * @lock_status: to protect changes to irq_status1
+ * @is_burst_read: Flag to determine if we are performing
+ *                 a burst read operation or not
  */
 struct cci_device {
 	struct v4l2_subdev subdev;
@@ -216,6 +222,9 @@
 	uint8_t payload_size;
 	char device_name[20];
 	uint32_t cpas_handle;
+	uint32_t irq_status1;
+	spinlock_t lock_status;
+	bool is_burst_read;
 };
 
 enum cam_cci_i2c_cmd_type {
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_hwreg.h b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_hwreg.h
index 31c8e26..65a48e1 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_hwreg.h
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_hwreg.h
@@ -56,15 +56,17 @@
 #define CCI_IRQ_STATUS_0_I2C_M1_Q0_REPORT_BMSK                         0x10000
 #define CCI_IRQ_STATUS_0_I2C_M1_RD_DONE_BMSK                            0x1000
 #define CCI_IRQ_STATUS_1_I2C_M1_RD_THRESHOLD                          0x100000
+#define CCI_IRQ_STATUS_1_I2C_M1_RD_PAUSE                              0x200000
 #define CCI_IRQ_STATUS_0_I2C_M0_Q1_REPORT_BMSK                           0x100
 #define CCI_IRQ_STATUS_0_I2C_M0_Q0_REPORT_BMSK                            0x10
 #define CCI_IRQ_STATUS_0_I2C_M0_ERROR_BMSK                          0x18000EE6
 #define CCI_IRQ_STATUS_0_I2C_M1_ERROR_BMSK                          0x60EE6000
 #define CCI_IRQ_STATUS_0_I2C_M0_RD_DONE_BMSK                               0x1
 #define CCI_IRQ_STATUS_1_I2C_M0_RD_THRESHOLD                           0x10000
+#define CCI_IRQ_STATUS_1_I2C_M0_RD_PAUSE                               0x20000
 #define CCI_I2C_M0_RD_THRESHOLD_ADDR                                0x00000120
 #define CCI_I2C_M1_RD_THRESHOLD_ADDR                                0x00000220
-#define CCI_I2C_RD_THRESHOLD_VALUE                                        0x38
+#define CCI_I2C_RD_THRESHOLD_VALUE                                        0x30
 #define CCI_IRQ_GLOBAL_CLEAR_CMD_ADDR                               0x00000c00
 
 #define DEBUG_TOP_REG_START                                                0x0
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_soc.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_soc.c
index e0b27ca..8c2853b 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_soc.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_cci/cam_cci_soc.c
@@ -199,6 +199,8 @@
 		mutex_init(&new_cci_dev->cci_master_info[i].mutex);
 		init_completion(
 			&new_cci_dev->cci_master_info[i].reset_complete);
+		init_completion(
+			&new_cci_dev->cci_master_info[i].th_complete);
 
 		for (j = 0; j < NUM_QUEUES; j++) {
 			mutex_init(&new_cci_dev->cci_master_info[i].mutex_q[j]);
@@ -208,6 +210,7 @@
 				&new_cci_dev->cci_master_info[i].lock_q[j]);
 		}
 	}
+	spin_lock_init(&new_cci_dev->lock_status);
 }
 
 static void cam_cci_init_default_clk_params(struct cci_device *cci_dev,
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
index bc61df4..2e9aa6c 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_csiphy/cam_csiphy_core.c
@@ -296,12 +296,14 @@
 			continue;
 		}
 
-		settle_cnt = (csiphy_dev->csiphy_info.settle_time / 200000000);
+		settle_cnt = div64_u64(csiphy_dev->csiphy_info.settle_time,
+			200000000);
 		if (csiphy_dev->csiphy_info.combo_mode == 1 &&
 			(lane_pos >= 3))
 			settle_cnt =
-			(csiphy_dev->csiphy_info.settle_time_combo_sensor /
-				200000000);
+				div64_u64(csiphy_dev->csiphy_info.
+					settle_time_combo_sensor,
+					200000000);
 		for (i = 0; i < cfg_size; i++) {
 			switch (reg_array[lane_pos][i].csiphy_param_type) {
 			case CSIPHY_LANE_ENABLE:
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
index 4a9cfb0..e997168 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_flash/cam_flash_core.c
@@ -495,7 +495,6 @@
 				goto apply_setting_err;
 			}
 		} else if (flash_data->opcode == CAM_PKT_NOP_OPCODE) {
-			flash_data->opcode = 0;
 			CAM_DBG(CAM_FLASH, "NOP Packet");
 		} else {
 			rc = -EINVAL;
diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c
index c2d2e5f..0570655 100644
--- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c
+++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_ois/cam_ois_core.c
@@ -662,6 +662,15 @@
 		o_ctrl->bridge_intf.session_hdl = -1;
 	}
 
+	if (o_ctrl->i2c_mode_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_mode_data);
+
+	if (o_ctrl->i2c_calib_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_calib_data);
+
+	if (o_ctrl->i2c_init_data.is_settings_valid == 1)
+		delete_request(&o_ctrl->i2c_init_data);
+
 	kfree(power_info->power_setting);
 	kfree(power_info->power_down_setting);
 	power_info->power_setting = NULL;
@@ -779,6 +788,16 @@
 		power_info->power_down_setting = NULL;
 		power_info->power_down_setting_size = 0;
 		power_info->power_setting_size = 0;
+
+		if (o_ctrl->i2c_mode_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_mode_data);
+
+		if (o_ctrl->i2c_calib_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_calib_data);
+
+		if (o_ctrl->i2c_init_data.is_settings_valid == 1)
+			delete_request(&o_ctrl->i2c_init_data);
+
 		break;
 	case CAM_STOP_DEV:
 		if (o_ctrl->cam_ois_state != CAM_OIS_START) {
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync.c b/drivers/media/platform/msm/camera/cam_sync/cam_sync.c
index e5df874..4525bb5 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync.c
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync.c
@@ -18,9 +18,17 @@
 #include <linux/debugfs.h>
 #include "cam_sync_util.h"
 #include "cam_debug_util.h"
+#include "cam_common_util.h"
 
 struct sync_device *sync_dev;
 
+/*
+ * Flag to determine whether to enqueue cb of a
+ * signaled fence onto the workq or invoke it
+ * directly in the same context
+ */
+static bool trigger_cb_without_switch;
+
 int cam_sync_create(int32_t *sync_obj, const char *name)
 {
 	int rc;
@@ -59,6 +67,7 @@
 	struct sync_callback_info *sync_cb;
 	struct sync_callback_info *cb_info;
 	struct sync_table_row *row = NULL;
+	int status = 0;
 
 	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0 || !cb_func)
 		return -EINVAL;
@@ -95,18 +104,27 @@
 	if ((row->state == CAM_SYNC_STATE_SIGNALED_SUCCESS ||
 		row->state == CAM_SYNC_STATE_SIGNALED_ERROR) &&
 		(!row->remaining)) {
-		sync_cb->callback_func = cb_func;
-		sync_cb->cb_data = userdata;
-		sync_cb->sync_obj = sync_obj;
-		INIT_WORK(&sync_cb->cb_dispatch_work,
-			cam_sync_util_cb_dispatch);
-		sync_cb->status = row->state;
-		CAM_DBG(CAM_SYNC, "Callback trigger for sync object:%d",
-			sync_cb->sync_obj);
-		queue_work(sync_dev->work_queue,
-			&sync_cb->cb_dispatch_work);
+		if (trigger_cb_without_switch) {
+			CAM_DBG(CAM_SYNC, "Invoke callback for sync object:%d",
+				sync_obj);
+			status = row->state;
+			kfree(sync_cb);
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+			cb_func(sync_obj, status, userdata);
+		} else {
+			sync_cb->callback_func = cb_func;
+			sync_cb->cb_data = userdata;
+			sync_cb->sync_obj = sync_obj;
+			INIT_WORK(&sync_cb->cb_dispatch_work,
+				cam_sync_util_cb_dispatch);
+			sync_cb->status = row->state;
+			CAM_DBG(CAM_SYNC, "Enqueue callback for sync object:%d",
+				sync_cb->sync_obj);
+			queue_work(sync_dev->work_queue,
+				&sync_cb->cb_dispatch_work);
+			spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
+		}
 
-		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
 		return 0;
 	}
 
@@ -158,19 +176,11 @@
 
 int cam_sync_signal(int32_t sync_obj, uint32_t status)
 {
-	int rc;
 	struct sync_table_row *row = NULL;
 	struct sync_table_row *parent_row = NULL;
-	struct sync_callback_info *sync_cb;
-	struct sync_user_payload *payload_info;
-	struct sync_parent_info *parent_info;
-	struct list_head sync_list;
-	struct cam_signalable_info *list_info = NULL;
-	struct cam_signalable_info *temp_list_info = NULL;
+	struct sync_parent_info *parent_info, *temp_parent_info;
 	struct list_head parents_list;
-
-	/* Objects to be signaled will be added into this list */
-	INIT_LIST_HEAD(&sync_list);
+	int rc = 0;
 
 	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0) {
 		CAM_ERR(CAM_SYNC, "Error: Out of range sync obj (0 <= %d < %d)",
@@ -212,29 +222,28 @@
 		return -EINVAL;
 	}
 
-	row->state = status;
-	rc = cam_sync_util_add_to_signalable_list(sync_obj, status, &sync_list);
-	if (rc < 0) {
+	if (!atomic_dec_and_test(&row->ref_cnt)) {
 		spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
-		CAM_ERR(CAM_SYNC,
-			"Error: Unable to add sync object :%d to signalable list",
-			sync_obj);
-		return rc;
+		return 0;
 	}
 
+	row->state = status;
+	cam_sync_util_dispatch_signaled_cb(sync_obj, status);
+
 	/* copy parent list to local and release child lock */
 	INIT_LIST_HEAD(&parents_list);
 	list_splice_init(&row->parents_list, &parents_list);
 	spin_unlock_bh(&sync_dev->row_spinlocks[sync_obj]);
 
 	if (list_empty(&parents_list))
-		goto dispatch_cb;
+		return 0;
 
 	/*
 	 * Now iterate over all parents of this object and if they too need to
-	 * be signaled add them to the list
+	 * be signaled dispatch cb's
 	 */
-	list_for_each_entry(parent_info,
+	list_for_each_entry_safe(parent_info,
+		temp_parent_info,
 		&parents_list,
 		list) {
 		parent_row = sync_dev->sync_table + parent_info->sync_id;
@@ -253,93 +262,16 @@
 			continue;
 		}
 
-		if (!parent_row->remaining) {
-			rc = cam_sync_util_add_to_signalable_list
-				(parent_info->sync_id,
-					parent_row->state,
-					&sync_list);
-			if (rc < 0) {
-				spin_unlock_bh(
-					&sync_dev->row_spinlocks[
-						parent_info->sync_id]);
-				continue;
-			}
-		}
+		if (!parent_row->remaining)
+			cam_sync_util_dispatch_signaled_cb(
+				parent_info->sync_id, parent_row->state);
+
 		spin_unlock_bh(&sync_dev->row_spinlocks[parent_info->sync_id]);
+		list_del_init(&parent_info->list);
+		kfree(parent_info);
 	}
 
-dispatch_cb:
-
-	/*
-	 * Now dispatch the various sync objects collected so far, in our
-	 * list
-	 */
-	list_for_each_entry_safe(list_info,
-		temp_list_info,
-		&sync_list,
-		list) {
-		struct sync_table_row *signalable_row = NULL;
-		struct sync_callback_info *temp_sync_cb;
-		struct sync_user_payload *temp_payload_info;
-
-		signalable_row = sync_dev->sync_table + list_info->sync_obj;
-
-		spin_lock_bh(&sync_dev->row_spinlocks[list_info->sync_obj]);
-		if (signalable_row->state == CAM_SYNC_STATE_INVALID) {
-			spin_unlock_bh(
-				&sync_dev->row_spinlocks[list_info->sync_obj]);
-			continue;
-		}
-
-		/* Dispatch kernel callbacks if any were registered earlier */
-
-		list_for_each_entry_safe(sync_cb,
-			temp_sync_cb, &signalable_row->callback_list, list) {
-			sync_cb->status = list_info->status;
-			list_del_init(&sync_cb->list);
-			queue_work(sync_dev->work_queue,
-				&sync_cb->cb_dispatch_work);
-		}
-
-		/* Dispatch user payloads if any were registered earlier */
-		list_for_each_entry_safe(payload_info, temp_payload_info,
-			&signalable_row->user_payload_list, list) {
-			spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
-			if (!sync_dev->cam_sync_eventq) {
-				spin_unlock_bh(
-				&sync_dev->cam_sync_eventq_lock);
-				break;
-			}
-			spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
-			cam_sync_util_send_v4l2_event(
-				CAM_SYNC_V4L_EVENT_ID_CB_TRIG,
-				list_info->sync_obj,
-				list_info->status,
-				payload_info->payload_data,
-				CAM_SYNC_PAYLOAD_WORDS * sizeof(__u64));
-
-			list_del_init(&payload_info->list);
-			/*
-			 * We can free the list node here because
-			 * sending V4L event will make a deep copy
-			 * anyway
-			 */
-			kfree(payload_info);
-		}
-
-		/*
-		 * This needs to be done because we want to unblock anyone
-		 * who might be blocked and waiting on this sync object
-		 */
-		complete_all(&signalable_row->signaled);
-
-		spin_unlock_bh(&sync_dev->row_spinlocks[list_info->sync_obj]);
-
-		list_del_init(&list_info->list);
-		kfree(list_info);
-	}
-
-	return rc;
+	return 0;
 }
 
 int cam_sync_merge(int32_t *sync_obj, uint32_t num_objs, int32_t *merged_obj)
@@ -358,6 +290,12 @@
 		return -EINVAL;
 	}
 
+	if (cam_common_util_remove_duplicate_arr(sync_obj, num_objs)
+		!= num_objs) {
+		CAM_ERR(CAM_SYNC, "The obj list has duplicate fence");
+		return -EINVAL;
+	}
+
 	do {
 		idx = find_first_zero_bit(sync_dev->bitmap, CAM_SYNC_MAX_OBJS);
 		if (idx >= CAM_SYNC_MAX_OBJS)
@@ -383,6 +321,46 @@
 	return 0;
 }
 
+int cam_sync_get_obj_ref(int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)
+		return -EINVAL;
+
+	row = sync_dev->sync_table + sync_obj;
+
+	spin_lock(&sync_dev->row_spinlocks[sync_obj]);
+
+	if (row->state != CAM_SYNC_STATE_ACTIVE) {
+		spin_unlock(&sync_dev->row_spinlocks[sync_obj]);
+		CAM_ERR(CAM_SYNC,
+			"Error: accessing an uninitialized sync obj = %d",
+			sync_obj);
+		return -EINVAL;
+	}
+
+	atomic_inc(&row->ref_cnt);
+	spin_unlock(&sync_dev->row_spinlocks[sync_obj]);
+	CAM_DBG(CAM_SYNC, "get ref for obj %d", sync_obj);
+
+	return 0;
+}
+
+int cam_sync_put_obj_ref(int32_t sync_obj)
+{
+	struct sync_table_row *row = NULL;
+
+	if (sync_obj >= CAM_SYNC_MAX_OBJS || sync_obj <= 0)
+		return -EINVAL;
+
+	row = sync_dev->sync_table + sync_obj;
+	atomic_dec(&row->ref_cnt);
+	CAM_DBG(CAM_SYNC, "put ref for obj %d", sync_obj);
+
+	return 0;
+}
+
 int cam_sync_destroy(int32_t sync_obj)
 {
 	CAM_DBG(CAM_SYNC, "sync_obj: %i", sync_obj);
@@ -479,6 +457,8 @@
 		k_ioctl->size))
 		return -EFAULT;
 
+	/* need to get ref for UMD signaled fences */
+	cam_sync_get_obj_ref(sync_signal.sync_obj);
 	return cam_sync_signal(sync_signal.sync_obj,
 		sync_signal.sync_state);
 }
@@ -965,6 +945,26 @@
 }
 #endif
 
+static int cam_sync_create_debugfs(void)
+{
+	sync_dev->dentry = debugfs_create_dir("camera_sync", NULL);
+
+	if (!sync_dev->dentry) {
+		CAM_ERR(CAM_SYNC, "Failed to create sync dir");
+		return -ENOMEM;
+	}
+
+	if (!debugfs_create_bool("trigger_cb_without_switch",
+		0644, sync_dev->dentry,
+		&trigger_cb_without_switch)) {
+		CAM_ERR(CAM_SYNC,
+			"failed to create trigger_cb_without_switch entry");
+		return -ENOMEM;
+	}
+
+	return 0;
+}
+
 static int cam_sync_probe(struct platform_device *pdev)
 {
 	int rc;
@@ -1030,6 +1030,9 @@
 		goto v4l2_fail;
 	}
 
+	trigger_cb_without_switch = false;
+	cam_sync_create_debugfs();
+
 	return rc;
 
 v4l2_fail:
@@ -1049,6 +1052,8 @@
 	v4l2_device_unregister(sync_dev->vdev->v4l2_dev);
 	cam_sync_media_controller_cleanup(sync_dev);
 	video_device_release(sync_dev->vdev);
+	debugfs_remove_recursive(sync_dev->dentry);
+	sync_dev->dentry = NULL;
 	kfree(sync_dev);
 	sync_dev = NULL;
 
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync_api.h b/drivers/media/platform/msm/camera/cam_sync/cam_sync_api.h
index 9646887..c735d51 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync_api.h
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync_api.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -101,6 +101,29 @@
 int cam_sync_merge(int32_t *sync_obj, uint32_t num_objs, int32_t *merged_obj);
 
 /**
+ * @brief: get ref count of sync obj
+ *
+ * This function will increment ref count for the sync object, and the ref
+ * count will be decremented when this sync object is signaled.
+ *
+ * @param sync_obj: sync object
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_get_obj_ref(int32_t sync_obj);
+
+/**
+ * @brief: put ref count of sync obj
+ *
+ * This function will decrement ref count for the sync object.
+ *
+ * @param sync_obj: sync object
+ *
+ * @return Status of operation. Negative in case of error. Zero otherwise.
+ */
+int cam_sync_put_obj_ref(int32_t sync_obj);
+
+/**
  * @brief: Destroys a sync object
  *
  * @param sync_obj: int referencing the sync object to be destroyed
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync_private.h b/drivers/media/platform/msm/camera/cam_sync/cam_sync_private.h
index 5ae707a..eb2fb34 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync_private.h
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync_private.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -17,6 +17,7 @@
 #include <linux/videodev2.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
+#include <linux/debugfs.h>
 #include <media/v4l2-fh.h>
 #include <media/v4l2-device.h>
 #include <media/v4l2-subdev.h>
@@ -138,6 +139,7 @@
  * @signaled          : Completion variable on which block calls will wait
  * @callback_list     : Linked list of kernel callbacks registered
  * @user_payload_list : LInked list of user space payloads registered
+ * @ref_cnt           : ref count of the number of usage of the fence.
  */
 struct sync_table_row {
 	char name[CAM_SYNC_OBJ_NAME_LEN];
@@ -152,6 +154,7 @@
 	struct completion signaled;
 	struct list_head callback_list;
 	struct list_head user_payload_list;
+	atomic_t ref_cnt;
 };
 
 /**
@@ -177,6 +180,7 @@
  * @row_spinlocks   : Spinlock array, one for each row in the table
  * @table_lock      : Mutex used to lock the table
  * @open_cnt        : Count of file open calls made on the sync driver
+ * @dentry          : Debugfs entry
  * @work_queue      : Work queue used for dispatching kernel callbacks
  * @cam_sync_eventq : Event queue used to dispatch user payloads to user space
  * @bitmap          : Bitmap representation of all sync objects
@@ -188,6 +192,7 @@
 	spinlock_t row_spinlocks[CAM_SYNC_MAX_OBJS];
 	struct mutex table_lock;
 	int open_cnt;
+	struct dentry *dentry;
 	struct workqueue_struct *work_queue;
 	struct v4l2_fh *cam_sync_eventq;
 	spinlock_t cam_sync_eventq_lock;
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.c b/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.c
index f391c8c..0a05918 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.c
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.c
@@ -49,6 +49,7 @@
 	row->sync_id = idx;
 	row->state = CAM_SYNC_STATE_ACTIVE;
 	row->remaining = 0;
+	atomic_set(&row->ref_cnt, 0);
 	init_completion(&row->signaled);
 	INIT_LIST_HEAD(&row->callback_list);
 	INIT_LIST_HEAD(&row->user_payload_list);
@@ -175,6 +176,12 @@
 			idx);
 		return -EINVAL;
 	}
+
+	if (row->state == CAM_SYNC_STATE_ACTIVE)
+		CAM_WARN(CAM_SYNC,
+			"Destroying an active sync object name:%s id:%i",
+			row->name, row->sync_id);
+
 	row->state = CAM_SYNC_STATE_INVALID;
 
 	/* Object's child and parent objects will be added into this list */
@@ -217,6 +224,11 @@
 			continue;
 		}
 
+		if (child_row->state == CAM_SYNC_STATE_ACTIVE)
+			CAM_WARN(CAM_SYNC,
+				"Warning: destroying active child sync obj = %d",
+				child_info->sync_id);
+
 		cam_sync_util_cleanup_parents_list(child_row,
 			SYNC_LIST_CLEAN_ONE, idx);
 
@@ -241,6 +253,11 @@
 			continue;
 		}
 
+		if (parent_row->state == CAM_SYNC_STATE_ACTIVE)
+			CAM_WARN(CAM_SYNC,
+				"Warning: destroying active parent sync obj = %d",
+				parent_info->sync_id);
+
 		cam_sync_util_cleanup_children_list(parent_row,
 			SYNC_LIST_CLEAN_ONE, idx);
 
@@ -287,6 +304,64 @@
 	kfree(cb_info);
 }
 
+void cam_sync_util_dispatch_signaled_cb(int32_t sync_obj,
+	uint32_t status)
+{
+	struct sync_callback_info  *sync_cb;
+	struct sync_user_payload   *payload_info;
+	struct sync_callback_info  *temp_sync_cb;
+	struct sync_table_row      *signalable_row;
+	struct sync_user_payload   *temp_payload_info;
+
+	signalable_row = sync_dev->sync_table + sync_obj;
+	if (signalable_row->state == CAM_SYNC_STATE_INVALID) {
+		CAM_DBG(CAM_SYNC,
+			"Accessing invalid sync object:%i", sync_obj);
+		return;
+	}
+
+	/* Dispatch kernel callbacks if any were registered earlier */
+	list_for_each_entry_safe(sync_cb,
+		temp_sync_cb, &signalable_row->callback_list, list) {
+		sync_cb->status = status;
+		list_del_init(&sync_cb->list);
+		queue_work(sync_dev->work_queue,
+			&sync_cb->cb_dispatch_work);
+	}
+
+	/* Dispatch user payloads if any were registered earlier */
+	list_for_each_entry_safe(payload_info, temp_payload_info,
+		&signalable_row->user_payload_list, list) {
+		spin_lock_bh(&sync_dev->cam_sync_eventq_lock);
+		if (!sync_dev->cam_sync_eventq) {
+			spin_unlock_bh(
+				&sync_dev->cam_sync_eventq_lock);
+			break;
+		}
+		spin_unlock_bh(&sync_dev->cam_sync_eventq_lock);
+		cam_sync_util_send_v4l2_event(
+			CAM_SYNC_V4L_EVENT_ID_CB_TRIG,
+			sync_obj,
+			status,
+			payload_info->payload_data,
+			CAM_SYNC_PAYLOAD_WORDS * sizeof(__u64));
+
+		list_del_init(&payload_info->list);
+		/*
+		 * We can free the list node here because
+		 * sending V4L event will make a deep copy
+		 * anyway
+		 */
+		 kfree(payload_info);
+	}
+
+	/*
+	 * This needs to be done because we want to unblock anyone
+	 * who might be blocked and waiting on this sync object
+	 */
+	complete_all(&signalable_row->signaled);
+}
+
 void cam_sync_util_send_v4l2_event(uint32_t id,
 	uint32_t sync_obj,
 	int status,
@@ -312,26 +387,6 @@
 		sync_obj);
 }
 
-int cam_sync_util_add_to_signalable_list(int32_t sync_obj,
-	uint32_t status,
-	struct list_head *sync_list)
-{
-	struct cam_signalable_info *signalable_info = NULL;
-
-	signalable_info = kzalloc(sizeof(*signalable_info), GFP_ATOMIC);
-	if (!signalable_info)
-		return -ENOMEM;
-
-	signalable_info->sync_obj = sync_obj;
-	signalable_info->status = status;
-
-	list_add_tail(&signalable_info->list, sync_list);
-	CAM_DBG(CAM_SYNC, "Add sync_obj :%d with status :%d to signalable list",
-		sync_obj, status);
-
-	return 0;
-}
-
 int cam_sync_util_update_parent_state(struct sync_table_row *parent_row,
 	int new_state)
 {
diff --git a/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.h b/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.h
index a9d6f86..cfa450c 100644
--- a/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.h
+++ b/drivers/media/platform/msm/camera/cam_sync/cam_sync_util.h
@@ -87,6 +87,17 @@
 void cam_sync_util_cb_dispatch(struct work_struct *cb_dispatch_work);
 
 /**
+ * @brief: Function to dispatch callbacks for a signaled sync object
+ *
+ * @sync_obj : Sync object that is signaled
+ * @status   : Status of the signaled object
+ *
+ * @return None
+ */
+void cam_sync_util_dispatch_signaled_cb(int32_t sync_obj,
+	uint32_t status);
+
+/**
  * @brief: Function to send V4L event to user space
  * @param id       : V4L event id to send
  * @param sync_obj : Sync obj for which event needs to be sent
@@ -103,19 +114,6 @@
 	int len);
 
 /**
- * @brief: Function which adds sync object information to the signalable list
- *
- * @param sync_obj : Sync object to add
- * @param status   : Status of above sync object
- * @param list     : Linked list where the information should be added to
- *
- * @return Status of operation. Negative in case of error. Zero otherwise.
- */
-int cam_sync_util_add_to_signalable_list(int32_t sync_obj,
-	uint32_t status,
-	struct list_head *sync_list);
-
-/**
  * @brief: Function which gets the next state of the sync object based on the
  *         current state and the new state
  *
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_common_util.c b/drivers/media/platform/msm/camera/cam_utils/cam_common_util.c
index 199d3ea..bba12cf 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_common_util.c
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_common_util.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -33,3 +33,25 @@
 
 	return -EINVAL;
 }
+
+uint32_t cam_common_util_remove_duplicate_arr(int32_t *arr, uint32_t num)
+{
+	int i, j;
+	uint32_t wr_idx = 1;
+
+	if (!arr) {
+		CAM_ERR(CAM_UTIL, "Null input array");
+		return 0;
+	}
+
+	for (i = 1; i < num; i++) {
+		for (j = 0; j < wr_idx ; j++) {
+			if (arr[i] == arr[j])
+				break;
+		}
+		if (j == wr_idx)
+			arr[wr_idx++] = arr[i];
+	}
+
+	return wr_idx;
+}
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_common_util.h b/drivers/media/platform/msm/camera/cam_utils/cam_common_util.h
index d6a11b7..3e1281b 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_common_util.h
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_common_util.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -32,4 +32,18 @@
 int cam_common_util_get_string_index(const char **strings,
 	uint32_t num_strings, char *matching_string, uint32_t *index);
 
+/**
+ * cam_common_util_remove_duplicate_arr()
+ *
+ * @brief                  Move all the unique integers to the start of
+ *                         the array and return the number of unique integers
+ *
+ * @array:                 Pointer to the first integer of array
+ * @num:                   Number of elements in array
+ *
+ * @return:                Number of unique integers in array
+ */
+uint32_t cam_common_util_remove_duplicate_arr(int32_t *array,
+	uint32_t num);
+
 #endif /* _CAM_COMMON_UTIL_H_ */
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_debug_util.h b/drivers/media/platform/msm/camera/cam_utils/cam_debug_util.h
index 1ed7056..9093517 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_debug_util.h
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_debug_util.h
@@ -106,9 +106,22 @@
 #define CAM_INFO(__module, fmt, args...)                           \
 	pr_info("CAM_INFO: %s: %s: %d " fmt "\n",                     \
 		cam_get_module_name(__module), __func__,  __LINE__, ##args)
+
+/*
+ * CAM_INFO_RATE_LIMIT
+ * @brief    :  This Macro will print info logs with ratelimit
+ *
+ * @__module :  Respective module id which is been calling this Macro
+ * @fmt      :  Formatted string which needs to be print in log
+ * @args     :  Arguments which needs to be print in log
+ */
+#define CAM_INFO_RATE_LIMIT(__module, fmt, args...)                 \
+	pr_err_ratelimited("CAM_INFO: %s: %s: %d " fmt "\n",            \
+		cam_get_module_name(__module), __func__,  __LINE__, ##args)
+
 /*
  * CAM_DBG
- * @brief :     This Macro will print debug logs when enabled using GROUP
+ * @brief    :  This Macro will print debug logs when enabled using GROUP
  *
  * @__module :  Respective module id which is been calling this Macro
  * @fmt      :  Formatted string which needs to be print in log
@@ -119,7 +132,7 @@
 
 /*
  * CAM_ERR_RATE_LIMIT
- * @brief :     This Macro will prevent error print logs with ratelimit
+ * @brief    :  This Macro will print error print logs with ratelimit
  */
 #define CAM_ERR_RATE_LIMIT(__module, fmt, args...)                 \
 	pr_err_ratelimited("CAM_ERR: %s: %s: %d " fmt "\n",            \
diff --git a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
index db2629d..a88ccdb 100644
--- a/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
+++ b/drivers/media/platform/msm/camera/cam_utils/cam_packet_util.c
@@ -127,7 +127,7 @@
 	int32_t iommu_hdl, int32_t sec_mmu_hdl)
 {
 	struct cam_patch_desc *patch_desc = NULL;
-	uint64_t   iova_addr;
+	dma_addr_t iova_addr;
 	uint64_t   cpu_addr;
 	uint32_t   temp;
 	uint32_t  *dst_cpu_addr;
diff --git a/drivers/media/platform/msm/camera_v2/camera/camera.c b/drivers/media/platform/msm/camera_v2/camera/camera.c
index 01ee5d4..1da62e2 100644
--- a/drivers/media/platform/msm/camera_v2/camera/camera.c
+++ b/drivers/media/platform/msm/camera_v2/camera/camera.c
@@ -688,8 +688,6 @@
 			if (rc < 0)
 				goto post_fail;
 		}
-		/* Enable power collapse latency */
-		msm_pm_qos_update_request(CAMERA_ENABLE_PC_LATENCY);
 	} else {
 		rc = msm_create_command_ack_q(pvdev->vdev->num,
 			find_first_zero_bit((const unsigned long *)&opn_idx,
@@ -713,6 +711,7 @@
 command_ack_q_fail:
 	msm_destroy_session(pvdev->vdev->num);
 session_fail:
+	msm_pm_qos_update_request(CAMERA_ENABLE_PC_LATENCY);
 	pm_relax(&pvdev->vdev->dev);
 stream_fail:
 	camera_v4l2_vb2_q_release(filep);
@@ -786,6 +785,8 @@
 		camera_v4l2_vb2_q_release(filep);
 		msm_destroy_session(pvdev->vdev->num);
 
+		/* Enable power collapse latency */
+		msm_pm_qos_update_request(CAMERA_ENABLE_PC_LATENCY);
 		pm_relax(&pvdev->vdev->dev);
 	} else {
 		msm_delete_command_ack_q(pvdev->vdev->num,
@@ -933,6 +934,7 @@
 	pvdev->vdev->ioctl_ops = &camera_v4l2_ioctl_ops;
 	pvdev->vdev->minor     = -1;
 	pvdev->vdev->vfl_type  = VFL_TYPE_GRABBER;
+	pvdev->vdev->device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_STREAMING;
 	rc = video_register_device(pvdev->vdev,
 		VFL_TYPE_GRABBER, -1);
 	if (WARN_ON(rc < 0))
diff --git a/drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.h b/drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.h
index 77809d2..a9bc575 100644
--- a/drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.h
+++ b/drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.h
@@ -22,6 +22,8 @@
 #include <media/msm_cam_sensor.h>
 #include <media/v4l2-ioctl.h>
 
+#include <media/adsp-shmem-device.h>
+
 #define NO_SET_RATE -1
 #define INIT_RATE -2
 
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp.c
index cfe8054..7c55ad8 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp.c
@@ -691,7 +691,8 @@
 	spin_lock_init(&vfe_dev->shared_data_lock);
 	spin_lock_init(&vfe_dev->reg_update_lock);
 	spin_lock_init(&req_history_lock);
-	spin_lock_init(&vfe_dev->completion_lock);
+	spin_lock_init(&vfe_dev->reset_completion_lock);
+	spin_lock_init(&vfe_dev->halt_completion_lock);
 	media_entity_pads_init(&vfe_dev->subdev.sd.entity, 0, NULL);
 	vfe_dev->subdev.sd.entity.function = MSM_CAMERA_SUBDEV_VFE;
 	//vfe_dev->subdev.sd.entity.group_id = MSM_CAMERA_SUBDEV_VFE;
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp.h b/drivers/media/platform/msm/camera_v2/isp/msm_isp.h
index f560e83..4f97618 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp.h
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp.h
@@ -27,6 +27,7 @@
 #include "msm_buf_mgr.h"
 #include "cam_hw_ops.h"
 #include <soc/qcom/cx_ipeak.h>
+#include <media/adsp-shmem-device.h>
 
 #define VFE40_8974V1_VERSION 0x10000018
 #define VFE40_8974V2_VERSION 0x1001001A
@@ -802,7 +803,8 @@
 	struct mutex core_mutex;
 	spinlock_t shared_data_lock;
 	spinlock_t reg_update_lock;
-	spinlock_t completion_lock;
+	spinlock_t reset_completion_lock;
+	spinlock_t halt_completion_lock;
 
 	/* Tasklet info */
 	atomic_t irq_cnt;
@@ -860,4 +862,15 @@
 };
 int vfe_hw_probe(struct platform_device *pdev);
 void msm_isp_update_last_overflow_ab_ib(struct vfe_device *vfe_dev);
+
+/* Returning true means the VFE is still used from ADSP side */
+static inline bool vfe_used_by_adsp(struct vfe_device *vfe_dev)
+{
+	if (vfe_dev->pdev->id == ADSP_VFE &&
+		adsp_shmem_get_state() != CAMERA_STATUS_END)
+		return true;
+
+	return false;
+}
+
 #endif
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp40.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp40.c
index 72ab3ba..c5c05d2 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp40.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp40.c
@@ -305,6 +305,9 @@
 	struct msm_vfe_hw_init_parms vbif_parms;
 	struct msm_vfe_hw_init_parms ds_parms;
 
+	if (vfe_used_by_adsp(vfe_dev))
+		return;
+
 	qos_parms.entries = "qos-entries";
 	qos_parms.regs = "qos-regs";
 	qos_parms.settings = "qos-settings";
@@ -363,15 +366,24 @@
 static void msm_vfe40_process_reset_irq(struct vfe_device *vfe_dev,
 	uint32_t irq_status0, uint32_t irq_status1)
 {
-	if (irq_status0 & (1 << 31))
+	unsigned long flags;
+
+	if (irq_status0 & (1 << 31)) {
+		spin_lock_irqsave(&vfe_dev->reset_completion_lock, flags);
 		complete(&vfe_dev->reset_complete);
+		spin_unlock_irqrestore(&vfe_dev->reset_completion_lock, flags);
+	}
 }
 
 static void msm_vfe40_process_halt_irq(struct vfe_device *vfe_dev,
 	uint32_t irq_status0, uint32_t irq_status1)
 {
+	unsigned long flags;
+
 	if (irq_status1 & (1 << 8)) {
+		spin_lock_irqsave(&vfe_dev->halt_completion_lock, flags);
 		complete(&vfe_dev->halt_complete);
+		spin_unlock_irqrestore(&vfe_dev->halt_completion_lock, flags);
 		msm_camera_io_w(0x0, vfe_dev->vfe_base + 0x2C0);
 	}
 }
@@ -761,8 +773,14 @@
 	uint32_t first_start, uint32_t blocking_call)
 {
 	long rc = 0;
+	unsigned long flags;
 
+	spin_lock_irqsave(&vfe_dev->reset_completion_lock, flags);
 	init_completion(&vfe_dev->reset_complete);
+	spin_unlock_irqrestore(&vfe_dev->reset_completion_lock, flags);
+
+	if (vfe_used_by_adsp(vfe_dev))
+		return msecs_to_jiffies(50);
 
 	if (first_start) {
 		msm_camera_io_w_mb(0x1FF, vfe_dev->vfe_base + 0xC);
@@ -1777,6 +1795,10 @@
 	int rc = 0;
 	enum msm_vfe_input_src i;
 	struct msm_isp_timestamp ts;
+	unsigned long flags;
+
+	if (vfe_used_by_adsp(vfe_dev))
+		return msecs_to_jiffies(50);
 
 	/* Keep only halt and restart mask */
 	msm_vfe40_config_irq(vfe_dev, (1 << 31), (1 << 8),
@@ -1793,7 +1815,9 @@
 	msm_isp_stats_stream_update(vfe_dev);
 
 	if (blocking) {
+		spin_lock_irqsave(&vfe_dev->halt_completion_lock, flags);
 		init_completion(&vfe_dev->halt_complete);
+		spin_unlock_irqrestore(&vfe_dev->halt_completion_lock, flags);
 		/* Halt AXI Bus Bridge */
 		msm_camera_io_w_mb(0x1, vfe_dev->vfe_base + 0x2C0);
 		rc = wait_for_completion_interruptible_timeout(
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c
index b867eb3..75d09a3 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c
@@ -311,6 +311,9 @@
 	int rc = -1;
 	enum cam_ahb_clk_client id;
 
+	if (vfe_used_by_adsp(vfe_dev))
+		return msecs_to_jiffies(50);
+
 	if (vfe_dev->pdev->id == 0)
 		id = CAM_AHB_CLIENT_VFE0;
 	else
@@ -440,10 +443,10 @@
 	unsigned long flags;
 
 	if (irq_status0 & (1 << 31)) {
-		spin_lock_irqsave(&vfe_dev->completion_lock, flags);
+		spin_lock_irqsave(&vfe_dev->reset_completion_lock, flags);
 		complete(&vfe_dev->reset_complete);
 		vfe_dev->reset_pending = 0;
-		spin_unlock_irqrestore(&vfe_dev->completion_lock, flags);
+		spin_unlock_irqrestore(&vfe_dev->reset_completion_lock, flags);
 	}
 }
 
@@ -451,9 +454,12 @@
 	uint32_t irq_status0, uint32_t irq_status1)
 {
 	uint32_t val = 0;
+	unsigned long flags;
 
 	if (irq_status1 & (1 << 8)) {
+		spin_lock_irqsave(&vfe_dev->halt_completion_lock, flags);
 		complete(&vfe_dev->halt_complete);
+		spin_unlock_irqrestore(&vfe_dev->halt_completion_lock, flags);
 		msm_camera_io_w(0x0, vfe_dev->vfe_base + 0x400);
 	}
 
@@ -770,9 +776,9 @@
 	uint32_t reset;
 	unsigned long flags;
 
-	spin_lock_irqsave(&vfe_dev->completion_lock, flags);
+	spin_lock_irqsave(&vfe_dev->reset_completion_lock, flags);
 	init_completion(&vfe_dev->reset_complete);
-	spin_unlock_irqrestore(&vfe_dev->completion_lock, flags);
+	spin_unlock_irqrestore(&vfe_dev->reset_completion_lock, flags);
 
 	if (blocking_call)
 		vfe_dev->reset_pending = 1;
@@ -2002,6 +2008,7 @@
 	enum msm_vfe_input_src i;
 	uint32_t val = 0;
 	struct msm_isp_timestamp ts;
+	unsigned long flags;
 
 	val = msm_camera_io_r(vfe_dev->vfe_vbif_base + VFE47_VBIF_CLK_OFFSET);
 	val |= 0x1;
@@ -2018,7 +2025,9 @@
 			__func__, vfe_dev->pdev->id, blocking);
 
 	if (blocking) {
+		spin_lock_irqsave(&vfe_dev->halt_completion_lock, flags);
 		init_completion(&vfe_dev->halt_complete);
+		spin_unlock_irqrestore(&vfe_dev->halt_completion_lock, flags);
 		/* Halt AXI Bus Bridge */
 		msm_camera_io_w_mb(0x1, vfe_dev->vfe_base + 0x400);
 		rc = wait_for_completion_interruptible_timeout(
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
index 3832d63..1b04e1d 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
@@ -1739,12 +1739,40 @@
 	struct msm_vfe_axi_halt_cmd halt_cmd;
 	struct vfe_device *temp_dev = NULL;
 	uint32_t irq_status0 = 0, irq_status1 = 0;
+	struct vfe_device *vfe_dev_other = NULL;
+	uint32_t vfe_id_other = 0;
+	unsigned long flags;
 
 	if (atomic_read(&vfe_dev->error_info.overflow_state) !=
 		NO_OVERFLOW)
 		/* Recovery is already in Progress */
 		return;
 
+	/* if there are no active streams - do not start recovery */
+	if (vfe_dev->is_split) {
+		if (vfe_dev->pdev->id == ISP_VFE0)
+			vfe_id_other = ISP_VFE1;
+		else
+			vfe_id_other = ISP_VFE0;
+
+		spin_lock_irqsave(
+			&vfe_dev->common_data->common_dev_data_lock, flags);
+		vfe_dev_other = vfe_dev->common_data->dual_vfe_res->
+			vfe_dev[vfe_id_other];
+		if (!vfe_dev->axi_data.num_active_stream ||
+			!vfe_dev_other->axi_data.num_active_stream) {
+			spin_unlock_irqrestore(
+				&vfe_dev->common_data->common_dev_data_lock,
+				flags);
+			pr_err("%s:skip the recovery as no active streams\n",
+				 __func__);
+			return;
+		}
+		spin_unlock_irqrestore(
+			&vfe_dev->common_data->common_dev_data_lock, flags);
+	} else if (!vfe_dev->axi_data.num_active_stream)
+		return;
+
 	if (event == ISP_EVENT_PING_PONG_MISMATCH &&
 		vfe_dev->axi_data.recovery_count < MAX_RECOVERY_THRESHOLD) {
 		pr_err("%s: ping pong mismatch on vfe%d recovery count %d\n",
diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
index e671122..431609f 100644
--- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
+++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
@@ -1037,6 +1037,17 @@
 		break;
 	case VIDIOC_MSM_ISP_SMMU_ATTACH:
 		mutex_lock(&vfe_dev->core_mutex);
+		if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+			pr_debug("Stop adsp camera\n");  /* execute stop cmd */
+			wmb(); /* sync memory access with ADSP */
+			adsp_shmem_set_state(CAMERA_STATUS_STOP);
+			wmb(); /* sync memory access with ADSP */
+			usleep_range(1000, 1100);
+			rmb(); /* sync memory access with ADSP */
+			while (adsp_shmem_get_state() != CAMERA_STATUS_END)
+				rmb(); /* sync memory access with ADSP */
+		}
+
 		rc = msm_isp_smmu_attach(vfe_dev->buf_mgr, arg);
 		mutex_unlock(&vfe_dev->core_mutex);
 		break;
@@ -2328,7 +2339,8 @@
 	memset(&vfe_dev->error_info, 0, sizeof(vfe_dev->error_info));
 	atomic_set(&vfe_dev->error_info.overflow_state, NO_OVERFLOW);
 
-	vfe_dev->hw_info->vfe_ops.core_ops.clear_status_reg(vfe_dev);
+	if (!vfe_used_by_adsp(vfe_dev))
+		vfe_dev->hw_info->vfe_ops.core_ops.clear_status_reg(vfe_dev);
 
 	vfe_dev->vfe_hw_version = msm_camera_io_r(vfe_dev->vfe_base);
 	ISP_DBG("%s: HW Version: 0x%x\n", __func__, vfe_dev->vfe_hw_version);
@@ -2422,18 +2434,22 @@
 	if (rc <= 0)
 		pr_err("%s: halt timeout rc=%ld\n", __func__, rc);
 
-	vfe_dev->hw_info->vfe_ops.core_ops.
+	if (!vfe_used_by_adsp(vfe_dev)) {
+		vfe_dev->hw_info->vfe_ops.core_ops.
 		update_camif_state(vfe_dev, DISABLE_CAMIF_IMMEDIATELY);
+	}
 	vfe_dev->hw_info->vfe_ops.core_ops.reset_hw(vfe_dev, 0, 0);
 
-	/* put scratch buf in all the wm */
-	for (wm = 0; wm < vfe_dev->axi_data.hw_info->num_wm; wm++) {
-		msm_isp_cfg_wm_scratch(vfe_dev, wm, VFE_PING_FLAG);
-		msm_isp_cfg_wm_scratch(vfe_dev, wm, VFE_PONG_FLAG);
-	}
-	vfe_dev->hw_info->vfe_ops.core_ops.release_hw(vfe_dev);
 	/* after regular hw stop, reduce open cnt */
 	vfe_dev->vfe_open_cnt--;
+
+	if (!vfe_used_by_adsp(vfe_dev)) {
+		for (wm = 0; wm < vfe_dev->axi_data.hw_info->num_wm; wm++) {
+			msm_isp_cfg_wm_scratch(vfe_dev, wm, VFE_PING_FLAG);
+			msm_isp_cfg_wm_scratch(vfe_dev, wm, VFE_PONG_FLAG);
+		}
+		vfe_dev->hw_info->vfe_ops.core_ops.release_hw(vfe_dev);
+	}
 	vfe_dev->buf_mgr->ops->buf_mgr_deinit(vfe_dev->buf_mgr);
 	if (vfe_dev->vt_enable) {
 		msm_isp_end_avtimer();
diff --git a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c
index 512fdb9..5057992 100644
--- a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c
+++ b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c
@@ -29,6 +29,7 @@
 #include "msm_camera_io_util.h"
 #include "cam_hw_ops.h"
 #include "cam_soc_api.h"
+#include <media/adsp-shmem-device.h>
 
 #ifdef CONFIG_MSM_ISPIF_V1
 #include "msm_ispif_hwreg_v1.h"
@@ -444,6 +445,13 @@
 	memset(ispif->stereo_configured, 0, sizeof(ispif->stereo_configured));
 	atomic_set(&ispif->reset_trig[VFE0], 1);
 	/* initiate reset of ISPIF */
+
+
+	if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+		pr_info("%s camera is in use by aDSP\n", __func__);
+		return rc;
+	}
+
 	msm_camera_io_w(ISPIF_RST_CMD_MASK,
 				ispif->base + ISPIF_RST_CMD_ADDR);
 
diff --git a/drivers/media/platform/msm/camera_v2/msm.c b/drivers/media/platform/msm/camera_v2/msm.c
index d52d8bc..559ad4d 100644
--- a/drivers/media/platform/msm/camera_v2/msm.c
+++ b/drivers/media/platform/msm/camera_v2/msm.c
@@ -238,8 +238,13 @@
 
 void msm_pm_qos_update_request(int val)
 {
-	pr_info("%s: update request %d", __func__, val);
-	pm_qos_update_request(&msm_v4l2_pm_qos_request, val);
+	/* update just before creating the first session,
+	 * or after destroying the last session.
+	 */
+	if (msm_session_q && msm_session_q->len == 0) {
+		pr_info("%s: update request %d", __func__, val);
+		pm_qos_update_request(&msm_v4l2_pm_qos_request, val);
+	}
 }
 
 struct msm_session *msm_session_find(unsigned int session_id)
diff --git a/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c b/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c
index b67af9c..80373d4 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c
+++ b/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c
@@ -23,6 +23,7 @@
 #include "msm_camera_io_util.h"
 #include "msm_camera_dt_util.h"
 #include "cam_hw_ops.h"
+#include <media/adsp-shmem-device.h>
 
 #define V4L2_IDENT_CCI 50005
 #define CCI_I2C_QUEUE_0_SIZE 64
@@ -1477,6 +1478,14 @@
 		}
 	}
 
+
+	if (cci_dev->pdev->id == ADSP_CCI
+	&& adsp_shmem_get_state() != CAMERA_STATUS_END) {
+		/* Used by aDSP */
+		cci_dev->cci_state = CCI_STATE_ENABLED;
+		return 0;
+	}
+
 	cci_dev->cci_master_info[MASTER_0].reset_pending = TRUE;
 	msm_camera_io_w_mb(CCI_RESET_CMD_RMSK, cci_dev->base +
 			CCI_RESET_CMD_ADDR);
diff --git a/drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c b/drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c
index 9d3184e..53dd371 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c
+++ b/drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c
@@ -30,6 +30,7 @@
 #include "include/msm_csid_3_6_0_hwreg.h"
 #include "include/msm_csid_3_5_1_hwreg.h"
 #include "cam_hw_ops.h"
+#include <media/adsp-shmem-device.h>
 
 #define V4L2_IDENT_CSID                            50002
 #define CSID_VERSION_V20                      0x02000011
@@ -233,7 +234,14 @@
 	int32_t rc = 0;
 	uint32_t irq = 0, irq_bitshift;
 
+	if (csid_dev->pdev->id == ADSP_CSID &&
+	    adsp_shmem_get_state() != CAMERA_STATUS_END) {
+		pr_debug("%s: already in use from aDSP\n", __func__);
+		return rc;
+	}
+
 	irq_bitshift = csid_dev->ctrl_reg->csid_reg.csid_rst_done_irq_bitshift;
+
 	msm_camera_io_w(csid_dev->ctrl_reg->csid_reg.csid_rst_stb_all,
 		csid_dev->base +
 		csid_dev->ctrl_reg->csid_reg.csid_rst_cmd_addr);
@@ -651,14 +659,14 @@
 
 	CDBG("%s:%d, hw_version = 0x%x\n", __func__, __LINE__,
 		csid_dev->hw_version);
-
-	irq = msm_camera_io_r(csid_dev->base +
-		csid_dev->ctrl_reg->csid_reg.csid_irq_status_addr);
-	msm_camera_io_w(irq, csid_dev->base +
-		csid_dev->ctrl_reg->csid_reg.csid_irq_clear_cmd_addr);
-	msm_camera_io_w(0, csid_dev->base +
-		csid_dev->ctrl_reg->csid_reg.csid_irq_mask_addr);
-
+	if (adsp_shmem_get_state() == CAMERA_STATUS_END) {
+		irq = msm_camera_io_r(csid_dev->base +
+			csid_dev->ctrl_reg->csid_reg.csid_irq_status_addr);
+		msm_camera_io_w(irq, csid_dev->base +
+			csid_dev->ctrl_reg->csid_reg.csid_irq_clear_cmd_addr);
+		msm_camera_io_w(0, csid_dev->base +
+			csid_dev->ctrl_reg->csid_reg.csid_irq_mask_addr);
+	}
 	msm_camera_enable_irq(csid_dev->irq, false);
 
 	msm_camera_clk_enable(&csid_dev->pdev->dev,
@@ -728,6 +736,12 @@
 		struct msm_camera_csid_vc_cfg *vc_cfg = NULL;
 		int i = 0;
 
+		if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+			/* aDSP still in use */
+			rc = 0;
+			break;
+		}
+
 		if (copy_from_user(&csid_params,
 			(void __user *)cdata->cfg.csid_params,
 			sizeof(struct msm_camera_csid_params))) {
@@ -822,6 +836,12 @@
 		break;
 	case VIDIOC_MSM_CSID_RELEASE:
 	case MSM_SD_SHUTDOWN:
+		if (adsp_shmem_get_state() == CAMERA_STATUS_END) {
+			/* aDSP still in use */
+			rc = 0;
+			break;
+		}
+
 		rc = msm_csid_release(csid_dev);
 		break;
 	default:
@@ -871,7 +891,6 @@
 		break;
 	}
 	case CSID_CFG: {
-
 		struct msm_camera_csid_params csid_params;
 		struct msm_camera_csid_vc_cfg *vc_cfg = NULL;
 		int i = 0;
@@ -879,6 +898,12 @@
 		struct msm_camera_csid_params32 csid_params32;
 		struct msm_camera_csid_vc_cfg vc_cfg32;
 
+		if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+			/* aDSP still in use */
+			rc = 0;
+			break;
+		}
+
 		if (copy_from_user(&csid_params32,
 			(void __user *)compat_ptr(arg32->cfg.csid_params),
 			sizeof(struct msm_camera_csid_params32))) {
diff --git a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c
index 162101c..9830810 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c
+++ b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c
@@ -30,6 +30,7 @@
 #include "include/msm_csiphy_5_0_1_hwreg.h"
 #include "include/msm_csiphy_10_0_0_hwreg.h"
 #include "cam_hw_ops.h"
+#include <media/adsp-shmem-device.h>
 
 #define DBG_CSIPHY 0
 #define SOF_DEBUG_ENABLE 1
@@ -2162,11 +2163,15 @@
 		rc = msm_csiphy_get_subdev_id(csiphy_dev, arg);
 		break;
 	case VIDIOC_MSM_CSIPHY_IO_CFG:
-		rc = msm_csiphy_cmd(csiphy_dev, arg);
+		rc = 0;
+		if (adsp_shmem_get_state() == CAMERA_STATUS_END)
+			rc = msm_csiphy_cmd(csiphy_dev, arg);
 		break;
 	case VIDIOC_MSM_CSIPHY_RELEASE:
 	case MSM_SD_SHUTDOWN:
-		rc = msm_csiphy_release(csiphy_dev, arg);
+		rc = 0;
+		if (adsp_shmem_get_state() == CAMERA_STATUS_END)
+			rc = msm_csiphy_release(csiphy_dev, arg);
 		break;
 	case MSM_SD_NOTIFY_FREEZE:
 		if (!csiphy_dev || !csiphy_dev->ctrl_reg ||
diff --git a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c
index 9e99ba2..9e9ef92 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c
+++ b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c
@@ -14,6 +14,7 @@
 #include "msm_camera_io_util.h"
 #include "msm_camera_i2c_mux.h"
 #include "msm_cci.h"
+#include <media/adsp-shmem-device.h>
 
 #define CAM_SENSOR_PINCTRL_STATE_SLEEP "cam_suspend"
 #define CAM_SENSOR_PINCTRL_STATE_DEFAULT "cam_default"
@@ -1424,6 +1425,22 @@
 	int rc = 0, index = 0, no_gpio = 0, ret = 0;
 	struct msm_sensor_power_setting *power_setting = NULL;
 
+	if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+		/* camera still in use from aDSP side */
+		ctrl->cam_pinctrl_status = 0;
+
+		if (device_type == MSM_CAMERA_PLATFORM_DEVICE) {
+			rc = sensor_i2c_client->i2c_func_tbl->i2c_util(
+				sensor_i2c_client, MSM_CCI_INIT);
+			if (rc < 0) {
+				pr_err("%s cci_init failed\n", __func__);
+				goto power_up_failed;
+			}
+		}
+
+		return rc;
+	}
+
 	CDBG("%s:%d\n", __func__, __LINE__);
 	if (!ctrl || !sensor_i2c_client) {
 		pr_err("failed ctrl %pK sensor_i2c_client %pK\n", ctrl,
@@ -1656,6 +1673,20 @@
 			sensor_i2c_client);
 		return -EINVAL;
 	}
+
+	if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+		/* camera still in use from aDSP side */
+
+		if (device_type == MSM_CAMERA_PLATFORM_DEVICE)
+			sensor_i2c_client->i2c_func_tbl->i2c_util(
+			sensor_i2c_client, MSM_CCI_RELEASE);
+		ctrl->cam_pinctrl_status = 0;
+		msm_camera_request_gpio_table(
+			ctrl->gpio_conf->cam_gpio_req_tbl,
+			ctrl->gpio_conf->cam_gpio_req_tbl_size, 0);
+		return ret;
+	}
+
 	if (device_type == MSM_CAMERA_PLATFORM_DEVICE)
 		sensor_i2c_client->i2c_func_tbl->i2c_util(
 			sensor_i2c_client, MSM_CCI_RELEASE);
@@ -1667,10 +1698,12 @@
 		CDBG("%s type %d\n", __func__, pd->seq_type);
 		switch (pd->seq_type) {
 		case SENSOR_CLK:
-			msm_camera_clk_enable(ctrl->dev,
-				ctrl->clk_info, ctrl->clk_ptr,
-				ctrl->clk_info_size, false);
-				break;
+			if (ctrl->cam_pinctrl_status) { /* adsp */
+				msm_camera_clk_enable(ctrl->dev,
+					ctrl->clk_info, ctrl->clk_ptr,
+					ctrl->clk_info_size, false);
+			}
+			break;
 		case SENSOR_GPIO:
 			if (pd->seq_val >= SENSOR_GPIO_MAX ||
 				!ctrl->gpio_conf->gpio_num_info) {
@@ -1737,18 +1770,20 @@
 				(pd->delay * 1000) + 1000);
 		}
 	}
+
 	if (ctrl->cam_pinctrl_status) {
 		ret = pinctrl_select_state(ctrl->pinctrl_info.pinctrl,
-				ctrl->pinctrl_info.gpio_state_suspend);
+			ctrl->pinctrl_info.gpio_state_suspend);
 		if (ret)
 			pr_err("%s:%d cannot set pin to suspend state",
-				__func__, __LINE__);
+			__func__, __LINE__);
 		devm_pinctrl_put(ctrl->pinctrl_info.pinctrl);
-	}
-	ctrl->cam_pinctrl_status = 0;
-	msm_camera_request_gpio_table(
+		msm_camera_request_gpio_table(
 		ctrl->gpio_conf->cam_gpio_req_tbl,
 		ctrl->gpio_conf->cam_gpio_req_tbl_size, 0);
+	}
+	ctrl->cam_pinctrl_status = 0;
+
 	CDBG("%s exit\n", __func__);
 	return 0;
 }
diff --git a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c
index 6f39956..cdc67d2 100644
--- a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c
+++ b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c
@@ -17,6 +17,7 @@
 #include "msm_camera_i2c_mux.h"
 #include <linux/regulator/rpm-smd-regulator.h>
 #include <linux/regulator/consumer.h>
+#include <media/adsp-shmem-device.h>
 
 #undef CDBG
 #define CDBG(fmt, args...) pr_debug(fmt, ##args)
@@ -258,6 +259,17 @@
 	slave_info = s_ctrl->sensordata->slave_info;
 	sensor_name = s_ctrl->sensordata->sensor_name;
 
+	if (adsp_shmem_is_initialized()) {
+		pr_debug("%s aDSP camera supports sensor_name:%s\n", __func__,
+			adsp_shmem_get_sensor_name());
+		if (strnstr(sensor_name, adsp_shmem_get_sensor_name(),
+			strlen(sensor_name))) {
+			pr_debug("%s ARM-side sensor matched with aDSP-side sensor:%s\n",
+				__func__, sensor_name);
+			return rc;
+		}
+	}
+
 	if (!sensor_i2c_client || !slave_info || !sensor_name) {
 		pr_err("%s:%d failed: %pK %pK %pK\n",
 			__func__, __LINE__, sensor_i2c_client, slave_info,
@@ -463,6 +475,11 @@
 		struct msm_camera_i2c_reg_setting conf_array;
 		struct msm_camera_i2c_reg_array *reg_setting = NULL;
 
+		if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+			mutex_unlock(s_ctrl->msm_sensor_mutex);
+			return 0;
+		}
+
 		if (s_ctrl->is_csid_tg_mode)
 			goto DONE;
 
@@ -540,6 +557,11 @@
 		uint16_t orig_slave_addr = 0, read_slave_addr = 0;
 		uint16_t orig_addr_type = 0, read_addr_type = 0;
 
+		if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+			mutex_unlock(s_ctrl->msm_sensor_mutex);
+			return 0;
+		}
+
 		if (s_ctrl->is_csid_tg_mode)
 			goto DONE;
 
@@ -618,6 +640,11 @@
 		uint16_t orig_slave_addr = 0, write_slave_addr = 0;
 		uint16_t orig_addr_type = 0, write_addr_type = 0;
 
+		if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+			mutex_unlock(s_ctrl->msm_sensor_mutex);
+			return 0;
+		}
+
 		if (s_ctrl->is_csid_tg_mode)
 			goto DONE;
 
@@ -724,6 +751,11 @@
 		struct msm_camera_i2c_seq_reg_setting conf_array;
 		struct msm_camera_i2c_seq_reg_array *reg_setting = NULL;
 
+		if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+			mutex_unlock(s_ctrl->msm_sensor_mutex);
+			return 0;
+		}
+
 		if (s_ctrl->is_csid_tg_mode)
 			goto DONE;
 
@@ -841,6 +873,11 @@
 		struct msm_camera_i2c_reg_setting *stop_setting =
 			&s_ctrl->stop_setting;
 
+		if (adsp_shmem_get_state() != CAMERA_STATUS_END) {
+			mutex_unlock(s_ctrl->msm_sensor_mutex);
+			return 0;
+		}
+
 		if (s_ctrl->is_csid_tg_mode)
 			goto DONE;
 
diff --git a/drivers/media/platform/msm/vidc/msm_vidc.c b/drivers/media/platform/msm/vidc/msm_vidc.c
index 651d0a2..815d137 100644
--- a/drivers/media/platform/msm/vidc/msm_vidc.c
+++ b/drivers/media/platform/msm/vidc/msm_vidc.c
@@ -1860,6 +1860,8 @@
 		dprintk(VIDC_ERR,
 			"Failed to release mark_data buffers\n");
 
+	msm_comm_free_buffer_tags(inst);
+
 	msm_comm_release_eos_buffers(inst);
 
 	if (msm_comm_release_output_buffers(inst, true))
diff --git a/drivers/media/platform/msm/vidc_3x/msm_vdec.c b/drivers/media/platform/msm/vidc_3x/msm_vdec.c
index 04bdd65..bb4b6c8 100644
--- a/drivers/media/platform/msm/vidc_3x/msm_vdec.c
+++ b/drivers/media/platform/msm/vidc_3x/msm_vdec.c
@@ -22,6 +22,7 @@
 #define MSM_VDEC_DVC_NAME "msm_vdec_8974"
 #define MIN_NUM_OUTPUT_BUFFERS 4
 #define MIN_NUM_OUTPUT_BUFFERS_VP9 6
+#define MIN_NUM_OUTPUT_BUFFERS_HEVC 6
 #define MIN_NUM_CAPTURE_BUFFERS 6
 #define MIN_NUM_THUMBNAIL_MODE_CAPTURE_BUFFERS 1
 #define MAX_NUM_OUTPUT_BUFFERS VB2_MAX_FRAME
@@ -1499,6 +1500,10 @@
 				V4L2_PIX_FMT_VP9 &&
 				*num_buffers < MIN_NUM_OUTPUT_BUFFERS_VP9)
 			*num_buffers = MIN_NUM_OUTPUT_BUFFERS_VP9;
+		else if (inst->fmts[OUTPUT_PORT].fourcc ==
+				V4L2_PIX_FMT_HEVC &&
+				*num_buffers < MIN_NUM_OUTPUT_BUFFERS_HEVC)
+			*num_buffers = MIN_NUM_OUTPUT_BUFFERS_HEVC;
 
 		for (i = 0; i < *num_planes; i++) {
 			sizes[i] = get_frame_size(inst,
diff --git a/drivers/media/platform/msm/vidc_3x/venus_hfi.c b/drivers/media/platform/msm/vidc_3x/venus_hfi.c
index b83606a..c385088 100644
--- a/drivers/media/platform/msm/vidc_3x/venus_hfi.c
+++ b/drivers/media/platform/msm/vidc_3x/venus_hfi.c
@@ -1587,7 +1587,7 @@
 	__strict_check(device);
 
 	if (!__core_in_valid_state(device)) {
-		dprintk(VIDC_DBG, "%s - fw not in init state\n", __func__);
+		dprintk(VIDC_ERR, "%s - fw not in init state\n", __func__);
 		result = -EINVAL;
 		goto err_q_null;
 	}
@@ -3337,8 +3337,6 @@
 {
 	struct hfi_sfr_struct *vsfr = NULL;
 
-	__set_state(device, VENUS_STATE_DEINIT);
-
 	/* Once SYS_ERROR received from HW, it is safe to halt the AXI.
 	 * With SYS_ERROR, Venus FW may have crashed and HW might be
 	 * active and causing unnecessary transactions. Hence it is
@@ -3581,6 +3579,9 @@
 					"Too many packets in message queue to handle at once, deferring read\n");
 			break;
 		}
+		/* do not read packets after sys error packet */
+		if (info->response_type == HAL_SYS_ERROR)
+			break;
 	}
 
 	if (requeue_pm_work && device->res->sw_power_collapsible) {
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 99165f7..59082ad 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -2973,15 +2973,20 @@
  */
 static int mmc_runtime_resume(struct mmc_host *host)
 {
-	int err;
+	int err = 0;
 	ktime_t start = ktime_get();
 
 	MMC_TRACE(host, "%s\n", __func__);
+
+	if (!(host->caps & MMC_CAP_AGGRESSIVE_PM))
+		goto out;
+
 	err = _mmc_resume(host);
 	if (err && err != -ENOMEDIUM)
 		pr_err("%s: error %d doing runtime resume\n",
 			mmc_hostname(host), err);
 
+out:
 	trace_mmc_runtime_resume(mmc_hostname(host), err,
 			ktime_to_us(ktime_sub(ktime_get(), start)));
 
diff --git a/drivers/mmc/host/sdhci-msm-ice.c b/drivers/mmc/host/sdhci-msm-ice.c
index 42021af..2682a93 100644
--- a/drivers/mmc/host/sdhci-msm-ice.c
+++ b/drivers/mmc/host/sdhci-msm-ice.c
@@ -301,6 +301,7 @@
 	struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
 	struct sdhci_msm_host *msm_host = pltfm_host->priv;
 	unsigned int crypto_params = 0;
+	unsigned int crypto_enable = !bypass;
 	/*
 	 * The naming convention got changed between ICE2.0 and ICE3.0
 	 * registers fields. Below is the equivalent names for
@@ -311,7 +312,7 @@
 	 */
 	/* Configure ICE bypass mode */
 	crypto_params |=
-		(!bypass & MASK_SDHCI_MSM_ICE_HCI_PARAM_CE)
+		(crypto_enable & MASK_SDHCI_MSM_ICE_HCI_PARAM_CE)
 			<< OFFSET_SDHCI_MSM_ICE_HCI_PARAM_CE;
 	/* Configure Crypto Configure Index (CCI) */
 	crypto_params |= (key_index &
@@ -351,12 +352,16 @@
 		return -EINVAL;
 	req = mrq->req;
 	if (req && req->bio) {
+#ifdef CONFIG_PFK
 		if (bio_dun(req->bio)) {
 			dun = bio_dun(req->bio);
 			cdu_sz = SDHCI_MSM_ICE_TR_DATA_UNIT_4_KB;
 		} else {
 			dun = req->__sector;
 		}
+#else
+		dun = req->__sector;
+#endif
 		err = sdhci_msm_ice_get_cfg(msm_host, req, &bypass, &key_index);
 		if (err)
 			return err;
@@ -401,12 +406,16 @@
 		return -EINVAL;
 	req = mrq->req;
 	if (req && req->bio) {
+#ifdef CONFIG_PFK
 		if (bio_dun(req->bio)) {
 			dun = bio_dun(req->bio);
 			cdu_sz = SDHCI_MSM_ICE_TR_DATA_UNIT_4_KB;
 		} else {
 			dun = req->__sector;
 		}
+#else
+		dun = req->__sector;
+#endif
 		err = sdhci_msm_ice_get_cfg(msm_host, req, &bypass, &key_index);
 		if (err)
 			return err;
diff --git a/drivers/net/wireless/cnss2/main.c b/drivers/net/wireless/cnss2/main.c
index b2c0d09..4433ae0 100644
--- a/drivers/net/wireless/cnss2/main.c
+++ b/drivers/net/wireless/cnss2/main.c
@@ -900,8 +900,8 @@
 			goto self_recovery;
 		break;
 	case CNSS_REASON_RDDM:
-		clear_bit(CNSS_DEV_ERR_NOTIFY, &plat_priv->driver_state);
 		cnss_bus_collect_dump_info(plat_priv, false);
+		clear_bit(CNSS_DEV_ERR_NOTIFY, &plat_priv->driver_state);
 		break;
 	case CNSS_REASON_DEFAULT:
 	case CNSS_REASON_TIMEOUT:
diff --git a/drivers/net/wireless/cnss2/pci.c b/drivers/net/wireless/cnss2/pci.c
index c1fc8ba..0c07bef 100644
--- a/drivers/net/wireless/cnss2/pci.c
+++ b/drivers/net/wireless/cnss2/pci.c
@@ -229,6 +229,27 @@
 }
 EXPORT_SYMBOL(cnss_pci_link_down);
 
+int cnss_pci_is_device_down(struct device *dev)
+{
+	struct cnss_plat_data *plat_priv = cnss_bus_dev_to_plat_priv(dev);
+	struct cnss_pci_data *pci_priv;
+
+	if (!plat_priv) {
+		cnss_pr_err("plat_priv is NULL\n");
+		return -ENODEV;
+	}
+
+	pci_priv = plat_priv->bus_priv;
+	if (!pci_priv) {
+		cnss_pr_err("pci_priv is NULL\n");
+		return -ENODEV;
+	}
+
+	return test_bit(CNSS_DEV_ERR_NOTIFY, &plat_priv->driver_state) |
+		pci_priv->pci_link_down_ind;
+}
+EXPORT_SYMBOL(cnss_pci_is_device_down);
+
 int cnss_pci_call_driver_probe(struct cnss_pci_data *pci_priv)
 {
 	int ret = 0;
diff --git a/drivers/net/wireless/cnss_prealloc/cnss_prealloc.c b/drivers/net/wireless/cnss_prealloc/cnss_prealloc.c
index c09e61f..c2a740b 100644
--- a/drivers/net/wireless/cnss_prealloc/cnss_prealloc.c
+++ b/drivers/net/wireless/cnss_prealloc/cnss_prealloc.c
@@ -16,6 +16,7 @@
 #include <linux/stacktrace.h>
 #include <linux/spinlock.h>
 #include <linux/debugfs.h>
+#include <net/cnss_prealloc.h>
 #ifdef	CONFIG_WCNSS_SKB_PRE_ALLOC
 #include <linux/skbuff.h>
 #endif
@@ -33,7 +34,7 @@
 
 struct wcnss_prealloc {
 	int occupied;
-	unsigned int size;
+	size_t size;
 	void *ptr;
 #ifdef CONFIG_SLUB_DEBUG
 	unsigned long stack_trace[WCNSS_MAX_STACK_TRACE];
@@ -153,7 +154,7 @@
 void wcnss_prealloc_save_stack_trace(struct wcnss_prealloc *entry) {}
 #endif
 
-void *wcnss_prealloc_get(unsigned int size)
+void *wcnss_prealloc_get(size_t size)
 {
 	int i = 0;
 	unsigned long flags;
@@ -173,8 +174,6 @@
 	}
 	spin_unlock_irqrestore(&alloc_lock, flags);
 
-	WARN(1, "wcnss_prealloc not available for size %d\n", size);
-
 	return NULL;
 }
 EXPORT_SYMBOL(wcnss_prealloc_get);
@@ -212,7 +211,7 @@
 			j++;
 		}
 
-		pr_err("Size: %u, addr: %pK, backtrace:\n",
+		pr_err("Size: %zu, addr: %pK, backtrace:\n",
 		       wcnss_allocs[i].size, wcnss_allocs[i].ptr);
 		print_stack_trace(&wcnss_allocs[i].trace, 1);
 	}
diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c
index 15f3df9..dcfe105 100644
--- a/drivers/pinctrl/qcom/pinctrl-msm.c
+++ b/drivers/pinctrl/qcom/pinctrl-msm.c
@@ -35,6 +35,7 @@
 #include <linux/pm.h>
 #include <linux/log2.h>
 #include <linux/irq.h>
+#include <soc/qcom/scm.h>
 #include "../core.h"
 #include "../pinconf.h"
 #include "pinctrl-msm.h"
@@ -73,6 +74,8 @@
 	const struct msm_pinctrl_soc_data *soc;
 	void __iomem *regs;
 	void __iomem *pdc_regs;
+	phys_addr_t spi_cfg_regs;
+	phys_addr_t spi_cfg_end;
 };
 
 static struct msm_pinctrl *msm_pinctrl_data;
@@ -1279,8 +1282,12 @@
 	struct irq_desc *desc = irq_data_to_desc(d);
 	struct irq_data *parent_data = irq_get_irq_data(desc->parent_irq);
 	struct irq_data *dir_conn_data = NULL;
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
 	int offset = 0;
-	unsigned int virt = 0;
+	unsigned int virt = 0, val = 0;
+	struct msm_pinctrl *pctrl;
+	phys_addr_t spi_cfg_reg = 0;
+	unsigned long flags;
 
 	offset = select_dir_conn_mux(d, &irq);
 	if (offset < 0 || !parent_data)
@@ -1296,6 +1303,28 @@
 	dir_conn_data = &(desc->irq_data);
 
 	if (dir_conn_data) {
+
+		pctrl = gpiochip_get_data(gc);
+		if (pctrl->spi_cfg_regs) {
+			spi_cfg_reg = pctrl->spi_cfg_regs +
+					(dir_conn_data->hwirq / 32) * 4;
+			if (spi_cfg_reg < pctrl->spi_cfg_end) {
+				spin_lock_irqsave(&pctrl->lock, flags);
+				val = scm_io_read(spi_cfg_reg);
+				/*
+				 * Clear the respective bit for edge type
+				 * interrupt
+				 */
+				val &= ~(1 << (dir_conn_data->hwirq % 32));
+				WARN_ON(scm_io_write(spi_cfg_reg, val));
+				spin_unlock_irqrestore(&pctrl->lock, flags);
+			} else
+				pr_err("%s: type config failed for SPI: %lu\n",
+								 __func__, irq);
+		} else
+			pr_debug("%s: type config for SPI is not supported\n",
+								__func__);
+
 		if (dir_conn_data->chip && dir_conn_data->chip->irq_set_type)
 			dir_conn_data->chip->irq_set_type(dir_conn_data,
 					IRQ_TYPE_EDGE_RISING);
@@ -1331,11 +1360,19 @@
 {
 	struct irq_desc *desc = irq_data_to_desc(d);
 	struct irq_data *parent_data = irq_get_irq_data(desc->parent_irq);
+	struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
 	irq_hw_number_t irq = 0;
+	struct msm_pinctrl *pctrl;
+	phys_addr_t spi_cfg_reg = 0;
+	unsigned int config_val = 0;
+	unsigned int val = 0;
+	unsigned long flags;
 
 	if (!parent_data)
 		return 0;
 
+	pctrl = gpiochip_get_data(gc);
+
 	if (type == IRQ_TYPE_EDGE_BOTH)
 		add_dirconn_tlmm(d, irq);
 	else if (is_gpio_dual_edge(d, &irq))
@@ -1343,11 +1380,33 @@
 	else if (is_gpio_tlmm_dc(d, type))
 		type = IRQ_TYPE_EDGE_RISING;
 
-	if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
+	/*
+	 * Shared SPI config for Edge is 0 and
+	 * for Level interrupt is 1
+	 */
+	if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH)) {
 		irq_set_handler_locked(d, handle_level_irq);
-	else if (type & (IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
+		config_val = 1;
+	} else if (type & (IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
 		irq_set_handler_locked(d, handle_edge_irq);
 
+	if (pctrl->spi_cfg_regs && type != IRQ_TYPE_NONE) {
+		spi_cfg_reg = pctrl->spi_cfg_regs +
+				(parent_data->hwirq / 32) * 4;
+		if (spi_cfg_reg < pctrl->spi_cfg_end) {
+			spin_lock_irqsave(&pctrl->lock, flags);
+			val = scm_io_read(spi_cfg_reg);
+			val &= ~(1 << (parent_data->hwirq % 32));
+			if (config_val)
+				val |= (1 << (parent_data->hwirq % 32));
+			WARN_ON(scm_io_write(spi_cfg_reg, val));
+			spin_unlock_irqrestore(&pctrl->lock, flags);
+		} else
+			pr_err("%s: type config failed for SPI: %lu\n",
+							 __func__, irq);
+	} else
+		pr_debug("%s: SPI type config is not supported\n", __func__);
+
 	if (parent_data->chip->irq_set_type)
 		return parent_data->chip->irq_set_type(parent_data, type);
 
@@ -1653,6 +1712,7 @@
 	struct msm_pinctrl *pctrl;
 	struct resource *res;
 	int ret;
+	char *key;
 
 	msm_pinctrl_data = pctrl = devm_kzalloc(&pdev->dev,
 				sizeof(*pctrl), GFP_KERNEL);
@@ -1666,14 +1726,23 @@
 
 	spin_lock_init(&pctrl->lock);
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+	key = "pinctrl_regs";
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, key);
 	pctrl->regs = devm_ioremap_resource(&pdev->dev, res);
 	if (IS_ERR(pctrl->regs))
 		return PTR_ERR(pctrl->regs);
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+	key = "pdc_regs";
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, key);
 	pctrl->pdc_regs = devm_ioremap_resource(&pdev->dev, res);
 
+	key = "spi_cfg_regs";
+	res = platform_get_resource_byname(pdev, IORESOURCE_MEM, key);
+	if (res) {
+		pctrl->spi_cfg_regs = res->start;
+		pctrl->spi_cfg_end = res->end;
+	}
+
 	msm_pinctrl_setup_pm_reset(pctrl);
 
 	pctrl->irq = platform_get_irq(pdev, 0);
diff --git a/drivers/pinctrl/qcom/pinctrl-sdm670.c b/drivers/pinctrl/qcom/pinctrl-sdm670.c
index e9d7dfc..0e02da5 100644
--- a/drivers/pinctrl/qcom/pinctrl-sdm670.c
+++ b/drivers/pinctrl/qcom/pinctrl-sdm670.c
@@ -1579,13 +1579,13 @@
 	[147] = PINGROUP(147, WEST, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 	[148] = PINGROUP(148, WEST, NA, NA, NA, NA, NA, NA, NA, NA, NA),
 	[149] = PINGROUP(149, WEST, NA, NA, NA, NA, NA, NA, NA, NA, NA),
-	[150] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x99000, 15, 0),
-	[151] = SDC_QDSD_PINGROUP(sdc1_clk, 0x99000, 13, 6),
-	[152] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x99000, 11, 3),
-	[153] = SDC_QDSD_PINGROUP(sdc1_data, 0x99000, 9, 0),
-	[154] = SDC_QDSD_PINGROUP(sdc2_clk, 0x9a000, 14, 6),
-	[155] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x9a000, 11, 3),
-	[156] = SDC_QDSD_PINGROUP(sdc2_data, 0x9a000, 9, 0),
+	[150] = SDC_QDSD_PINGROUP(sdc1_rclk, 0x599000, 15, 0),
+	[151] = SDC_QDSD_PINGROUP(sdc1_clk, 0x599000, 13, 6),
+	[152] = SDC_QDSD_PINGROUP(sdc1_cmd, 0x599000, 11, 3),
+	[153] = SDC_QDSD_PINGROUP(sdc1_data, 0x599000, 9, 0),
+	[154] = SDC_QDSD_PINGROUP(sdc2_clk, 0x99a000, 14, 6),
+	[155] = SDC_QDSD_PINGROUP(sdc2_cmd, 0x99a000, 11, 3),
+	[156] = SDC_QDSD_PINGROUP(sdc2_data, 0x99a000, 9, 0),
 	[157] = UFS_RESET(ufs_reset, 0x99d000),
 };
 static struct msm_dir_conn sdm670_dir_conn[] = {
diff --git a/drivers/platform/msm/ipa/ipa_clients/ecm_ipa.c b/drivers/platform/msm/ipa/ipa_clients/ecm_ipa.c
index f7de806..0e5edf2 100644
--- a/drivers/platform/msm/ipa/ipa_clients/ecm_ipa.c
+++ b/drivers/platform/msm/ipa/ipa_clients/ecm_ipa.c
@@ -32,17 +32,49 @@
 #define DEBUGFS_TEMP_BUF_SIZE 4
 #define TX_TIMEOUT (5 * HZ)
 
+#define IPA_ECM_IPC_LOG_PAGES 50
+
+#define IPA_ECM_IPC_LOGGING(buf, fmt, args...) \
+	do { \
+		if (buf) \
+			ipc_log_string((buf), fmt, __func__, __LINE__, \
+				## args); \
+	} while (0)
+
+static void *ipa_ecm_logbuf;
+
 #define ECM_IPA_DEBUG(fmt, args...) \
-	pr_debug("ctx:%s: "\
-			fmt, current->comm, ## args)
+	do { \
+		pr_debug(DRIVER_NAME " %s:%d "\
+			fmt, __func__, __LINE__, ## args);\
+		if (ipa_ecm_logbuf) { \
+			IPA_ECM_IPC_LOGGING(ipa_ecm_logbuf, \
+				DRIVER_NAME " %s:%d " fmt, ## args); \
+		} \
+	} while (0)
+
+#define ECM_IPA_DEBUG_XMIT(fmt, args...) \
+	pr_debug(DRIVER_NAME " %s:%d " fmt, __func__, __LINE__, ## args)
 
 #define ECM_IPA_INFO(fmt, args...) \
-	pr_err(DRIVER_NAME "@%s@%d@ctx:%s: "\
-			fmt, __func__, __LINE__, current->comm, ## args)
+	do { \
+		pr_info(DRIVER_NAME "@%s@%d@ctx:%s: "\
+			fmt, __func__, __LINE__, current->comm, ## args);\
+		if (ipa_ecm_logbuf) { \
+			IPA_ECM_IPC_LOGGING(ipa_ecm_logbuf, \
+				DRIVER_NAME " %s:%d " fmt, ## args); \
+		} \
+	} while (0)
 
 #define ECM_IPA_ERROR(fmt, args...) \
-	pr_err(DRIVER_NAME "@%s@%d@ctx:%s: "\
-			fmt, __func__, __LINE__, current->comm, ## args)
+	do { \
+		pr_err(DRIVER_NAME "@%s@%d@ctx:%s: "\
+			fmt, __func__, __LINE__, current->comm, ## args);\
+		if (ipa_ecm_logbuf) { \
+			IPA_ECM_IPC_LOGGING(ipa_ecm_logbuf, \
+				DRIVER_NAME " %s:%d " fmt, ## args); \
+		} \
+	} while (0)
 
 #define NULL_CHECK(ptr) \
 	do { \
@@ -586,7 +618,7 @@
 
 	netif_trans_update(net);
 
-	ECM_IPA_DEBUG
+	ECM_IPA_DEBUG_XMIT
 		("Tx, len=%d, skb->protocol=%d, outstanding=%d\n",
 		skb->len, skb->protocol,
 		atomic_read(&ecm_ipa_ctx->outstanding_pkts));
@@ -1289,7 +1321,9 @@
 	ecm_ipa_ctx->net->stats.tx_packets++;
 	ecm_ipa_ctx->net->stats.tx_bytes += skb->len;
 
-	atomic_dec(&ecm_ipa_ctx->outstanding_pkts);
+	if (atomic_read(&ecm_ipa_ctx->outstanding_pkts) > 0)
+		atomic_dec(&ecm_ipa_ctx->outstanding_pkts);
+
 	if
 		(netif_queue_stopped(ecm_ipa_ctx->net) &&
 		netif_carrier_ok(ecm_ipa_ctx->net) &&
@@ -1577,6 +1611,10 @@
 static int ecm_ipa_init_module(void)
 {
 	ECM_IPA_LOG_ENTRY();
+	ipa_ecm_logbuf = ipc_log_context_create(IPA_ECM_IPC_LOG_PAGES,
+			"ipa_ecm", 0);
+	if (ipa_ecm_logbuf == NULL)
+		ECM_IPA_DEBUG("failed to create IPC log, continue...\n");
 	ECM_IPA_LOG_EXIT();
 	return 0;
 }
@@ -1588,6 +1626,9 @@
 static void ecm_ipa_cleanup_module(void)
 {
 	ECM_IPA_LOG_ENTRY();
+	if (ipa_ecm_logbuf)
+		ipc_log_context_destroy(ipa_ecm_logbuf);
+	ipa_ecm_logbuf = NULL;
 	ECM_IPA_LOG_EXIT();
 }
 
diff --git a/drivers/platform/msm/ipa/ipa_clients/rndis_ipa.c b/drivers/platform/msm/ipa/ipa_clients/rndis_ipa.c
index 51890dd..2b58121 100644
--- a/drivers/platform/msm/ipa/ipa_clients/rndis_ipa.c
+++ b/drivers/platform/msm/ipa/ipa_clients/rndis_ipa.c
@@ -62,11 +62,38 @@
 #define DEFAULT_AGGR_TIME_LIMIT 1
 #define DEFAULT_AGGR_PKT_LIMIT 0
 
-#define RNDIS_IPA_ERROR(fmt, args...) \
-		pr_err(DRV_NAME "@%s@%d@ctx:%s: "\
-				fmt, __func__, __LINE__, current->comm, ## args)
+#define IPA_RNDIS_IPC_LOG_PAGES 50
+
+#define IPA_RNDIS_IPC_LOGGING(buf, fmt, args...) \
+	do { \
+		if (buf) \
+			ipc_log_string((buf), fmt, __func__, __LINE__, \
+				## args); \
+	} while (0)
+
+static void *ipa_rndis_logbuf;
+
 #define RNDIS_IPA_DEBUG(fmt, args...) \
-			pr_debug("ctx: %s, "fmt, current->comm, ## args)
+	do { \
+		pr_debug(DRV_NAME " %s:%d " fmt, __func__, __LINE__, ## args);\
+		if (ipa_rndis_logbuf) { \
+			IPA_RNDIS_IPC_LOGGING(ipa_rndis_logbuf, \
+				DRV_NAME " %s:%d " fmt, ## args); \
+		} \
+	} while (0)
+
+#define RNDIS_IPA_DEBUG_XMIT(fmt, args...) \
+	pr_debug(DRV_NAME " %s:%d " fmt, __func__, __LINE__, ## args)
+
+#define RNDIS_IPA_ERROR(fmt, args...) \
+	do { \
+		pr_err(DRV_NAME "@%s@%d@ctx:%s: "\
+			fmt, __func__, __LINE__, current->comm, ## args);\
+		if (ipa_rndis_logbuf) { \
+			IPA_RNDIS_IPC_LOGGING(ipa_rndis_logbuf, \
+				DRV_NAME " %s:%d " fmt, ## args); \
+		} \
+	} while (0)
 
 #define NULL_CHECK_RETVAL(ptr) \
 		do { \
@@ -892,7 +919,7 @@
 
 	netif_trans_update(net);
 
-	RNDIS_IPA_DEBUG
+	RNDIS_IPA_DEBUG_XMIT
 		("Tx, len=%d, skb->protocol=%d, outstanding=%d\n",
 		skb->len, skb->protocol,
 		atomic_read(&rndis_ipa_ctx->outstanding_pkts));
@@ -1010,7 +1037,9 @@
 	rndis_ipa_ctx->net->stats.tx_packets++;
 	rndis_ipa_ctx->net->stats.tx_bytes += skb->len;
 
-	atomic_dec(&rndis_ipa_ctx->outstanding_pkts);
+	if (atomic_read(&rndis_ipa_ctx->outstanding_pkts) > 0)
+		atomic_dec(&rndis_ipa_ctx->outstanding_pkts);
+
 	if
 		(netif_queue_stopped(rndis_ipa_ctx->net) &&
 		netif_carrier_ok(rndis_ipa_ctx->net) &&
@@ -2630,12 +2659,21 @@
 
 static int rndis_ipa_init_module(void)
 {
+	ipa_rndis_logbuf = ipc_log_context_create(IPA_RNDIS_IPC_LOG_PAGES,
+		"ipa_rndis", 0);
+	if (ipa_rndis_logbuf == NULL)
+		RNDIS_IPA_DEBUG("failed to create IPC log, continue...\n");
+
 	pr_info("RNDIS_IPA module is loaded.");
 	return 0;
 }
 
 static void rndis_ipa_cleanup_module(void)
 {
+	if (ipa_rndis_logbuf)
+		ipc_log_context_destroy(ipa_rndis_logbuf);
+	ipa_rndis_logbuf = NULL;
+
 	pr_info("RNDIS_IPA module is unloaded.");
 }
 
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c b/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c
index 7603152..e6dae89 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_dp.c
@@ -1667,7 +1667,7 @@
 		&ipa3_ctx->wc_memb.wlan_comm_desc_list, link) {
 		list_del(&rx_pkt->link);
 		dma_unmap_single(ipa3_ctx->pdev, rx_pkt->data.dma_addr,
-				IPA_WLAN_COMM_RX_POOL_LOW, DMA_FROM_DEVICE);
+				IPA_WLAN_RX_BUFF_SZ, DMA_FROM_DEVICE);
 		dev_kfree_skb_any(rx_pkt->data.skb);
 		kmem_cache_free(ipa3_ctx->rx_pkt_wrapper_cache, rx_pkt);
 		ipa3_ctx->wc_memb.wlan_comm_free_cnt--;
diff --git a/drivers/platform/msm/mhi_dev/mhi.c b/drivers/platform/msm/mhi_dev/mhi.c
index 3e245cc..c938e8e 100644
--- a/drivers/platform/msm/mhi_dev/mhi.c
+++ b/drivers/platform/msm/mhi_dev/mhi.c
@@ -458,8 +458,9 @@
 
 		mhi_update_state_info(MHI_DEV_UEVENT_CTRL, MHI_STATE_CONNECTED);
 
-		ep_pcie_mask_irq_event(mhi_ctx->phandle,
-				EP_PCIE_INT_EVT_MHI_A7, true);
+		if (!mhi_ctx->mhi_int)
+			ep_pcie_mask_irq_event(mhi_ctx->phandle,
+					EP_PCIE_INT_EVT_MHI_A7, true);
 		break;
 	case IPA_MHI_EVENT_DATA_AVAILABLE:
 		rc = mhi_dev_notify_sm_event(MHI_DEV_EVENT_HW_ACC_WAKEUP);
@@ -2758,8 +2759,9 @@
 		EP_PCIE_EVENT_PM_D3_COLD |
 		EP_PCIE_EVENT_PM_D0 |
 		EP_PCIE_EVENT_PM_RST_DEAST |
-		EP_PCIE_EVENT_MHI_A7 |
 		EP_PCIE_EVENT_LINKDOWN;
+	if (!mhi_ctx->mhi_int)
+		mhi_ctx->event_reg.events |= EP_PCIE_EVENT_MHI_A7;
 	mhi_ctx->event_reg.user = mhi_ctx;
 	mhi_ctx->event_reg.mode = EP_PCIE_TRIGGER_CALLBACK;
 	mhi_ctx->event_reg.callback = mhi_dev_sm_pcie_handler;
@@ -2902,8 +2904,9 @@
 		EP_PCIE_EVENT_PM_D3_COLD |
 		EP_PCIE_EVENT_PM_D0 |
 		EP_PCIE_EVENT_PM_RST_DEAST |
-		EP_PCIE_EVENT_MHI_A7 |
 		EP_PCIE_EVENT_LINKDOWN;
+	if (!mhi_ctx->mhi_int)
+		mhi_ctx->event_reg.events |= EP_PCIE_EVENT_MHI_A7;
 	mhi_ctx->event_reg.user = mhi_ctx;
 	mhi_ctx->event_reg.mode = EP_PCIE_TRIGGER_CALLBACK;
 	mhi_ctx->event_reg.callback = mhi_dev_sm_pcie_handler;
diff --git a/drivers/platform/msm/mhi_dev/mhi_sm.c b/drivers/platform/msm/mhi_dev/mhi_sm.c
index 917b258..4ec1c02 100644
--- a/drivers/platform/msm/mhi_dev/mhi_sm.c
+++ b/drivers/platform/msm/mhi_dev/mhi_sm.c
@@ -1192,7 +1192,7 @@
 		spin_lock_irqsave(&mhi_sm_ctx->mhi_dev->lock, flags);
 		if ((mhi_sm_ctx->mhi_dev->mhi_int) &&
 				(mhi_sm_ctx->mhi_dev->mhi_int_en)) {
-			disable_irq(mhi_sm_ctx->mhi_dev->mhi_irq);
+			disable_irq_nosync(mhi_sm_ctx->mhi_dev->mhi_irq);
 			mhi_sm_ctx->mhi_dev->mhi_int_en = false;
 			MHI_SM_DBG("Disable MHI IRQ during D3 HOT");
 		}
diff --git a/drivers/power/supply/qcom/qpnp-qg.c b/drivers/power/supply/qcom/qpnp-qg.c
index fede66f..855e31d 100644
--- a/drivers/power/supply/qcom/qpnp-qg.c
+++ b/drivers/power/supply/qcom/qpnp-qg.c
@@ -2877,6 +2877,8 @@
 
 static int qg_post_init(struct qpnp_qg *chip)
 {
+	u8 status = 0;
+
 	/* disable all IRQs if profile is not loaded */
 	if (!chip->profile_loaded) {
 		vote(chip->vbatt_irq_disable_votable,
@@ -2891,6 +2893,9 @@
 	if (!chip->dt.esr_disable)
 		qg_retrieve_esr_params(chip);
 
+	/* read STATUS2 register to clear its last state */
+	qg_read(chip, chip->qg_base + QG_STATUS2_REG, &status, 1);
+
 	return 0;
 }
 
@@ -3379,6 +3384,9 @@
 
 	chip->suspend_data = false;
 
+	/* read STATUS2 register to clear its last state */
+	qg_read(chip, chip->qg_base + QG_STATUS2_REG, &status, 1);
+
 	/* ignore any suspend processing if we are charging */
 	if (chip->charge_status == POWER_SUPPLY_STATUS_CHARGING) {
 		qg_dbg(chip, QG_DEBUG_PM, "Charging @ suspend - ignore processing\n");
@@ -3428,9 +3436,6 @@
 		chip->suspend_data = true;
 	}
 
-	/* read STATUS2 register to clear its last state */
-	qg_read(chip, chip->qg_base + QG_STATUS2_REG, &status, 1);
-
 	qg_dbg(chip, QG_DEBUG_PM, "FIFO rt_length=%d sleep_fifo_length=%d default_s2_count=%d suspend_data=%d\n",
 			fifo_rt_length, sleep_fifo_length,
 			chip->dt.s2_fifo_length, chip->suspend_data);
diff --git a/drivers/power/supply/qcom/qpnp-smb5.c b/drivers/power/supply/qcom/qpnp-smb5.c
index e56ecb0..57aa0c6 100644
--- a/drivers/power/supply/qcom/qpnp-smb5.c
+++ b/drivers/power/supply/qcom/qpnp-smb5.c
@@ -1785,27 +1785,31 @@
 static int smb5_configure_mitigation(struct smb_charger *chg)
 {
 	int rc;
-	u8 chan = 0;
+	u8 chan = 0, src_cfg = 0;
 
 	if (!chg->hw_die_temp_mitigation && !chg->hw_connector_mitigation)
 		return 0;
 
 	if (chg->hw_die_temp_mitigation) {
-		rc = smblib_write(chg, MISC_THERMREG_SRC_CFG_REG,
-				THERMREG_CONNECTOR_ADC_SRC_EN_BIT
-				| THERMREG_DIE_ADC_SRC_EN_BIT
-				| THERMREG_DIE_CMP_SRC_EN_BIT);
-		if (rc < 0) {
-			dev_err(chg->dev,
-				"Couldn't configure THERM_SRC reg rc=%d\n", rc);
-			return rc;
-		};
-
 		chan = DIE_TEMP_CHANNEL_EN_BIT;
+		src_cfg = THERMREG_DIE_ADC_SRC_EN_BIT
+			| THERMREG_DIE_CMP_SRC_EN_BIT;
 	}
 
-	if (chg->hw_connector_mitigation)
+	if (chg->hw_connector_mitigation) {
 		chan |= CONN_THM_CHANNEL_EN_BIT;
+		src_cfg |= THERMREG_CONNECTOR_ADC_SRC_EN_BIT;
+	}
+
+	rc = smblib_masked_write(chg, MISC_THERMREG_SRC_CFG_REG,
+			THERMREG_SW_ICL_ADJUST_BIT | THERMREG_DIE_ADC_SRC_EN_BIT
+			| THERMREG_DIE_CMP_SRC_EN_BIT
+			| THERMREG_CONNECTOR_ADC_SRC_EN_BIT, src_cfg);
+	if (rc < 0) {
+		dev_err(chg->dev,
+				"Couldn't configure THERM_SRC reg rc=%d\n", rc);
+		return rc;
+	};
 
 	rc = smblib_masked_write(chg, BATIF_ADC_CHANNEL_EN_REG,
 			CONN_THM_CHANNEL_EN_BIT | DIE_TEMP_CHANNEL_EN_BIT,
diff --git a/drivers/power/supply/qcom/smb-lib.c b/drivers/power/supply/qcom/smb-lib.c
index 6b6bc9c..5546eae 100644
--- a/drivers/power/supply/qcom/smb-lib.c
+++ b/drivers/power/supply/qcom/smb-lib.c
@@ -510,6 +510,9 @@
 {
 	int rc = 0;
 
+	if (chg->pr_swap_in_progress)
+		return 0;
+
 	/* fetch the DPDM regulator */
 	if (!chg->dpdm_reg && of_get_property(chg->dev->of_node,
 				"dpdm-supply", NULL)) {
diff --git a/drivers/power/supply/qcom/smb138x-charger.c b/drivers/power/supply/qcom/smb138x-charger.c
index e03e0a8..7dbd189 100644
--- a/drivers/power/supply/qcom/smb138x-charger.c
+++ b/drivers/power/supply/qcom/smb138x-charger.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016-2017 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2016-2018 The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -1265,7 +1265,9 @@
 	struct smb_irq_data *irq_data = data;
 	struct smb138x *chip = irq_data->parent_data;
 
-	power_supply_changed(chip->parallel_psy);
+	if (chip->parallel_psy)
+		power_supply_changed(chip->parallel_psy);
+
 	return IRQ_HANDLED;
 }
 
diff --git a/drivers/power/supply/qcom/step-chg-jeita.c b/drivers/power/supply/qcom/step-chg-jeita.c
index 3b4b275..3e8b46b 100644
--- a/drivers/power/supply/qcom/step-chg-jeita.c
+++ b/drivers/power/supply/qcom/step-chg-jeita.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2017 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2017-2018 The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -79,10 +79,12 @@
 
 	struct votable		*fcc_votable;
 	struct votable		*fv_votable;
+	struct votable		*usb_icl_votable;
 	struct wakeup_source	*step_chg_ws;
 	struct power_supply	*batt_psy;
 	struct power_supply	*bms_psy;
 	struct power_supply	*main_psy;
+	struct power_supply	*usb_psy;
 	struct delayed_work	status_change_work;
 	struct delayed_work	get_config_work;
 	struct notifier_block	nb;
@@ -119,6 +121,17 @@
 	return true;
 }
 
+static bool is_usb_available(struct step_chg_info *chip)
+{
+	if (!chip->usb_psy)
+		chip->usb_psy = power_supply_get_by_name("usb");
+
+	if (!chip->usb_psy)
+		return false;
+
+	return true;
+}
+
 static int read_range_data_from_node(struct device_node *node,
 		const char *prop_str, struct range_data *ranges,
 		u32 max_threshold, u32 max_value)
@@ -486,6 +499,7 @@
 	return (STEP_CHG_HYSTERISIS_DELAY_US - elapsed_us + 1000);
 }
 
+#define JEITA_SUSPEND_HYST_UV		50000
 static int handle_jeita(struct step_chg_info *chip)
 {
 	union power_supply_propval pval = {0, };
@@ -504,6 +518,8 @@
 			vote(chip->fcc_votable, JEITA_VOTER, false, 0);
 		if (chip->fv_votable)
 			vote(chip->fv_votable, JEITA_VOTER, false, 0);
+		if (chip->usb_icl_votable)
+			vote(chip->usb_icl_votable, JEITA_VOTER, false, 0);
 		return 0;
 	}
 
@@ -525,12 +541,8 @@
 			pval.intval,
 			&chip->jeita_fcc_index,
 			&fcc_ua);
-	if (rc < 0) {
-		/* remove the vote if no step-based fcc is found */
-		if (chip->fcc_votable)
-			vote(chip->fcc_votable, JEITA_VOTER, false, 0);
-		goto update_time;
-	}
+	if (rc < 0)
+		fcc_ua = 0;
 
 	if (!chip->fcc_votable)
 		chip->fcc_votable = find_votable("FCC");
@@ -538,7 +550,7 @@
 		/* changing FCC is a must */
 		return -EINVAL;
 
-	vote(chip->fcc_votable, JEITA_VOTER, true, fcc_ua);
+	vote(chip->fcc_votable, JEITA_VOTER, fcc_ua ? true : false, fcc_ua);
 
 	rc = get_val(chip->jeita_fv_config->fv_cfg,
 			chip->jeita_fv_config->hysteresis,
@@ -546,21 +558,45 @@
 			pval.intval,
 			&chip->jeita_fv_index,
 			&fv_uv);
-	if (rc < 0) {
-		/* remove the vote if no step-based fcc is found */
-		if (chip->fv_votable)
-			vote(chip->fv_votable, JEITA_VOTER, false, 0);
-		goto update_time;
-	}
+	if (rc < 0)
+		fv_uv = 0;
 
 	chip->fv_votable = find_votable("FV");
 	if (!chip->fv_votable)
 		goto update_time;
 
-	vote(chip->fv_votable, JEITA_VOTER, true, fv_uv);
+	if (!chip->usb_icl_votable)
+		chip->usb_icl_votable = find_votable("USB_ICL");
 
-	pr_debug("%s = %d FCC = %duA FV = %duV\n",
-		chip->jeita_fcc_config->prop_name, pval.intval, fcc_ua, fv_uv);
+	if (!chip->usb_icl_votable)
+		goto set_jeita_fv;
+
+	/*
+	 * If JEITA float voltage is same as max-vfloat of battery then
+	 * skip any further VBAT specific checks.
+	 */
+	rc = power_supply_get_property(chip->batt_psy,
+				POWER_SUPPLY_PROP_VOLTAGE_MAX, &pval);
+	if (rc || (pval.intval == fv_uv)) {
+		vote(chip->usb_icl_votable, JEITA_VOTER, false, 0);
+		goto set_jeita_fv;
+	}
+
+	/*
+	 * Suspend USB input path if battery voltage is above
+	 * JEITA VFLOAT threshold.
+	 */
+	if (fv_uv > 0) {
+		rc = power_supply_get_property(chip->batt_psy,
+				POWER_SUPPLY_PROP_VOLTAGE_NOW, &pval);
+		if (!rc && (pval.intval > fv_uv))
+			vote(chip->usb_icl_votable, JEITA_VOTER, true, 0);
+		else if (pval.intval < (fv_uv - JEITA_SUSPEND_HYST_UV))
+			vote(chip->usb_icl_votable, JEITA_VOTER, false, 0);
+	}
+
+set_jeita_fv:
+	vote(chip->fv_votable, JEITA_VOTER, fv_uv ? true : false, fv_uv);
 
 update_time:
 	chip->jeita_last_update_time = ktime_get();
@@ -618,11 +654,13 @@
 	int reschedule_us;
 	int reschedule_jeita_work_us = 0;
 	int reschedule_step_work_us = 0;
+	union power_supply_propval prop = {0, };
 
 	if (!is_batt_available(chip))
-		return;
+		goto exit_work;
 
 	handle_battery_insertion(chip);
+
 	/* skip elapsed_us debounce for handling battery temperature */
 	rc = handle_jeita(chip);
 	if (rc > 0)
@@ -636,12 +674,28 @@
 	if (rc < 0)
 		pr_err("Couldn't handle step rc = %d\n", rc);
 
+	/* Remove stale votes on USB removal */
+	if (is_usb_available(chip)) {
+		prop.intval = 0;
+		power_supply_get_property(chip->usb_psy,
+				POWER_SUPPLY_PROP_PRESENT, &prop);
+		if (!prop.intval) {
+			if (chip->usb_icl_votable)
+				vote(chip->usb_icl_votable, JEITA_VOTER,
+						false, 0);
+		}
+	}
+
 	reschedule_us = min(reschedule_jeita_work_us, reschedule_step_work_us);
 	if (reschedule_us == 0)
-		__pm_relax(chip->step_chg_ws);
+		goto exit_work;
 	else
 		schedule_delayed_work(&chip->status_change_work,
 				usecs_to_jiffies(reschedule_us));
+	return;
+
+exit_work:
+	__pm_relax(chip->step_chg_ws);
 }
 
 static int step_chg_notifier_call(struct notifier_block *nb,
@@ -653,7 +707,8 @@
 	if (ev != PSY_EVENT_PROP_CHANGED)
 		return NOTIFY_OK;
 
-	if ((strcmp(psy->desc->name, "battery") == 0)) {
+	if ((strcmp(psy->desc->name, "battery") == 0)
+			|| (strcmp(psy->desc->name, "usb") == 0)) {
 		__pm_stay_awake(chip->step_chg_ws);
 		schedule_delayed_work(&chip->status_change_work, 0);
 	}
diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
index 17b808c..1b7af04 100644
--- a/drivers/pwm/core.c
+++ b/drivers/pwm/core.c
@@ -526,9 +526,19 @@
 
 		if (state->period != pwm->state.period ||
 		    state->duty_cycle != pwm->state.duty_cycle) {
-			err = pwm->chip->ops->config(pwm->chip, pwm,
-						     state->duty_cycle,
-						     state->period);
+			if (pwm->chip->ops->config_extend) {
+				err = pwm->chip->ops->config_extend(pwm->chip,
+						pwm, state->duty_cycle,
+						state->period);
+			} else {
+				if (state->period > UINT_MAX)
+					pr_warn("period %llu duty_cycle %llu will be truncated\n",
+							state->period,
+							state->duty_cycle);
+				err = pwm->chip->ops->config(pwm->chip, pwm,
+						state->duty_cycle,
+						state->period);
+			}
 			if (err)
 				return err;
 
@@ -1017,8 +1027,8 @@
 		if (state.enabled)
 			seq_puts(s, " enabled");
 
-		seq_printf(s, " period: %u ns", state.period);
-		seq_printf(s, " duty: %u ns", state.duty_cycle);
+		seq_printf(s, " period: %llu ns", state.period);
+		seq_printf(s, " duty: %llu ns", state.duty_cycle);
 		seq_printf(s, " polarity: %s",
 			   state.polarity ? "inverse" : "normal");
 
diff --git a/drivers/pwm/pwm-qti-lpg.c b/drivers/pwm/pwm-qti-lpg.c
index d24bef1..f5c5e39 100644
--- a/drivers/pwm/pwm-qti-lpg.c
+++ b/drivers/pwm/pwm-qti-lpg.c
@@ -164,7 +164,7 @@
 	u32	prediv;
 	u32	clk_exp;
 	u16	pwm_value;
-	u32	best_period_ns;
+	u64	best_period_ns;
 };
 
 struct qpnp_lpg_lut {
@@ -185,8 +185,8 @@
 	u8				src_sel;
 	u8				subtype;
 	bool				lut_written;
-	int				current_period_ns;
-	int				current_duty_ns;
+	u64				current_period_ns;
+	u64				current_duty_ns;
 };
 
 struct qpnp_lpg_chip {
@@ -723,17 +723,17 @@
 	return rc;
 }
 
-static void __qpnp_lpg_calc_pwm_period(int period_ns,
+static void __qpnp_lpg_calc_pwm_period(u64 period_ns,
 			struct lpg_pwm_config *pwm_config)
 {
 	struct qpnp_lpg_channel *lpg = container_of(pwm_config,
 			struct qpnp_lpg_channel, pwm_config);
 	struct lpg_pwm_config configs[NUM_PWM_SIZE];
 	int i, j, m, n;
-	int tmp1, tmp2;
-	int clk_period_ns = 0, pwm_clk_period_ns;
-	int clk_delta_ns = INT_MAX, min_clk_delta_ns = INT_MAX;
-	int pwm_period_delta = INT_MAX, min_pwm_period_delta = INT_MAX;
+	u64 tmp1, tmp2;
+	u64 clk_period_ns = 0, pwm_clk_period_ns;
+	u64 clk_delta_ns = U64_MAX, min_clk_delta_ns = U64_MAX;
+	u64 pwm_period_delta = U64_MAX, min_pwm_period_delta = U64_MAX;
 	int pwm_size_step;
 
 	/*
@@ -755,7 +755,8 @@
 				for (m = 0; m < ARRAY_SIZE(pwm_exponent); m++) {
 					tmp1 = 1 << pwm_exponent[m];
 					tmp1 *= clk_prediv[j];
-					tmp2 = NSEC_PER_SEC / clk_freq_hz[i];
+					tmp2 = NSEC_PER_SEC;
+					do_div(tmp2, clk_freq_hz[i]);
 
 					clk_period_ns = tmp1 * tmp2;
 
@@ -785,10 +786,7 @@
 
 		configs[n].best_period_ns *= 1 << pwm_size[n];
 		/* Find the closest setting for PWM period */
-		if (min_clk_delta_ns < INT_MAX >> pwm_size[n])
-			pwm_period_delta = min_clk_delta_ns << pwm_size[n];
-		else
-			pwm_period_delta = INT_MAX;
+		pwm_period_delta = min_clk_delta_ns << pwm_size[n];
 		if (pwm_period_delta < min_pwm_period_delta) {
 			min_pwm_period_delta = pwm_period_delta;
 			memcpy(pwm_config, &configs[n],
@@ -806,21 +804,20 @@
 			pwm_config->clk_exp -= pwm_size_step;
 		}
 	}
-	pr_debug("PWM setting for period_ns %d: pwm_clk = %dHZ, prediv = %d, exponent = %d, pwm_size = %d\n",
+	pr_debug("PWM setting for period_ns %llu: pwm_clk = %dHZ, prediv = %d, exponent = %d, pwm_size = %d\n",
 			period_ns, pwm_config->pwm_clk, pwm_config->prediv,
 			pwm_config->clk_exp, pwm_config->pwm_size);
-	pr_debug("Actual period: %dns\n", pwm_config->best_period_ns);
+	pr_debug("Actual period: %lluns\n", pwm_config->best_period_ns);
 }
 
-static void __qpnp_lpg_calc_pwm_duty(int period_ns, int duty_ns,
+static void __qpnp_lpg_calc_pwm_duty(u64 period_ns, u64 duty_ns,
 			struct lpg_pwm_config *pwm_config)
 {
 	u16 pwm_value, max_pwm_value;
+	u64 tmp;
 
-	if ((1 << pwm_config->pwm_size) > (INT_MAX / duty_ns))
-		pwm_value = duty_ns / (period_ns >> pwm_config->pwm_size);
-	else
-		pwm_value = (duty_ns << pwm_config->pwm_size) / period_ns;
+	tmp = (u64)duty_ns << pwm_config->pwm_size;
+	pwm_value = (u16)div64_u64(tmp, period_ns);
 
 	max_pwm_value = (1 << pwm_config->pwm_size) - 1;
 	if (pwm_value > max_pwm_value)
@@ -828,20 +825,13 @@
 	pwm_config->pwm_value = pwm_value;
 }
 
-static int qpnp_lpg_pwm_config(struct pwm_chip *pwm_chip,
-		struct pwm_device *pwm, int duty_ns, int period_ns)
+static int qpnp_lpg_config(struct qpnp_lpg_channel *lpg,
+		u64 duty_ns, u64 period_ns)
 {
-	struct qpnp_lpg_channel *lpg;
-	int rc = 0;
-
-	lpg = pwm_dev_to_qpnp_lpg(pwm_chip, pwm);
-	if (lpg == NULL) {
-		dev_err(pwm_chip->dev, "lpg not found\n");
-		return -ENODEV;
-	}
+	int rc;
 
 	if (duty_ns > period_ns) {
-		dev_err(pwm_chip->dev, "Duty %dns is larger than period %dns\n",
+		dev_err(lpg->chip->dev, "Duty %lluns is larger than period %lluns\n",
 						duty_ns, period_ns);
 		return -EINVAL;
 	}
@@ -855,7 +845,7 @@
 					lpg->ramp_config.pattern,
 					lpg->ramp_config.pattern_length);
 			if (rc < 0) {
-				dev_err(pwm_chip->dev, "set LUT pattern failed for LPG%d, rc=%d\n",
+				dev_err(lpg->chip->dev, "set LUT pattern failed for LPG%d, rc=%d\n",
 						lpg->lpg_idx, rc);
 				return rc;
 			}
@@ -869,7 +859,7 @@
 
 	rc = qpnp_lpg_set_pwm_config(lpg);
 	if (rc < 0) {
-		dev_err(pwm_chip->dev, "Config PWM failed for channel %d, rc=%d\n",
+		dev_err(lpg->chip->dev, "Config PWM failed for channel %d, rc=%d\n",
 						lpg->lpg_idx, rc);
 		return rc;
 	}
@@ -880,6 +870,34 @@
 	return rc;
 }
 
+static int qpnp_lpg_pwm_config(struct pwm_chip *pwm_chip,
+		struct pwm_device *pwm, int duty_ns, int period_ns)
+{
+	struct qpnp_lpg_channel *lpg;
+
+	lpg = pwm_dev_to_qpnp_lpg(pwm_chip, pwm);
+	if (lpg == NULL) {
+		dev_err(pwm_chip->dev, "lpg not found\n");
+		return -ENODEV;
+	}
+
+	return qpnp_lpg_config(lpg, (u64)duty_ns, (u64)period_ns);
+}
+
+static int qpnp_lpg_pwm_config_extend(struct pwm_chip *pwm_chip,
+		struct pwm_device *pwm, u64 duty_ns, u64 period_ns)
+{
+	struct qpnp_lpg_channel *lpg;
+
+	lpg = pwm_dev_to_qpnp_lpg(pwm_chip, pwm);
+	if (lpg == NULL) {
+		dev_err(pwm_chip->dev, "lpg not found\n");
+		return -ENODEV;
+	}
+
+	return qpnp_lpg_config(lpg, duty_ns, period_ns);
+}
+
 static int qpnp_lpg_pbs_trigger_enable(struct qpnp_lpg_channel *lpg, bool en)
 {
 	struct qpnp_lpg_chip *chip = lpg->chip;
@@ -1065,8 +1083,9 @@
 	struct pwm_device *pwm, struct pwm_output_pattern *output_pattern)
 {
 	struct qpnp_lpg_channel *lpg;
-	int rc = 0, i, period_ns, duty_ns;
+	u64 period_ns, duty_ns, tmp;
 	u32 *percentages;
+	int rc = 0, i;
 
 	lpg = pwm_dev_to_qpnp_lpg(pwm_chip, pwm);
 	if (lpg == NULL) {
@@ -1086,19 +1105,17 @@
 	if (!percentages)
 		return -ENOMEM;
 
-	period_ns = pwm_get_period(pwm);
+	period_ns = pwm_get_period_extend(pwm);
 	for (i = 0; i < output_pattern->num_entries; i++) {
 		duty_ns = output_pattern->duty_pattern[i];
 		if (duty_ns > period_ns) {
-			dev_err(lpg->chip->dev, "duty %dns is larger than period %dns\n",
+			dev_err(lpg->chip->dev, "duty %lluns is larger than period %lluns\n",
 					duty_ns, period_ns);
 			goto err;
 		}
 		/* Translate the pattern in duty_ns to percentage */
-		if ((INT_MAX / duty_ns) < 100)
-			percentages[i] = duty_ns / (period_ns / 100);
-		else
-			percentages[i] = (duty_ns * 100) / period_ns;
+		tmp = (u64)duty_ns * 100;
+		percentages[i] = (u32)div64_u64(tmp, period_ns);
 	}
 
 	rc = qpnp_lpg_set_lut_pattern(lpg, percentages,
@@ -1114,12 +1131,10 @@
 			output_pattern->num_entries);
 	lpg->ramp_config.hi_idx = lpg->ramp_config.lo_idx +
 				output_pattern->num_entries - 1;
-	if ((INT_MAX / period_ns) > output_pattern->cycles_per_duty)
-		lpg->ramp_config.step_ms = output_pattern->cycles_per_duty *
-			period_ns / NSEC_PER_MSEC;
-	else
-		lpg->ramp_config.step_ms = (period_ns / NSEC_PER_MSEC) *
-			output_pattern->cycles_per_duty;
+
+	tmp = (u64)output_pattern->cycles_per_duty * period_ns;
+	do_div(tmp, NSEC_PER_MSEC);
+	lpg->ramp_config.step_ms = (u16)tmp;
 
 	rc = qpnp_lpg_set_ramp_config(lpg);
 	if (rc < 0)
@@ -1241,8 +1256,8 @@
 		seq_printf(s, "     prediv = %d\n", cfg->prediv);
 		seq_printf(s, "     exponent = %d\n", cfg->clk_exp);
 		seq_printf(s, "     pwm_value = %d\n", cfg->pwm_value);
-		seq_printf(s, "  Requested period: %dns, best period = %dns\n",
-				pwm_get_period(pwm), cfg->best_period_ns);
+		seq_printf(s, "  Requested period: %lluns, best period = %lluns\n",
+			pwm_get_period_extend(pwm), cfg->best_period_ns);
 
 		ramp = &lpg->ramp_config;
 		if (pwm_get_output_type(pwm) == PWM_OUTPUT_MODULATED) {
@@ -1273,6 +1288,7 @@
 
 static const struct pwm_ops qpnp_lpg_pwm_ops = {
 	.config = qpnp_lpg_pwm_config,
+	.config_extend = qpnp_lpg_pwm_config_extend,
 	.get_output_type_supported = qpnp_lpg_pwm_output_types_supported,
 	.set_output_type = qpnp_lpg_pwm_set_output_type,
 	.set_output_pattern = qpnp_lpg_pwm_set_output_pattern,
diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
index ea2b53d..50b7a3b 100644
--- a/drivers/pwm/sysfs.c
+++ b/drivers/pwm/sysfs.c
@@ -50,7 +50,7 @@
 
 	pwm_get_state(pwm, &state);
 
-	return sprintf(buf, "%u\n", state.period);
+	return sprintf(buf, "%llu\n", state.period);
 }
 
 static ssize_t period_store(struct device *child,
@@ -85,7 +85,7 @@
 
 	pwm_get_state(pwm, &state);
 
-	return sprintf(buf, "%u\n", state.duty_cycle);
+	return sprintf(buf, "%llu\n", state.duty_cycle);
 }
 
 static ssize_t duty_cycle_store(struct device *child,
@@ -220,7 +220,7 @@
 	if (ret)
 		return ret;
 
-	return sprintf(buf, "%u %u\n", result.period, result.duty_cycle);
+	return sprintf(buf, "%llu %llu\n", result.period, result.duty_cycle);
 }
 
 static ssize_t output_type_show(struct device *child,
diff --git a/drivers/regulator/qpnp-lcdb-regulator.c b/drivers/regulator/qpnp-lcdb-regulator.c
index 4e8d6f9..a0f0fcec 100644
--- a/drivers/regulator/qpnp-lcdb-regulator.c
+++ b/drivers/regulator/qpnp-lcdb-regulator.c
@@ -1151,6 +1151,7 @@
 		return rc;
 	}
 
+	val &= SET_OUTPUT_VOLTAGE_MASK;
 	if (val < VOLTAGE_STEP_50MV_OFFSET) {
 		*voltage_mv = VOLTAGE_MIN_STEP_100_MV +
 				(val * VOLTAGE_STEP_100_MV);
@@ -1826,7 +1827,7 @@
 
 		if (lcdb->bst.pd_strength != -EINVAL) {
 			rc = qpnp_lcdb_masked_write(lcdb, lcdb->base +
-				LCDB_NCP_PD_CTL_REG, BOOST_PD_STRENGTH_BIT,
+				LCDB_BST_PD_CTL_REG, BOOST_PD_STRENGTH_BIT,
 				lcdb->bst.pd_strength ?
 				BOOST_PD_STRENGTH_BIT : 0);
 			if (rc < 0) {
diff --git a/drivers/rtc/qpnp-rtc.c b/drivers/rtc/qpnp-rtc.c
index 4152086..06833ef 100644
--- a/drivers/rtc/qpnp-rtc.c
+++ b/drivers/rtc/qpnp-rtc.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2015, 2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2015, 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -374,6 +374,15 @@
 				alarm->time.tm_sec, alarm->time.tm_mday,
 				alarm->time.tm_mon, alarm->time.tm_year);
 
+	rc = qpnp_read_wrapper(rtc_dd, value,
+		rtc_dd->alarm_base + REG_OFFSET_ALARM_CTRL1, 1);
+	if (rc) {
+		dev_err(dev, "Read from ALARM CTRL1 failed\n");
+		return rc;
+	}
+
+	alarm->enabled = !!(value[0] & BIT_RTC_ALARM_ENABLE);
+
 	return 0;
 }
 
diff --git a/drivers/soc/qcom/bg_rsb.c b/drivers/soc/qcom/bg_rsb.c
index ffba372..1b5830a 100644
--- a/drivers/soc/qcom/bg_rsb.c
+++ b/drivers/soc/qcom/bg_rsb.c
@@ -83,6 +83,8 @@
 	struct input_dev *input;
 	struct mutex glink_mutex;
 
+	struct mutex rsb_state_mutex;
+
 	enum bgrsb_state bgrsb_current_state;
 	enum glink_link_state link_state;
 
@@ -651,9 +653,10 @@
 	struct bgrsb_priv *dev = container_of(work, struct bgrsb_priv,
 								rsb_up_work);
 
+	mutex_lock(&dev->rsb_state_mutex);
 	if (dev->bgrsb_current_state != BGRSB_STATE_RSB_CONFIGURED) {
 		pr_err("BG is not yet configured for RSB\n");
-		return;
+		goto unlock;
 	}
 
 	if (bgrsb_ldo_work(dev, BGRSB_ENABLE_LDO15) == 0) {
@@ -663,7 +666,7 @@
 			pr_err("Failed to send enable command to BG\n");
 			bgrsb_ldo_work(dev, BGRSB_DISABLE_LDO15);
 			dev->bgrsb_current_state = BGRSB_STATE_RSB_CONFIGURED;
-			return;
+			goto unlock;
 		}
 	}
 	dev->bgrsb_current_state = BGRSB_STATE_RSB_ENABLED;
@@ -673,6 +676,9 @@
 		dev->calibration_needed = false;
 		queue_work(dev->bgrsb_wq, &dev->rsb_calibration_work);
 	}
+unlock:
+	mutex_unlock(&dev->rsb_state_mutex);
+
 }
 
 static void bgrsb_disable_rsb(struct work_struct *work)
@@ -681,20 +687,24 @@
 	struct bgrsb_priv *dev = container_of(work, struct bgrsb_priv,
 								rsb_down_work);
 
+	mutex_lock(&dev->rsb_state_mutex);
 	if (dev->bgrsb_current_state == BGRSB_STATE_RSB_ENABLED) {
 
 		rc = bgrsb_enable(dev, false);
 		if (rc != 0) {
 			pr_err("Failed to send disable command to BG\n");
-			return;
+			goto unlock;
 		}
 
 		if (bgrsb_ldo_work(dev, BGRSB_DISABLE_LDO15) != 0)
-			return;
+			goto unlock;
 
 		dev->bgrsb_current_state = BGRSB_STATE_RSB_CONFIGURED;
 		pr_debug("RSB Disabled\n");
 	}
+
+unlock:
+	mutex_unlock(&dev->rsb_state_mutex);
 }
 
 static void bgrsb_calibration(struct work_struct *work)
@@ -763,13 +773,9 @@
 
 	switch (val) {
 	case BGRSB_POWER_DISABLE:
-		if (dev->bgrsb_current_state == BGRSB_STATE_RSB_CONFIGURED)
-			return 0;
 		queue_work(dev->bgrsb_wq, &dev->rsb_down_work);
 		break;
 	case BGRSB_POWER_ENABLE:
-		if (dev->bgrsb_current_state == BGRSB_STATE_RSB_ENABLED)
-			return 0;
 		queue_work(dev->bgrsb_wq, &dev->rsb_up_work);
 		break;
 	case BGRSB_POWER_CALIBRATION:
@@ -857,6 +863,7 @@
 	dev->chnl.chnl_edge = "bg";
 	dev->chnl.chnl_trnsprt = "bgcom";
 	mutex_init(&dev->glink_mutex);
+	mutex_init(&dev->rsb_state_mutex);
 	dev->link_state = GLINK_LINK_STATE_DOWN;
 
 	dev->ldo_action = BGRSB_NO_ACTION;
@@ -981,18 +988,24 @@
 	struct platform_device *pdev = to_platform_device(pldev);
 	struct bgrsb_priv *dev = platform_get_drvdata(pdev);
 
+	mutex_lock(&dev->rsb_state_mutex);
 	if (dev->bgrsb_current_state == BGRSB_STATE_RSB_CONFIGURED)
-		return 0;
+		goto ret_success;
 
 	if (dev->bgrsb_current_state == BGRSB_STATE_INIT) {
 		if (bgrsb_ldo_work(dev, BGRSB_ENABLE_LDO11) == 0) {
 			dev->bgrsb_current_state = BGRSB_STATE_RSB_CONFIGURED;
 			pr_debug("RSB Cofigured\n");
-			return 0;
+			goto ret_success;
 		}
 		pr_err("RSB failed to resume\n");
 	}
+	mutex_unlock(&dev->rsb_state_mutex);
 	return -EINVAL;
+
+ret_success:
+	mutex_unlock(&dev->rsb_state_mutex);
+	return 0;
 }
 
 static int bg_rsb_suspend(struct device *pldev)
@@ -1000,8 +1013,9 @@
 	struct platform_device *pdev = to_platform_device(pldev);
 	struct bgrsb_priv *dev = platform_get_drvdata(pdev);
 
+	mutex_lock(&dev->rsb_state_mutex);
 	if (dev->bgrsb_current_state == BGRSB_STATE_INIT)
-		return 0;
+		goto ret_success;
 
 	if (dev->bgrsb_current_state == BGRSB_STATE_RSB_ENABLED) {
 		if (bgrsb_ldo_work(dev, BGRSB_DISABLE_LDO15) != 0)
@@ -1011,12 +1025,17 @@
 	if (bgrsb_ldo_work(dev, BGRSB_DISABLE_LDO11) == 0) {
 		dev->bgrsb_current_state = BGRSB_STATE_INIT;
 		pr_debug("RSB Init\n");
-		return 0;
+		goto ret_success;
 	}
 
 ret_err:
 	pr_err("RSB failed to suspend\n");
+	mutex_unlock(&dev->rsb_state_mutex);
 	return -EINVAL;
+
+ret_success:
+	mutex_unlock(&dev->rsb_state_mutex);
+	return 0;
 }
 
 static const struct of_device_id bg_rsb_of_match[] = {
diff --git a/drivers/soc/qcom/dcc_v2.c b/drivers/soc/qcom/dcc_v2.c
index 279461d..afe304d 100644
--- a/drivers/soc/qcom/dcc_v2.c
+++ b/drivers/soc/qcom/dcc_v2.c
@@ -162,6 +162,28 @@
 	return 0;
 }
 
+static void dcc_sram_memset(const struct device *dev, void __iomem *dst,
+			    int c, size_t count)
+{
+	u64 qc = (u8)c;
+
+	qc |= qc << 8;
+	qc |= qc << 16;
+
+	if (!count || !IS_ALIGNED((unsigned long)dst, 4)
+	    || !IS_ALIGNED((unsigned long)count, 4)) {
+		dev_err(dev,
+			"Target address or size not aligned with 4 bytes");
+		return;
+	}
+
+	while (count >= 4) {
+		__raw_writel_no_log(qc, dst);
+		dst += 4;
+		count -= 4;
+	}
+}
+
 static bool dcc_ready(struct dcc_drvdata *drvdata)
 {
 	uint32_t val;
@@ -529,7 +551,7 @@
 	return 0;
 overstep:
 	ret = -EINVAL;
-	memset_io(drvdata->ram_base, 0, drvdata->ram_size);
+	dcc_sram_memset(drvdata->dev, drvdata->ram_base, 0, drvdata->ram_size);
 	dev_err(drvdata->dev, "DCC SRAM oversteps, 0x%x (0x%x)\n",
 		sram_offset, drvdata->ram_size);
 err:
@@ -587,7 +609,8 @@
 
 	mutex_lock(&drvdata->mutex);
 
-	memset_io(drvdata->ram_base, 0xDE, drvdata->ram_size);
+	dcc_sram_memset(drvdata->dev, drvdata->ram_base, 0xDE,
+			drvdata->ram_size);
 
 	for (list = 0; list < DCC_MAX_LINK_LIST; list++) {
 
@@ -1647,7 +1670,7 @@
 		drvdata->nr_config[i] = 0;
 	}
 
-	memset_io(drvdata->ram_base, 0, drvdata->ram_size);
+	dcc_sram_memset(drvdata->dev, drvdata->ram_base, 0, drvdata->ram_size);
 
 	drvdata->data_sink = DCC_DATA_SINK_SRAM;
 	ret = of_property_read_string(pdev->dev.of_node, "qcom,data-sink",
diff --git a/drivers/soc/qcom/glink_spi_xprt.c b/drivers/soc/qcom/glink_spi_xprt.c
index a08c4bf..efcd94cd 100644
--- a/drivers/soc/qcom/glink_spi_xprt.c
+++ b/drivers/soc/qcom/glink_spi_xprt.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2016-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2016-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -484,6 +484,13 @@
 	int ret;
 
 	read_id = einfo->rx_fifo_read;
+	if ((read_id > (einfo->rx_fifo_start + einfo->fifo_size)) ||
+		(read_id < einfo->rx_fifo_start)) {
+		pr_err("%s: Invalid rx_fifo_read: %d, start: %d, size: %d\n",
+			__func__, read_id, einfo->rx_fifo_start,
+			einfo->fifo_size);
+		return -EINVAL;
+	}
 	do {
 		if ((read_id + size_to_read) >=
 		    (einfo->rx_fifo_start + einfo->fifo_size))
@@ -722,11 +729,11 @@
 	struct rx_short_data_desc {
 		unsigned char data[SHORT_PKT_SIZE];
 	};
-	struct command *cmd;
+	struct command *cmd = NULL;
 	struct intent_desc *intents;
 	struct rx_desc *rx_descp;
 	struct rx_short_data_desc *rx_sd_descp;
-	int offset = 0;
+	uint64_t offset = 0;
 	int rcu_id;
 	uint16_t rcid;
 	uint16_t name_len;
@@ -742,6 +749,8 @@
 	}
 
 	while (offset < rx_size) {
+		if (offset + sizeof(*cmd) > rx_size)
+			goto err;
 		cmd = (struct command *)(rx_data + offset);
 		offset += sizeof(*cmd);
 		switch (cmd->id) {
@@ -760,7 +769,12 @@
 		case OPEN_CMD:
 			rcid = cmd->param1;
 			name_len = (uint16_t)(cmd->param2 & 0xFFFF);
+			if (name_len > GLINK_NAME_SIZE)
+				goto err;
 			prio = (uint16_t)((cmd->param2 & 0xFFFF0000) >> 16);
+			if (offset + ALIGN(name_len, FIFO_ALIGNMENT) >
+				rx_size)
+				goto err;
 			name = (char *)(rx_data + offset);
 			offset += ALIGN(name_len, FIFO_ALIGNMENT);
 			einfo->xprt_if.glink_core_if_ptr->rx_cmd_ch_remote_open(
@@ -786,6 +800,8 @@
 
 		case RX_INTENT_CMD:
 			for (i = 0; i < cmd->param2; i++) {
+				if (offset + sizeof(*intents) > rx_size)
+					goto err;
 				intents = (struct intent_desc *)
 						(rx_data + offset);
 				offset += sizeof(*intents);
@@ -821,6 +837,8 @@
 		case TX_DATA_CONT_CMD:
 		case TRACER_PKT_CMD:
 		case TRACER_PKT_CONT_CMD:
+			if (offset + sizeof(*rx_descp) > rx_size)
+				goto err;
 			rx_descp = (struct rx_desc *)(rx_data + offset);
 			offset += sizeof(*rx_descp);
 			process_rx_data(einfo, cmd->id, cmd->param1,
@@ -830,6 +848,8 @@
 			break;
 
 		case TX_SHORT_DATA_CMD:
+			if (offset + sizeof(*rx_sd_descp) > rx_size)
+				goto err;
 			rx_sd_descp = (struct rx_short_data_desc *)
 							(rx_data + offset);
 			offset += sizeof(*rx_sd_descp);
@@ -858,6 +878,13 @@
 		}
 	}
 	srcu_read_unlock(&einfo->use_ref, rcu_id);
+	return;
+err:
+	srcu_read_unlock(&einfo->use_ref, rcu_id);
+	if (cmd)
+		pr_err("%s: invalid size of rx_data: %d, cmd : %d\n",
+			__func__, rx_size, cmd->id);
+	return;
 }
 
 /**
diff --git a/drivers/soc/qcom/icnss.c b/drivers/soc/qcom/icnss.c
index 7286f08..7a7cdda 100644
--- a/drivers/soc/qcom/icnss.c
+++ b/drivers/soc/qcom/icnss.c
@@ -2508,6 +2508,7 @@
 static int icnss_driver_event_early_crash_ind(struct icnss_priv *priv,
 					      void *data)
 {
+	struct icnss_uevent_fw_down_data fw_down_data = {0};
 	int ret = 0;
 
 	if (!test_bit(ICNSS_WLFW_EXISTS, &priv->state)) {
@@ -2515,6 +2516,13 @@
 		goto out;
 	}
 
+	if (test_bit(ICNSS_FW_READY, &priv->state) &&
+	    !test_bit(ICNSS_DRIVER_UNLOADING, &priv->state)) {
+		fw_down_data.crashed = true;
+		icnss_call_driver_uevent(priv, ICNSS_UEVENT_FW_DOWN,
+					 &fw_down_data);
+	}
+
 	priv->early_crash_ind = true;
 	icnss_fw_crashed(priv, NULL);
 
diff --git a/drivers/soc/qcom/peripheral-loader.c b/drivers/soc/qcom/peripheral-loader.c
index 8776379..384ac58 100644
--- a/drivers/soc/qcom/peripheral-loader.c
+++ b/drivers/soc/qcom/peripheral-loader.c
@@ -849,8 +849,11 @@
 		if (fw->size != seg->filesz) {
 			pil_err(desc, "Blob size %u doesn't match %lu\n",
 					ret, seg->filesz);
+			release_firmware(fw);
 			return -EPERM;
 		}
+
+		release_firmware(fw);
 	}
 
 	/* Zero out trailing memory */
diff --git a/drivers/soc/qcom/secure_buffer.c b/drivers/soc/qcom/secure_buffer.c
index 1c8bc51..5b82c0b 100644
--- a/drivers/soc/qcom/secure_buffer.c
+++ b/drivers/soc/qcom/secure_buffer.c
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2011 Google, Inc
- * Copyright (c) 2011-2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -142,7 +142,8 @@
 		 * secure environment to ensure the data is actually present
 		 * in RAM
 		 */
-		dmac_flush_range(chunk_list, chunk_list + chunk_list_len);
+		dmac_flush_range(chunk_list,
+			(void *)chunk_list + chunk_list_len);
 
 		ret = secure_buffer_change_chunk(chunk_list_phys,
 				nchunks, V2_CHUNK_SIZE, lock);
diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c
index fffef10..f6a28c0 100644
--- a/drivers/soc/qcom/socinfo.c
+++ b/drivers/soc/qcom/socinfo.c
@@ -633,6 +633,8 @@
 	[363] = {MSM_CPU_SDA439, "SDA439"},
 	[364] = {MSM_CPU_SDA429, "SDA429"},
 
+	/* QM215 ID */
+	[386] = {MSM_CPU_QM215, "QM215"},
 	/* Uninitialized IDs are not known to run Linux.
 	 * MSM_CPU_UNKNOWN is set to 0 to ensure these IDs are
 	 * considered as unknown CPU.
@@ -1612,6 +1614,10 @@
 		dummy_socinfo.id = 290;
 		strlcpy(dummy_socinfo.build_id, "mdm9607 - ",
 				sizeof(dummy_socinfo.build_id));
+	} else if (early_machine_is_qm215()) {
+		dummy_socinfo.id = 386;
+		strlcpy(dummy_socinfo.build_id, "qm215 - ",
+				sizeof(dummy_socinfo.build_id));
 	}
 
 	strlcat(dummy_socinfo.build_id, "Dummy socinfo",
diff --git a/drivers/staging/android/ion/ion_carveout_heap.c b/drivers/staging/android/ion/ion_carveout_heap.c
index 492a93d..09bae03 100644
--- a/drivers/staging/android/ion/ion_carveout_heap.c
+++ b/drivers/staging/android/ion/ion_carveout_heap.c
@@ -160,7 +160,9 @@
 	.unmap_kernel = ion_heap_unmap_kernel,
 };
 
-struct ion_heap *ion_carveout_heap_create(struct ion_platform_heap *heap_data)
+static struct ion_heap *__ion_carveout_heap_create(
+					struct ion_platform_heap *heap_data,
+					bool sync)
 {
 	struct ion_carveout_heap *carveout_heap;
 	int ret;
@@ -172,7 +174,8 @@
 	page = pfn_to_page(PFN_DOWN(heap_data->base));
 	size = heap_data->size;
 
-	ion_pages_sync_for_device(dev, page, size, DMA_BIDIRECTIONAL);
+	if (sync)
+		ion_pages_sync_for_device(dev, page, size, DMA_BIDIRECTIONAL);
 
 	ret = ion_heap_pages_zero(page, size, pgprot_writecombine(PAGE_KERNEL));
 	if (ret)
@@ -197,6 +200,11 @@
 	return &carveout_heap->heap;
 }
 
+struct ion_heap *ion_carveout_heap_create(struct ion_platform_heap *heap_data)
+{
+	return __ion_carveout_heap_create(heap_data, true);
+}
+
 void ion_carveout_heap_destroy(struct ion_heap *heap)
 {
 	struct ion_carveout_heap *carveout_heap =
@@ -362,7 +370,7 @@
 	heap_data.size = size;
 
 	/* This will zero memory initially */
-	entry->heap = ion_carveout_heap_create(&heap_data);
+	entry->heap = __ion_carveout_heap_create(&heap_data, false);
 	if (IS_ERR(entry->heap))
 		goto out_free;
 
diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 10ae7eb..bbe643a 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -846,6 +846,7 @@
 #define DWC3_GSI_EVT_BUF_SETUP			11
 #define DWC3_GSI_EVT_BUF_CLEANUP		12
 #define DWC3_GSI_EVT_BUF_FREE			13
+#define DWC3_CONTROLLER_NOTIFY_CLEAR_DB		14
 
 #define MAX_INTR_STATS				10
 
diff --git a/drivers/usb/dwc3/dwc3-msm.c b/drivers/usb/dwc3/dwc3-msm.c
index 5aaf856..d53dc92 100644
--- a/drivers/usb/dwc3/dwc3-msm.c
+++ b/drivers/usb/dwc3/dwc3-msm.c
@@ -1337,7 +1337,7 @@
 */
 static bool gsi_check_ready_to_suspend(struct usb_ep *ep, bool f_suspend)
 {
-	u32	timeout = 1500;
+	u32	timeout = 500;
 	u32	reg = 0;
 	struct dwc3_ep *dep = to_dwc3_ep(ep);
 	struct dwc3 *dwc = dep->dwc;
@@ -1350,6 +1350,7 @@
 			"Unable to suspend GSI ch. WR_CTRL_STATE != 0\n");
 			return false;
 		}
+		usleep_range(20, 22);
 	}
 	/* Check for U3 only if we are not handling Function Suspend */
 	if (!f_suspend) {
@@ -2026,6 +2027,11 @@
 	case DWC3_CONTROLLER_NOTIFY_DISABLE_UPDXFER:
 		dwc3_msm_dbm_disable_updxfer(dwc, value);
 		break;
+	case DWC3_CONTROLLER_NOTIFY_CLEAR_DB:
+		dev_dbg(mdwc->dev, "DWC3_CONTROLLER_NOTIFY_CLEAR_DB\n");
+		dwc3_msm_write_reg_field(mdwc->base,
+			GSI_GENERAL_CFG_REG, BLOCK_GSI_WR_GO_MASK, true);
+		break;
 	default:
 		dev_dbg(mdwc->dev, "unknown dwc3 event\n");
 		break;
@@ -2139,6 +2145,7 @@
 		reg = dwc3_msm_read_reg(mdwc->base, PWR_EVNT_IRQ_STAT_REG);
 		if (reg & PWR_EVNT_LPM_IN_L2_MASK)
 			break;
+		usleep_range(20, 30);
 	}
 	if (!(reg & PWR_EVNT_LPM_IN_L2_MASK))
 		dev_err(mdwc->dev, "could not transition HS PHY to L2\n");
@@ -2322,6 +2329,13 @@
 		return -EBUSY;
 	}
 
+	if (!mdwc->in_host_mode && (mdwc->vbus_active && !mdwc->suspend)) {
+		dev_dbg(mdwc->dev,
+			"Received wakeup event before the core suspend\n");
+		mutex_unlock(&mdwc->suspend_resume_mutex);
+		return -EBUSY;
+	}
+
 	ret = dwc3_msm_prepare_suspend(mdwc);
 	if (ret) {
 		mutex_unlock(&mdwc->suspend_resume_mutex);
@@ -3139,8 +3153,8 @@
 	return ret;
 }
 
-#define SMMU_BASE	0x60000000 /* Device address range base */
-#define SMMU_SIZE	0x90000000 /* Device address range size */
+#define SMMU_BASE	0x90000000 /* Device address range base */
+#define SMMU_SIZE	0x60000000 /* Device address range size */
 
 static int dwc3_msm_init_iommu(struct dwc3_msm *mdwc)
 {
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index e6c89a3..e8e5c32 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3042,6 +3042,9 @@
 		if (!(dep->flags & DWC3_EP_ENABLED))
 			continue;
 
+		if (dep->endpoint.ep_type == EP_TYPE_GSI && dep->direction)
+			dwc3_notify_event(dwc,
+					DWC3_CONTROLLER_NOTIFY_CLEAR_DB, 0);
 		dwc3_remove_requests(dwc, dep);
 	}
 }
@@ -3354,8 +3357,11 @@
 
 		/*
 		 * In case of remote wake up dwc3_gadget_wakeup_work()
-		 * is doing pm_runtime_get_sync().
+		 * is doing pm_runtime_get_sync(). But mark last wakeup
+		 * event here to prevent runtime_suspend happening before this
+		 * wakeup event is processed.
 		 */
+		pm_runtime_mark_last_busy(dwc->dev);
 		dev_dbg(dwc->dev, "Notify OTG from %s\n", __func__);
 		dwc->b_suspend = false;
 		dwc3_notify_event(dwc,
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index b5d9131..8bdbf5f 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -660,18 +660,10 @@
 	w_value &= 0xff;
 
 	pos = &cdev->configs;
-	c = cdev->os_desc_config;
-	if (c)
-		goto check_config;
 
 	while ((pos = pos->next) !=  &cdev->configs) {
 		c = list_entry(pos, typeof(*c), list);
 
-		/* skip OS Descriptors config which is handled separately */
-		if (c == cdev->os_desc_config)
-			continue;
-
-check_config:
 		/* ignore configs that won't work at this speed */
 		switch (speed) {
 		case USB_SPEED_SUPER_PLUS:
@@ -1624,6 +1616,9 @@
 	struct usb_function *f;
 	int j;
 
+	if (interface >= c->next_interface_id)
+		return -EINVAL;
+
 	f = c->interface[interface];
 	for (j = 0; j < f->os_desc_n; ++j) {
 		struct usb_os_desc *d;
@@ -1643,6 +1638,9 @@
 	struct usb_os_desc *d;
 	int j, res;
 
+	if (interface >= c->next_interface_id)
+		return -EINVAL;
+
 	res = 10; /* header length */
 	f = c->interface[interface];
 	for (j = 0; j < f->os_desc_n; ++j) {
@@ -2035,6 +2033,8 @@
 				if (w_length == 0x0A) {
 					count = count_ext_prop(os_desc_cfg,
 						interface);
+					if (count < 0)
+						return count;
 					put_unaligned_le16(count, buf + 8);
 					count = len_ext_prop(os_desc_cfg,
 						interface);
@@ -2044,6 +2044,8 @@
 				} else {
 					count = count_ext_prop(os_desc_cfg,
 						interface);
+					if (count < 0)
+						return count;
 					put_unaligned_le16(count, buf + 8);
 					count = len_ext_prop(os_desc_cfg,
 						interface);
diff --git a/drivers/usb/gadget/function/f_gsi.c b/drivers/usb/gadget/function/f_gsi.c
index 5222f79..0065c06 100644
--- a/drivers/usb/gadget/function/f_gsi.c
+++ b/drivers/usb/gadget/function/f_gsi.c
@@ -2418,8 +2418,13 @@
 		if (alt == 0 && ((gsi->d_port.in_ep &&
 				!gsi->d_port.in_ep->driver_data) ||
 				(gsi->d_port.out_ep &&
-				!gsi->d_port.out_ep->driver_data)))
+				!gsi->d_port.out_ep->driver_data))) {
 			ipa_disconnect_handler(&gsi->d_port);
+			post_event(&gsi->d_port, EVT_DISCONNECTED);
+			queue_work(gsi->d_port.ipa_usb_wq,
+				&gsi->d_port.usb_ipa_w);
+			log_event_dbg("%s: Disconnecting\n", __func__);
+		}
 
 		gsi->data_interface_up = alt;
 		log_event_dbg("DATA_INTERFACE id = %d, status = %d",
@@ -2506,11 +2511,11 @@
 		return;
 	}
 
-	/*
-	 * GPS doesn't use any data interface, hence bail out as there is no
-	 * GSI specific handling needed.
+	/* For functions such as MBIM that support alternate data
+	 * interface, suspend/resume handling becomes a no-op if the
+	 * data interface is not selected.
 	 */
-	if (gsi->prot_id == USB_PROT_GPS_CTRL) {
+	if (!gsi->data_interface_up) {
 		log_event_dbg("%s: suspend done\n", __func__);
 		usb_gsi_check_pending_wakeup(f);
 		return;
@@ -2550,7 +2555,7 @@
 	/* Check any pending cpkt, and queue immediately on resume */
 	gsi_ctrl_send_notification(gsi);
 
-	if (gsi->prot_id == USB_PROT_GPS_CTRL) {
+	if (!gsi->data_interface_up) {
 		log_event_dbg("%s: resume done\n", __func__);
 		return;
 	}
diff --git a/drivers/usb/gadget/function/f_qc_rndis.c b/drivers/usb/gadget/function/f_qc_rndis.c
index df26403..dddf89e 100644
--- a/drivers/usb/gadget/function/f_qc_rndis.c
+++ b/drivers/usb/gadget/function/f_qc_rndis.c
@@ -6,7 +6,7 @@
  * Copyright (C) 2008 Nokia Corporation
  * Copyright (C) 2009 Samsung Electronics
  *			Author: Michal Nazarewicz (mina86@mina86.com)
- * Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2
@@ -913,6 +913,13 @@
 	int			status;
 	struct usb_ep		*ep;
 
+	status = rndis_ipa_init(&rndis_ipa_params);
+	if (status) {
+		pr_err("%s: failed to init rndis_ipa\n", __func__);
+		return status;
+	}
+
+	rndis_ipa_supported = true;
 	/* maybe allocate device-global string IDs */
 	if (rndis_qc_string_defs[0].id == 0) {
 
@@ -1196,11 +1203,8 @@
 	struct f_rndis_qc_opts *opts = container_of(fi,
 				struct f_rndis_qc_opts, func_inst);
 	struct f_rndis_qc	*rndis;
-	int		status;
 
 	/* allocate and initialize one new instance */
-	status = -ENOMEM;
-
 	opts = container_of(fi, struct f_rndis_qc_opts, func_inst);
 
 	opts->refcnt++;
@@ -1214,7 +1218,6 @@
 	pr_debug("setting host_ethaddr=%pM, device_ethaddr=%pM\n",
 		rndis_ipa_params.host_ethaddr,
 		rndis_ipa_params.device_ethaddr);
-	rndis_ipa_supported = true;
 	ether_addr_copy(rndis->ethaddr, rndis_ipa_params.host_ethaddr);
 	rndis_ipa_params.device_ready_notify = rndis_net_ready_notify;
 
@@ -1256,19 +1259,9 @@
 	rndis->func.resume = rndis_qc_resume;
 	rndis->func.free_func = rndis_qc_free;
 
-	status = rndis_ipa_init(&rndis_ipa_params);
-	if (status) {
-		pr_err("%s: failed to init rndis_ipa\n", __func__);
-		goto fail;
-	}
-
 	_rndis_qc = rndis;
 
 	return &rndis->func;
-fail:
-	kfree(rndis);
-	_rndis_qc = NULL;
-	return ERR_PTR(status);
 }
 
 static struct usb_function *qcrndis_alloc(struct usb_function_instance *fi)
diff --git a/drivers/usb/pd/policy_engine.c b/drivers/usb/pd/policy_engine.c
index 3165d1f..10d11ac 100644
--- a/drivers/usb/pd/policy_engine.c
+++ b/drivers/usb/pd/policy_engine.c
@@ -137,6 +137,14 @@
 	MSG_GET_COUNTRY_CODES,
 };
 
+static const char * const usbpd_control_msg_strings[] = {
+	"", "GoodCRC", "GotoMin", "Accept", "Reject", "Ping", "PS_RDY",
+	"Get_Source_Cap", "Get_Sink_Cap", "DR_Swap", "PR_Swap", "VCONN_Swap",
+	"Wait", "Soft_Reset", "", "", "Not_Supported",
+	"Get_Source_Cap_Extended", "Get_Status", "FR_Swap", "Get_PPS_Status",
+	"Get_Country_Codes",
+};
+
 enum usbpd_data_msg_type {
 	MSG_SOURCE_CAPABILITIES = 1,
 	MSG_REQUEST,
@@ -148,6 +156,12 @@
 	MSG_VDM = 0xF,
 };
 
+static const char * const usbpd_data_msg_strings[] = {
+	"", "Source_Capabilities", "Request", "BIST", "Sink_Capabilities",
+	"Battery_Status", "Alert", "Get_Country_Info", "", "", "", "", "", "",
+	"", "Vendor_Defined",
+};
+
 enum usbpd_ext_msg_type {
 	MSG_SOURCE_CAPABILITIES_EXTENDED = 1,
 	MSG_STATUS,
@@ -165,6 +179,29 @@
 	MSG_COUNTRY_CODES,
 };
 
+static const char * const usbpd_ext_msg_strings[] = {
+	"", "Source_Capabilities_Extended", "Status", "Get_Battery_Cap",
+	"Get_Battery_Status", "Get_Manufacturer_Info", "Manufacturer_Info",
+	"Security_Request", "Security_Response", "Firmware_Update_Request",
+	"Firmware_Update_Response", "PPS_Status", "Country_Info",
+	"Country_Codes",
+};
+
+static inline const char *msg_to_string(u8 id, bool is_data, bool is_ext)
+{
+	if (is_ext) {
+		if (id < ARRAY_SIZE(usbpd_ext_msg_strings))
+			return usbpd_ext_msg_strings[id];
+	} else if (is_data) {
+		if (id < ARRAY_SIZE(usbpd_data_msg_strings))
+			return usbpd_data_msg_strings[id];
+	} else if (id < ARRAY_SIZE(usbpd_control_msg_strings)) {
+		return usbpd_control_msg_strings[id];
+	}
+
+	return "Invalid";
+}
+
 enum vdm_state {
 	VDM_NONE,
 	DISCOVERED_ID,
@@ -435,6 +472,7 @@
 
 	struct list_head	instance;
 
+	bool		has_dp;
 	u16			ss_lane_svid;
 
 	/* ext msg support */
@@ -457,6 +495,7 @@
 static const unsigned int usbpd_extcon_cable[] = {
 	EXTCON_USB,
 	EXTCON_USB_HOST,
+	EXTCON_DISP_DP,
 	EXTCON_NONE,
 };
 
@@ -574,6 +613,13 @@
 
 	pd->ss_lane_svid = hdlr->svid;
 
+	/* DP 4 Lane mode  */
+	ret = extcon_blocking_sync(pd->extcon, EXTCON_DISP_DP, 4);
+	if (ret) {
+		usbpd_err(&pd->dev, "err(%d) for notify DP 4 Lane", ret);
+		goto err_exit;
+	}
+
 err_exit:
 	return ret;
 }
@@ -641,8 +687,12 @@
 			pd->tx_msgid, num_data, pd->spec_rev);
 
 	ret = pd_phy_write(hdr, (u8 *)data, num_data * sizeof(u32), sop);
-	if (ret)
+	if (ret) {
+		usbpd_err(&pd->dev, "Error sending %s: %d\n",
+				msg_to_string(msg_type, num_data, false),
+				ret);
 		return ret;
+	}
 
 	pd->tx_msgid = (pd->tx_msgid + 1) & PD_MAX_MSG_ID;
 	return 0;
@@ -682,8 +732,12 @@
 			PD_MSG_HDR_EXTENDED;
 		ret = pd_phy_write(hdr, chunked_payload,
 				num_objs * sizeof(u32), sop);
-		if (ret)
+		if (ret) {
+			usbpd_err(&pd->dev, "Error sending %s: %d\n",
+					usbpd_ext_msg_strings[msg_type],
+					ret);
 			return ret;
+		}
 
 		pd->tx_msgid = (pd->tx_msgid + 1) & PD_MAX_MSG_ID;
 
@@ -998,6 +1052,7 @@
 	struct rx_msg *rx_msg;
 	unsigned long flags;
 	u16 header;
+	u8 msg_type, num_objs;
 
 	if (sop != SOP_MSG) {
 		usbpd_err(&pd->dev, "invalid msg type (%d) received; only SOP supported\n",
@@ -1043,8 +1098,12 @@
 	if (PD_MSG_HDR_REV(header) < pd->spec_rev)
 		pd->spec_rev = PD_MSG_HDR_REV(header);
 
-	usbpd_dbg(&pd->dev, "received message: type(%d) num_objs(%d)\n",
-			PD_MSG_HDR_TYPE(header), PD_MSG_HDR_COUNT(header));
+	msg_type = PD_MSG_HDR_TYPE(header);
+	num_objs = PD_MSG_HDR_COUNT(header);
+	usbpd_dbg(&pd->dev, "%s type(%d) num_objs(%d)\n",
+			msg_to_string(msg_type, num_objs,
+				PD_MSG_HDR_IS_EXTENDED(header)),
+			msg_type, num_objs);
 
 	if (!PD_MSG_HDR_IS_EXTENDED(header)) {
 		rx_msg = kzalloc(sizeof(*rx_msg) + len, GFP_ATOMIC);
@@ -1092,6 +1151,47 @@
 	return HRTIMER_NORESTART;
 }
 
+static void log_decoded_request(struct usbpd *pd, u32 rdo)
+{
+	const u32 *pdos;
+	int pos = PD_RDO_OBJ_POS(rdo);
+	int type;
+
+	usbpd_dbg(&pd->dev, "RDO: 0x%08x\n", pd->rdo);
+
+	if (pd->current_pr == PR_SINK)
+		pdos = pd->received_pdos;
+	else
+		pdos = default_src_caps;
+
+	type = PD_SRC_PDO_TYPE(pdos[pos - 1]);
+
+	switch (type) {
+	case PD_SRC_PDO_TYPE_FIXED:
+	case PD_SRC_PDO_TYPE_VARIABLE:
+		usbpd_dbg(&pd->dev, "Request Fixed/Variable PDO:%d Volt:%dmV OpCurr:%dmA Curr:%dmA\n",
+				pos,
+				PD_SRC_PDO_FIXED_VOLTAGE(pdos[pos - 1]) * 50,
+				PD_RDO_FIXED_CURR(rdo) * 10,
+				PD_RDO_FIXED_CURR_MINMAX(rdo) * 10);
+		break;
+
+	case PD_SRC_PDO_TYPE_BATTERY:
+		usbpd_dbg(&pd->dev, "Request Battery PDO:%d OpPow:%dmW Pow:%dmW\n",
+				pos,
+				PD_RDO_FIXED_CURR(rdo) * 250,
+				PD_RDO_FIXED_CURR_MINMAX(rdo) * 250);
+		break;
+
+	case PD_SRC_PDO_TYPE_AUGMENTED:
+		usbpd_dbg(&pd->dev, "Request PPS PDO:%d Volt:%dmV Curr:%dmA\n",
+				pos,
+				PD_RDO_PROG_VOLTAGE(rdo) * 20,
+				PD_RDO_PROG_CURR(rdo) * 50);
+		break;
+	}
+}
+
 /* Enters new state and executes actions on entry */
 static void usbpd_set_state(struct usbpd *pd, enum usbpd_state next_state)
 {
@@ -1200,6 +1300,8 @@
 		break;
 
 	case PE_SRC_NEGOTIATE_CAPABILITY:
+		log_decoded_request(pd, pd->rdo);
+
 		if (PD_RDO_OBJ_POS(pd->rdo) != 1 ||
 			PD_RDO_FIXED_CURR(pd->rdo) >
 				PD_SRC_PDO_FIXED_MAX_CURR(*default_src_caps) ||
@@ -1208,7 +1310,6 @@
 			/* send Reject */
 			ret = pd_send_msg(pd, MSG_REJECT, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Reject\n");
 				usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
 				break;
 			}
@@ -1230,7 +1331,6 @@
 		/* PE_SRC_TRANSITION_SUPPLY pseudo-state */
 		ret = pd_send_msg(pd, MSG_ACCEPT, NULL, 0, SOP_MSG);
 		if (ret) {
-			usbpd_err(&pd->dev, "Error sending Accept\n");
 			usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
 			break;
 		}
@@ -1246,7 +1346,6 @@
 		 */
 		ret = pd_send_msg(pd, MSG_PS_RDY, NULL, 0, SOP_MSG);
 		if (ret) {
-			usbpd_err(&pd->dev, "Error sending PS_RDY\n");
 			usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
 			break;
 		}
@@ -1285,7 +1384,6 @@
 
 		ret = pd_send_msg(pd, MSG_SOFT_RESET, NULL, 0, SOP_MSG);
 		if (ret) {
-			usbpd_err(&pd->dev, "Error sending Soft Reset, do Hard Reset\n");
 			usbpd_set_state(pd, pd->current_pr == PR_SRC ?
 					PE_SRC_HARD_RESET : PE_SNK_HARD_RESET);
 			break;
@@ -1384,9 +1482,10 @@
 		/* fall-through */
 
 	case PE_SNK_SELECT_CAPABILITY:
+		log_decoded_request(pd, pd->rdo);
+
 		ret = pd_send_msg(pd, MSG_REQUEST, &pd->rdo, 1, SOP_MSG);
 		if (ret) {
-			usbpd_err(&pd->dev, "Error sending Request\n");
 			usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 			break;
 		}
@@ -1555,11 +1654,19 @@
 	u8 i, num_vdos = PD_MSG_HDR_COUNT(rx_msg->hdr) - 1;
 	u8 cmd = SVDM_HDR_CMD(vdm_hdr);
 	u8 cmd_type = SVDM_HDR_CMD_TYPE(vdm_hdr);
-	bool has_dp = false;
 	struct usbpd_svid_handler *handler;
 
-	usbpd_dbg(&pd->dev, "VDM rx: svid:%x cmd:%x cmd_type:%x vdm_hdr:%x\n",
-			svid, cmd, cmd_type, vdm_hdr);
+	usbpd_dbg(&pd->dev,
+			"VDM rx: svid:%x cmd:%x cmd_type:%x vdm_hdr:%x has_dp: %s\n",
+			svid, cmd, cmd_type, vdm_hdr,
+			pd->has_dp ? "true" : "false");
+
+	if ((svid == 0xFF01) && (pd->has_dp == false)) {
+		pd->has_dp = true;
+
+		/* Set to USB and DP cocurrency mode */
+		extcon_blocking_sync(pd->extcon, EXTCON_DISP_DP, 2);
+	}
 
 	/* if it's a supported SVID, pass the message to the handler */
 	handler = find_svid_handler(pd, svid);
@@ -1717,9 +1824,6 @@
 						handler->discovered = true;
 					}
 				}
-
-				if (svid == 0xFF01)
-					has_dp = true;
 			}
 			break;
 
@@ -1892,7 +1996,6 @@
 
 		ret = pd_send_msg(pd, MSG_PS_RDY, NULL, 0, SOP_MSG);
 		if (ret) {
-			usbpd_err(&pd->dev, "Error sending PS_RDY\n");
 			usbpd_set_state(pd, pd->current_pr == PR_SRC ?
 					PE_SRC_SEND_SOFT_RESET :
 					PE_SNK_SEND_SOFT_RESET);
@@ -2075,6 +2178,13 @@
 		kobject_uevent(&pd->dev.kobj, KOBJ_CHANGE);
 		dual_role_instance_changed(pd->dual_role);
 
+		if (pd->has_dp) {
+			pd->has_dp = false;
+
+			/* Set to USB only mode when cable disconnected */
+			extcon_blocking_sync(pd->extcon, EXTCON_DISP_DP, 0);
+		}
+
 		goto sm_done;
 	}
 
@@ -2212,10 +2322,8 @@
 			ret = pd_send_msg(pd, MSG_SINK_CAPABILITIES,
 					pd->sink_caps, pd->num_sink_caps,
 					SOP_MSG);
-			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Sink Caps\n");
+			if (ret)
 				usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
-			}
 		} else if (IS_DATA(rx_msg, MSG_REQUEST)) {
 			pd->rdo = *(u32 *)rx_msg->payload;
 			usbpd_set_state(pd, PE_SRC_NEGOTIATE_CAPABILITY);
@@ -2227,7 +2335,6 @@
 
 			ret = pd_send_msg(pd, MSG_ACCEPT, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Accept\n");
 				usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
 				break;
 			}
@@ -2240,7 +2347,6 @@
 			/* we'll happily accept Src->Sink requests anytime */
 			ret = pd_send_msg(pd, MSG_ACCEPT, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Accept\n");
 				usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
 				break;
 			}
@@ -2251,7 +2357,6 @@
 		} else if (IS_CTRL(rx_msg, MSG_VCONN_SWAP)) {
 			ret = pd_send_msg(pd, MSG_ACCEPT, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Accept\n");
 				usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
 				break;
 			}
@@ -2263,16 +2368,13 @@
 			/* unhandled messages */
 			ret = pd_send_msg(pd, MSG_NOT_SUPPORTED, NULL, 0,
 					SOP_MSG);
-			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Not supported\n");
+			if (ret)
 				usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
-			}
 			break;
 		} else if (pd->send_pr_swap) {
 			pd->send_pr_swap = false;
 			ret = pd_send_msg(pd, MSG_PR_SWAP, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending PR Swap\n");
 				usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
 				break;
 			}
@@ -2283,7 +2385,6 @@
 			pd->send_dr_swap = false;
 			ret = pd_send_msg(pd, MSG_DR_SWAP, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending DR Swap\n");
 				usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
 				break;
 			}
@@ -2491,17 +2592,14 @@
 			ret = pd_send_msg(pd, MSG_SINK_CAPABILITIES,
 					pd->sink_caps, pd->num_sink_caps,
 					SOP_MSG);
-			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Sink Caps\n");
+			if (ret)
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
-			}
 		} else if (IS_CTRL(rx_msg, MSG_GET_SOURCE_CAP) &&
 				pd->spec_rev == USBPD_REV_20) {
 			ret = pd_send_msg(pd, MSG_SOURCE_CAPABILITIES,
 					default_src_caps,
 					ARRAY_SIZE(default_src_caps), SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending SRC CAPs\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2513,7 +2611,6 @@
 
 			ret = pd_send_msg(pd, MSG_ACCEPT, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Accept\n");
 				usbpd_set_state(pd, PE_SRC_SEND_SOFT_RESET);
 				break;
 			}
@@ -2527,7 +2624,6 @@
 			/* TODO: should we Reject in certain circumstances? */
 			ret = pd_send_msg(pd, MSG_ACCEPT, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Accept\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2548,18 +2644,15 @@
 					(pd->requested_voltage > 5000000)) {
 				ret = pd_send_msg(pd, MSG_REJECT, NULL, 0,
 						SOP_MSG);
-				if (ret) {
-					usbpd_err(&pd->dev, "Error sending Reject\n");
+				if (ret)
 					usbpd_set_state(pd,
 							PE_SNK_SEND_SOFT_RESET);
-				}
 
 				break;
 			}
 
 			ret = pd_send_msg(pd, MSG_ACCEPT, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Accept\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2572,7 +2665,6 @@
 			ret = pd_send_msg(pd, MSG_GET_SOURCE_CAP_EXTENDED, NULL,
 				0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending get_src_cap_ext\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2591,7 +2683,6 @@
 			ret = pd_send_msg(pd, MSG_GET_PPS_STATUS, NULL,
 				0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending get_pps_status\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2626,7 +2717,6 @@
 			pd->send_get_status = false;
 			ret = pd_send_msg(pd, MSG_GET_STATUS, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending get_status\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2644,7 +2734,6 @@
 			ret = pd_send_ext_msg(pd, MSG_GET_BATTERY_CAP,
 				&pd->get_battery_cap_db, 1, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending get_battery_cap\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2663,7 +2752,6 @@
 			ret = pd_send_ext_msg(pd, MSG_GET_BATTERY_STATUS,
 				&pd->get_battery_status_db, 1, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending get_battery_status\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2681,10 +2769,8 @@
 			/* unhandled messages */
 			ret = pd_send_msg(pd, MSG_NOT_SUPPORTED, NULL, 0,
 					SOP_MSG);
-			if (ret) {
-				usbpd_err(&pd->dev, "Error sending Not supported\n");
+			if (ret)
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
-			}
 			break;
 		} else if (pd->send_request) {
 			pd->send_request = false;
@@ -2693,7 +2779,6 @@
 			pd->send_pr_swap = false;
 			ret = pd_send_msg(pd, MSG_PR_SWAP, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending PR Swap\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2704,7 +2789,6 @@
 			pd->send_dr_swap = false;
 			ret = pd_send_msg(pd, MSG_DR_SWAP, NULL, 0, SOP_MSG);
 			if (ret) {
-				usbpd_err(&pd->dev, "Error sending DR Swap\n");
 				usbpd_set_state(pd, PE_SNK_SEND_SOFT_RESET);
 				break;
 			}
@@ -2726,8 +2810,6 @@
 
 		ret = pd_send_msg(pd, MSG_ACCEPT, NULL, 0, SOP_MSG);
 		if (ret) {
-			usbpd_err(&pd->dev, "%s: Error sending Accept, do Hard Reset\n",
-					usbpd_state_strings[pd->current_state]);
 			usbpd_set_state(pd, pd->current_pr == PR_SRC ?
 					PE_SRC_HARD_RESET : PE_SNK_HARD_RESET);
 			break;
@@ -2819,7 +2901,6 @@
 
 		ret = pd_send_msg(pd, MSG_PS_RDY, NULL, 0, SOP_MSG);
 		if (ret) {
-			usbpd_err(&pd->dev, "Error sending PS_RDY\n");
 			usbpd_set_state(pd, PE_ERROR_RECOVERY);
 			break;
 		}
@@ -2866,7 +2947,6 @@
 
 		ret = pd_send_msg(pd, MSG_PS_RDY, NULL, 0, SOP_MSG);
 		if (ret) {
-			usbpd_err(&pd->dev, "Error sending PS_RDY\n");
 			usbpd_set_state(pd, PE_ERROR_RECOVERY);
 			break;
 		}
diff --git a/drivers/video/fbdev/msm/mdss_compat_utils.c b/drivers/video/fbdev/msm/mdss_compat_utils.c
index 23d4a27..4ee8e60 100644
--- a/drivers/video/fbdev/msm/mdss_compat_utils.c
+++ b/drivers/video/fbdev/msm/mdss_compat_utils.c
@@ -1336,10 +1336,10 @@
 		return -EFAULT;
 
 	if (num_r_stages > GC_LUT_SEGMENTS || num_b_stages > GC_LUT_SEGMENTS
-	    || num_r_stages > GC_LUT_SEGMENTS || !num_r_stages || !num_b_stages
+	    || num_g_stages > GC_LUT_SEGMENTS || !num_r_stages || !num_b_stages
 	    || !num_g_stages) {
 		pr_err("invalid number of stages r_stages %d b_stages %d g_stages %d\n",
-		       num_r_stages, num_b_stages, num_r_stages);
+		       num_r_stages, num_b_stages, num_g_stages);
 		return -EFAULT;
 	}
 
diff --git a/drivers/video/fbdev/msm/mdss_fb.h b/drivers/video/fbdev/msm/mdss_fb.h
index 3515e37..38cf5f7 100644
--- a/drivers/video/fbdev/msm/mdss_fb.h
+++ b/drivers/video/fbdev/msm/mdss_fb.h
@@ -246,8 +246,8 @@
 				do_div(out, 2 * max_bright);\
 				} while (0)
 #define MDSS_BL_TO_BRIGHT(out, v, bl_max, max_bright) do {\
-				out = ((v) * (max_bright));\
-				do_div(out, bl_max);\
+				out = (2 * ((v) * (max_bright)) + (bl_max));\
+				do_div(out, 2 * bl_max);\
 				} while (0)
 
 struct mdss_fb_file_info {
diff --git a/drivers/video/fbdev/msm/mdss_hdmi_util.c b/drivers/video/fbdev/msm/mdss_hdmi_util.c
index b5bedfa..afd4cd4 100644
--- a/drivers/video/fbdev/msm/mdss_hdmi_util.c
+++ b/drivers/video/fbdev/msm/mdss_hdmi_util.c
@@ -1389,6 +1389,7 @@
 	rc = hdmi_ddc_read(ctrl);
 	if (rc) {
 		pr_err("DDC Read failed for %s\n", data.what);
+		ctrl->ddc_data.data_buf = NULL;
 		return rc;
 	}
 
@@ -1428,7 +1429,7 @@
 	default:
 		break;
 	}
-
+	ctrl->ddc_data.data_buf = NULL;
 	return 0;
 }
 
@@ -1469,7 +1470,7 @@
 		rc = hdmi_ddc_read(ctrl);
 		if (rc) {
 			pr_err("scdc read failed\n");
-			return rc;
+			goto scdc_write_fail;
 		}
 		if (data_type == HDMI_TX_SCDC_SCRAMBLING_ENABLE) {
 			data_buf[0] = ((((u8)(read_val & 0xFF)) & (~BIT(0))) |
@@ -1491,7 +1492,8 @@
 	default:
 		pr_err("Cannot write to read only reg (%d)\n",
 			data_type);
-		return -EINVAL;
+		rc = -EINVAL;
+		goto scdc_write_fail;
 	}
 
 	ctrl->ddc_data = data;
@@ -1499,10 +1501,10 @@
 	rc = hdmi_ddc_write(ctrl);
 	if (rc) {
 		pr_err("DDC Read failed for %s\n", data.what);
-		return rc;
 	}
-
-	return 0;
+scdc_write_fail:
+	ctrl->ddc_data.data_buf = NULL;
+	return rc;
 }
 
 int hdmi_setup_ddc_timers(struct hdmi_tx_ddc_ctrl *ctrl,
diff --git a/drivers/video/fbdev/msm/mdss_mdp_intf_cmd.c b/drivers/video/fbdev/msm/mdss_mdp_intf_cmd.c
index 0ffe89c..5a989bc 100644
--- a/drivers/video/fbdev/msm/mdss_mdp_intf_cmd.c
+++ b/drivers/video/fbdev/msm/mdss_mdp_intf_cmd.c
@@ -709,6 +709,7 @@
 			swap(*ctl, *sctl);
 		}
 	} else {
+		rc = -EINVAL;
 		pr_debug("%s no split mode:%d\n", __func__,
 			(*ctl)->mfd->split_mode);
 	}
diff --git a/fs/crypto/Makefile b/fs/crypto/Makefile
index cc42e5e..b0ca0e6 100644
--- a/fs/crypto/Makefile
+++ b/fs/crypto/Makefile
@@ -3,5 +3,6 @@
 ccflags-y += -Ifs/ext4
 ccflags-y += -Ifs/f2fs
 
-fscrypto-y := crypto.o fname.o hooks.o keyinfo.o policy.o fscrypt_ice.o
+fscrypto-y := crypto.o fname.o hooks.o keyinfo.o policy.o
 fscrypto-$(CONFIG_BLOCK) += bio.o
+fscrypto-$(CONFIG_PFK) += fscrypt_ice.o
diff --git a/include/crypto/ice.h b/include/crypto/ice.h
index 133041e..4c8faf1 100644
--- a/include/crypto/ice.h
+++ b/include/crypto/ice.h
@@ -49,6 +49,25 @@
 	bool				encr_bypass;
 };
 
+/* MSM ICE Crypto Data Unit of target DUN of Transfer Request */
+enum ice_crypto_data_unit {
+	ICE_CRYPTO_DATA_UNIT_512_B          = 0,
+	ICE_CRYPTO_DATA_UNIT_1_KB           = 1,
+	ICE_CRYPTO_DATA_UNIT_2_KB           = 2,
+	ICE_CRYPTO_DATA_UNIT_4_KB           = 3,
+	ICE_CRYPTO_DATA_UNIT_8_KB           = 4,
+	ICE_CRYPTO_DATA_UNIT_16_KB          = 5,
+	ICE_CRYPTO_DATA_UNIT_32_KB          = 6,
+	ICE_CRYPTO_DATA_UNIT_64_KB          = 7,
+};
+
+enum ice_capability_index {
+	ICE_CRYPTO_MODE_XTS_128 = 0,
+	ICE_CRYPTO_MODE_CBC_128 = 1,
+	ICE_CRYPTO_MODE_XTS_256 = 3,
+	ICE_CRYPTO_MODE_CBC_256 = 4
+};
+
 typedef void (*ice_error_cb)(void *, u32 error);
 
 struct qcom_ice_variant_ops *qcom_ice_get_variant_ops(struct device_node *node);
diff --git a/include/linux/bluetooth-power.h b/include/linux/bluetooth-power.h
index ef8b519b..901dae0 100644
--- a/include/linux/bluetooth-power.h
+++ b/include/linux/bluetooth-power.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2013-2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -83,7 +83,9 @@
 };
 
 int bt_register_slimdev(struct device *dev);
+int get_chipset_version(void);
 
 #define BT_CMD_SLIM_TEST		0xbfac
 #define BT_CMD_PWR_CTRL			0xbfad
+#define BT_CMD_CHIPSET_VERS		0xbfae
 #endif /* __LINUX_BLUETOOTH_POWER_H */
diff --git a/include/linux/extcon.h b/include/linux/extcon.h
index 94c7be2..59a8473 100644
--- a/include/linux/extcon.h
+++ b/include/linux/extcon.h
@@ -317,7 +317,7 @@
 extern const char *extcon_get_edev_name(struct extcon_dev *edev);
 
 extern int extcon_blocking_sync(struct extcon_dev *edev, unsigned int id,
-							bool val);
+							u8 val);
 #else /* CONFIG_EXTCON */
 static inline int extcon_dev_register(struct extcon_dev *edev)
 {
diff --git a/include/linux/input/synaptics_dsx_v2_6.h b/include/linux/input/synaptics_dsx_v2_6.h
index 75d4b77..d0a5c1a 100644
--- a/include/linux/input/synaptics_dsx_v2_6.h
+++ b/include/linux/input/synaptics_dsx_v2_6.h
@@ -114,6 +114,7 @@
 	const char *bus_reg_name;
 	struct synaptics_dsx_button_map *cap_button_map;
 	struct synaptics_dsx_button_map *vir_button_map;
+	const char *fw_name;
 };
 
 #endif
diff --git a/include/linux/pfk.h b/include/linux/pfk.h
index d7405ea..5be7d9e 100644
--- a/include/linux/pfk.h
+++ b/include/linux/pfk.h
@@ -33,7 +33,8 @@
 };
 
 int pfk_load_key_start(const struct bio *bio,
-		struct ice_crypto_setting *ice_setting, bool *is_pfe, bool);
+		struct ice_crypto_setting *ice_setting,
+		bool *is_pfe, bool async, int ice_rev);
 int pfk_load_key_end(const struct bio *bio, bool *is_pfe);
 int pfk_remove_key(const unsigned char *key, size_t key_size);
 bool pfk_allow_merge_bio(const struct bio *bio1, const struct bio *bio2);
@@ -41,7 +42,8 @@
 
 #else
 static inline int pfk_load_key_start(const struct bio *bio,
-	struct ice_crypto_setting *ice_setting, bool *is_pfe, bool async)
+	struct ice_crypto_setting *ice_setting, bool *is_pfe,
+	bool async, int ice_rev)
 {
 	return -ENODEV;
 }
diff --git a/include/linux/pwm.h b/include/linux/pwm.h
index 6c0168b..b40287e 100644
--- a/include/linux/pwm.h
+++ b/include/linux/pwm.h
@@ -38,7 +38,7 @@
  * current PWM hardware state.
  */
 struct pwm_args {
-	unsigned int period;
+	u64 period;
 	enum pwm_polarity polarity;
 };
 
@@ -65,9 +65,9 @@
  * @cycles_per_duty: number of PWM period cycles an entry stays at
  */
 struct pwm_output_pattern {
-	unsigned int *duty_pattern;
+	u64 *duty_pattern;
 	unsigned int num_entries;
-	unsigned int cycles_per_duty;
+	u64 cycles_per_duty;
 };
 
 /*
@@ -78,8 +78,8 @@
  * @enabled: PWM enabled status
  */
 struct pwm_state {
-	unsigned int period;
-	unsigned int duty_cycle;
+	u64 period;
+	u64 duty_cycle;
 	enum pwm_polarity polarity;
 	enum pwm_output_type output_type;
 	struct pwm_output_pattern *output_pattern;
@@ -135,12 +135,30 @@
 		pwm->state.period = period;
 }
 
+static inline void pwm_set_period_extend(struct pwm_device *pwm, u64 period)
+{
+	if (pwm)
+		pwm->state.period = period;
+}
+
 static inline unsigned int pwm_get_period(const struct pwm_device *pwm)
 {
 	struct pwm_state state;
 
 	pwm_get_state(pwm, &state);
 
+	if (state.period > UINT_MAX)
+		pr_warn("PWM period %llu is truncated\n", state.period);
+
+	return (unsigned int)state.period;
+}
+
+static inline u64 pwm_get_period_extend(const struct pwm_device *pwm)
+{
+	struct pwm_state state;
+
+	pwm_get_state(pwm, &state);
+
 	return state.period;
 }
 
@@ -150,12 +168,30 @@
 		pwm->state.duty_cycle = duty;
 }
 
+static inline void pwm_set_duty_cycle_extend(struct pwm_device *pwm, u64 duty)
+{
+	if (pwm)
+		pwm->state.duty_cycle = duty;
+}
+
 static inline unsigned int pwm_get_duty_cycle(const struct pwm_device *pwm)
 {
 	struct pwm_state state;
 
 	pwm_get_state(pwm, &state);
 
+	if (state.duty_cycle > UINT_MAX)
+		pr_warn("PWM duty cycle %llu is truncated\n", state.duty_cycle);
+
+	return (unsigned int)state.duty_cycle;
+}
+
+static inline u64 pwm_get_duty_cycle_extend(const struct pwm_device *pwm)
+{
+	struct pwm_state state;
+
+	pwm_get_state(pwm, &state);
+
 	return state.duty_cycle;
 }
 
@@ -287,6 +323,8 @@
  * @request: optional hook for requesting a PWM
  * @free: optional hook for freeing a PWM
  * @config: configure duty cycles and period length for this PWM
+ * @config_extend: configure duty cycles and period length for this
+ *	PWM with u64 data type
  * @set_polarity: configure the polarity of this PWM
  * @capture: capture and report PWM signal
  * @enable: enable PWM output toggling
@@ -309,6 +347,8 @@
 	void (*free)(struct pwm_chip *chip, struct pwm_device *pwm);
 	int (*config)(struct pwm_chip *chip, struct pwm_device *pwm,
 		      int duty_ns, int period_ns);
+	int (*config_extend)(struct pwm_chip *chip, struct pwm_device *pwm,
+		      u64 duty_ns, u64 period_ns);
 	int (*set_polarity)(struct pwm_chip *chip, struct pwm_device *pwm,
 			    enum pwm_polarity polarity);
 	int (*capture)(struct pwm_chip *chip, struct pwm_device *pwm,
@@ -366,8 +406,8 @@
  * @duty_cycle: duty cycle of the PWM signal (in nanoseconds)
  */
 struct pwm_capture {
-	unsigned int period;
-	unsigned int duty_cycle;
+	u64 period;
+	u64 duty_cycle;
 };
 
 #if IS_ENABLED(CONFIG_PWM)
@@ -421,6 +461,31 @@
 }
 
 /**
+ * pwm_config_extend() - change PWM period and duty length with u64 data type
+ * @pwm: PWM device
+ * @duty_ns: "on" time (in nanoseconds)
+ * @period_ns: duration (in nanoseconds) of one cycle
+ *
+ * Returns: 0 on success or a negative error code on failure.
+ */
+static inline int pwm_config_extend(struct pwm_device *pwm, u64 duty_ns,
+			     u64 period_ns)
+{
+	struct pwm_state state;
+
+	if (!pwm)
+		return -EINVAL;
+
+	pwm_get_state(pwm, &state);
+	if (state.duty_cycle == duty_ns && state.period == period_ns)
+		return 0;
+
+	state.duty_cycle = duty_ns;
+	state.period = period_ns;
+	return pwm_apply_state(pwm, &state);
+}
+
+/**
  * pwm_set_polarity() - configure the polarity of a PWM signal
  * @pwm: PWM device
  * @polarity: new polarity of the PWM signal
diff --git a/include/linux/sw_sync.h b/include/linux/sw_sync.h
deleted file mode 100644
index 69f1391..0000000
--- a/include/linux/sw_sync.h
+++ /dev/null
@@ -1,59 +0,0 @@
-/*
- * include/linux/sw_sync.h
- *
- * Copyright (C) 2012 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#ifndef _LINUX_SW_SYNC_H
-#define _LINUX_SW_SYNC_H
-
-#include <linux/types.h>
-#include <linux/kconfig.h>
-#include <linux/sync.h>
-#include <uapi/linux/sw_sync.h>
-
-struct sw_sync_timeline {
-	struct	sync_timeline	obj;
-
-	u32			value;
-};
-
-struct sw_sync_pt {
-	struct sync_pt		pt;
-
-	u32			value;
-};
-
-#if IS_ENABLED(CONFIG_SW_SYNC)
-struct sw_sync_timeline *sw_sync_timeline_create(const char *name);
-void sw_sync_timeline_inc(struct sw_sync_timeline *obj, u32 inc);
-
-struct sync_pt *sw_sync_pt_create(struct sw_sync_timeline *obj, u32 value);
-#else
-static inline struct sw_sync_timeline *sw_sync_timeline_create(const char *name)
-{
-	return NULL;
-}
-
-static inline void sw_sync_timeline_inc(struct sw_sync_timeline *obj, u32 inc)
-{
-}
-
-static inline struct sync_pt *sw_sync_pt_create(struct sw_sync_timeline *obj,
-						u32 value)
-{
-	return NULL;
-}
-#endif /* IS_ENABLED(CONFIG_SW_SYNC) */
-
-#endif /* _LINUX_SW_SYNC_H */
diff --git a/include/linux/sync.h b/include/linux/sync.h
deleted file mode 100644
index a443b52..0000000
--- a/include/linux/sync.h
+++ /dev/null
@@ -1,349 +0,0 @@
-/*
- * include/linux/sync.h
- *
- * Copyright (C) 2012 Google, Inc.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#ifndef _LINUX_SYNC_H
-#define _LINUX_SYNC_H
-
-#include <linux/types.h>
-#include <linux/kref.h>
-#include <linux/ktime.h>
-#include <linux/list.h>
-#include <linux/spinlock.h>
-#include <linux/wait.h>
-
-#include <uapi/linux/sync.h>
-
-struct sync_timeline;
-struct sync_pt;
-struct sync_fence;
-struct seq_file;
-
-/**
- * struct sync_timeline_ops - sync object implementation ops
- * @driver_name:	name of the implementation
- * @dup:		duplicate a sync_pt
- * @has_signaled:	returns:
- *			  1 if pt has signaled
- *			  0 if pt has not signaled
- *			 <0 on error
- * @compare:		returns:
- *			  1 if b will signal before a
- *			  0 if a and b will signal at the same time
- *			 -1 if a will signal before b
- * @free_pt:		called before sync_pt is freed
- * @release_obj:	called before sync_timeline is freed
- * @print_obj:		deprecated
- * @print_pt:		deprecated
- * @fill_driver_data:	write implementation specific driver data to data.
- *			  should return an error if there is not enough room
- *			  as specified by size.  This information is returned
- *			  to userspace by SYNC_IOC_FENCE_INFO.
- * @timeline_value_str: fill str with the value of the sync_timeline's counter
- * @pt_value_str:	fill str with the value of the sync_pt
- */
-struct sync_timeline_ops {
-	const char *driver_name;
-
-	/* required */
-	struct sync_pt * (*dup)(struct sync_pt *pt);
-
-	/* required */
-	int (*has_signaled)(struct sync_pt *pt);
-
-	/* required */
-	int (*compare)(struct sync_pt *a, struct sync_pt *b);
-
-	/* optional */
-	void (*free_pt)(struct sync_pt *sync_pt);
-
-	/* optional */
-	void (*release_obj)(struct sync_timeline *sync_timeline);
-
-	/* deprecated */
-	void (*print_obj)(struct seq_file *s,
-			  struct sync_timeline *sync_timeline);
-
-	/* deprecated */
-	void (*print_pt)(struct seq_file *s, struct sync_pt *sync_pt);
-
-	/* optional */
-	int (*fill_driver_data)(struct sync_pt *syncpt, void *data, int size);
-
-	/* optional */
-	void (*timeline_value_str)(struct sync_timeline *timeline, char *str,
-				   int size);
-
-	/* optional */
-	void (*pt_value_str)(struct sync_pt *pt, char *str, int size);
-
-	/* optional */
-	void (*pt_log)(struct sync_pt *pt);
-};
-
-/**
- * struct sync_timeline - sync object
- * @kref:		reference count on fence.
- * @ops:		ops that define the implementation of the sync_timeline
- * @name:		name of the sync_timeline. Useful for debugging
- * @destroyed:		set when sync_timeline is destroyed
- * @child_list_head:	list of children sync_pts for this sync_timeline
- * @child_list_lock:	lock protecting @child_list_head, destroyed, and
- *			  sync_pt.status
- * @active_list_head:	list of active (unsignaled/errored) sync_pts
- * @sync_timeline_list:	membership in global sync_timeline_list
- */
-struct sync_timeline {
-	struct kref		kref;
-	const struct sync_timeline_ops	*ops;
-	char			name[64];
-
-	/* protected by child_list_lock */
-	bool			destroyed;
-
-	struct list_head	child_list_head;
-	spinlock_t		child_list_lock;
-
-	struct list_head	active_list_head;
-	spinlock_t		active_list_lock;
-
-	struct list_head	sync_timeline_list;
-};
-
-/**
- * struct sync_pt - sync point
- * @parent:		sync_timeline to which this sync_pt belongs
- * @child_list:		membership in sync_timeline.child_list_head
- * @active_list:	membership in sync_timeline.active_list_head
- * @signaled_list:	membership in temporary signaled_list on stack
- * @fence:		sync_fence to which the sync_pt belongs
- * @pt_list:		membership in sync_fence.pt_list_head
- * @status:		1: signaled, 0:active, <0: error
- * @timestamp:		time which sync_pt status transitioned from active to
- *			  signaled or error.
- */
-struct sync_pt {
-	struct sync_timeline		*parent;
-	struct list_head	child_list;
-
-	struct list_head	active_list;
-	struct list_head	signaled_list;
-
-	struct sync_fence	*fence;
-	struct list_head	pt_list;
-
-	/* protected by parent->active_list_lock */
-	int			status;
-
-	ktime_t			timestamp;
-};
-
-/**
- * struct sync_fence - sync fence
- * @file:		file representing this fence
- * @kref:		reference count on fence.
- * @name:		name of sync_fence.  Useful for debugging
- * @pt_list_head:	list of sync_pts in the fence.  immutable once fence
- *			  is created
- * @waiter_list_head:	list of asynchronous waiters on this fence
- * @waiter_list_lock:	lock protecting @waiter_list_head and @status
- * @status:		1: signaled, 0:active, <0: error
- *
- * @wq:			wait queue for fence signaling
- * @sync_fence_list:	membership in global fence list
- */
-struct sync_fence {
-	struct file		*file;
-	struct kref		kref;
-	char			name[64];
-
-	/* this list is immutable once the fence is created */
-	struct list_head	pt_list_head;
-
-	struct list_head	waiter_list_head;
-	spinlock_t		waiter_list_lock; /* also protects status */
-	int			status;
-
-	wait_queue_head_t	wq;
-
-	struct list_head	sync_fence_list;
-};
-
-struct sync_fence_waiter;
-typedef void (*sync_callback_t)(struct sync_fence *fence,
-				struct sync_fence_waiter *waiter);
-
-/**
- * struct sync_fence_waiter - metadata for asynchronous waiter on a fence
- * @waiter_list:	membership in sync_fence.waiter_list_head
- * @callback:		function pointer to call when fence signals
- * @callback_data:	pointer to pass to @callback
- */
-struct sync_fence_waiter {
-	struct list_head	waiter_list;
-
-	sync_callback_t		callback;
-};
-
-static inline void sync_fence_waiter_init(struct sync_fence_waiter *waiter,
-					  sync_callback_t callback)
-{
-	waiter->callback = callback;
-}
-
-/*
- * API for sync_timeline implementers
- */
-
-/**
- * sync_timeline_create() - creates a sync object
- * @ops:	specifies the implementation ops for the object
- * @size:	size to allocate for this obj
- * @name:	sync_timeline name
- *
- * Creates a new sync_timeline which will use the implementation specified by
- * @ops.  @size bytes will be allocated allowing for implementation specific
- * data to be kept after the generic sync_timeline struct.
- */
-struct sync_timeline *sync_timeline_create(const struct sync_timeline_ops *ops,
-					   int size, const char *name);
-
-/**
- * sync_timeline_destroy() - destroys a sync object
- * @obj:	sync_timeline to destroy
- *
- * A sync implementation should call this when the @obj is going away
- * (i.e. module unload.)  @obj won't actually be freed until all its children
- * sync_pts are freed.
- */
-void sync_timeline_destroy(struct sync_timeline *obj);
-
-/**
- * sync_timeline_signal() - signal a status change on a sync_timeline
- * @obj:	sync_timeline to signal
- *
- * A sync implementation should call this any time one of it's sync_pts
- * has signaled or has an error condition.
- */
-void sync_timeline_signal(struct sync_timeline *obj);
-
-/**
- * sync_pt_create() - creates a sync pt
- * @parent:	sync_pt's parent sync_timeline
- * @size:	size to allocate for this pt
- *
- * Creates a new sync_pt as a child of @parent.  @size bytes will be
- * allocated allowing for implementation specific data to be kept after
- * the generic sync_timeline struct.
- */
-struct sync_pt *sync_pt_create(struct sync_timeline *parent, int size);
-
-/**
- * sync_pt_free() - frees a sync pt
- * @pt:		sync_pt to free
- *
- * This should only be called on sync_pts which have been created but
- * not added to a fence.
- */
-void sync_pt_free(struct sync_pt *pt);
-
-/**
- * sync_fence_create() - creates a sync fence
- * @name:	name of fence to create
- * @pt:		sync_pt to add to the fence
- *
- * Creates a fence containg @pt.  Once this is called, the fence takes
- * ownership of @pt.
- */
-struct sync_fence *sync_fence_create(const char *name, struct sync_pt *pt);
-
-/*
- * API for sync_fence consumers
- */
-
-/**
- * sync_fence_merge() - merge two fences
- * @name:	name of new fence
- * @a:		fence a
- * @b:		fence b
- *
- * Creates a new fence which contains copies of all the sync_pts in both
- * @a and @b.  @a and @b remain valid, independent fences.
- */
-struct sync_fence *sync_fence_merge(const char *name,
-				    struct sync_fence *a, struct sync_fence *b);
-
-/**
- * sync_fence_fdget() - get a fence from an fd
- * @fd:		fd referencing a fence
- *
- * Ensures @fd references a valid fence, increments the refcount of the backing
- * file, and returns the fence.
- */
-struct sync_fence *sync_fence_fdget(int fd);
-
-/**
- * sync_fence_put() - puts a reference of a sync fence
- * @fence:	fence to put
- *
- * Puts a reference on @fence.  If this is the last reference, the fence and
- * all it's sync_pts will be freed
- */
-void sync_fence_put(struct sync_fence *fence);
-
-/**
- * sync_fence_install() - installs a fence into a file descriptor
- * @fence:	fence to install
- * @fd:		file descriptor in which to install the fence
- *
- * Installs @fence into @fd.  @fd's should be acquired through
- * get_unused_fd_flags(O_CLOEXEC).
- */
-void sync_fence_install(struct sync_fence *fence, int fd);
-
-/**
- * sync_fence_wait_async() - registers and async wait on the fence
- * @fence:		fence to wait on
- * @waiter:		waiter callback struck
- *
- * Returns 1 if @fence has already signaled.
- *
- * Registers a callback to be called when @fence signals or has an error.
- * @waiter should be initialized with sync_fence_waiter_init().
- */
-int sync_fence_wait_async(struct sync_fence *fence,
-			  struct sync_fence_waiter *waiter);
-
-/**
- * sync_fence_cancel_async() - cancels an async wait
- * @fence:		fence to wait on
- * @waiter:		waiter callback struck
- *
- * returns 0 if waiter was removed from fence's async waiter list.
- * returns -ENOENT if waiter was not found on fence's async waiter list.
- *
- * Cancels a previously registered async wait.  Will fail gracefully if
- * @waiter was never registered or if @fence has already signaled @waiter.
- */
-int sync_fence_cancel_async(struct sync_fence *fence,
-			    struct sync_fence_waiter *waiter);
-
-/**
- * sync_fence_wait() - wait on fence
- * @fence:	fence to wait on
- * @tiemout:	timeout in ms
- *
- * Wait for @fence to be signaled or have an error.  Waits indefinitely
- * if @timeout < 0
- */
-int sync_fence_wait(struct sync_fence *fence, long timeout);
-
-#endif /* _LINUX_SYNC_H */
diff --git a/include/linux/wcnss_wlan.h b/include/linux/wcnss_wlan.h
index 05fb7b5..6fa28ab 100644
--- a/include/linux/wcnss_wlan.h
+++ b/include/linux/wcnss_wlan.h
@@ -127,7 +127,7 @@
 void wcnss_allow_suspend(void);
 void wcnss_prevent_suspend(void);
 int wcnss_hardware_type(void);
-void *wcnss_prealloc_get(unsigned int size);
+void *wcnss_prealloc_get(size_t size);
 int wcnss_prealloc_put(void *ptr);
 void wcnss_reset_fiq(bool clk_chk_en);
 void wcnss_suspend_notify(void);
diff --git a/include/media/adsp-shmem-device.h b/include/media/adsp-shmem-device.h
new file mode 100644
index 0000000..60b0338
--- /dev/null
+++ b/include/media/adsp-shmem-device.h
@@ -0,0 +1,50 @@
+/* Copyright (c) 2018, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+
+#ifndef __ADSP_SHMEM_DEVICE_H_
+#define __ADSP_SHMEM_DEVICE_H_
+
+#define ADSP_VFE        0
+#define ADSP_CSID       0
+#define ADSP_CCI        0
+
+enum camera_status_state {
+	CAMERA_STATUS_STOP = 1234,
+	CAMERA_STATUS_INIT,
+	CAMERA_STATUS_START,
+	CAMERA_STATUS_END,
+};
+
+struct adsp_camera_header {
+	unsigned short debug;
+	unsigned short status;
+	uint32_t    frame_idx;
+	char sensor_name[32];
+	unsigned short width;
+	unsigned short height;
+	unsigned short stride;
+	unsigned short format;
+	uint32_t    frame_size;
+	unsigned short data_type;
+	uint32_t header_size;
+	char    printf_buf; /* last */
+};
+
+int         adsp_shmem_get_state(void);
+void        adsp_shmem_set_state(enum camera_status_state state);
+const char *adsp_shmem_get_sensor_name(void);
+int         adsp_shmem_is_initialized(void);
+
+/* true if ADSP is initialized AND in state INIT or START */
+int         adsp_shmem_is_working(void);
+
+#endif /* __ADSP_SHMEM_DEVICE_H_ */
diff --git a/include/microvisor/resource_manager.h b/include/microvisor/resource_manager.h
new file mode 100644
index 0000000..5d553bb
--- /dev/null
+++ b/include/microvisor/resource_manager.h
@@ -0,0 +1,219 @@
+/*
+ * Copyright (c) 2018 Cog Systems Pty Ltd
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Header file for communication with resource manager.
+ *
+ */
+
+/*
+ * Core API
+ */
+#define ERROR_REPLY 0x8000ffff
+
+/*
+ * Boot manager API
+ */
+#define BOOT_MGR_PROTOCOL_ID 'B'
+
+/* start_client: Unmap the client (ML VM) memory and start Linux */
+#define BOOT_MGR_START_CLIENT 0x00420001
+/* msg_payload: struct boot_mgr_start_params */
+
+struct boot_mgr_start_params {
+    uint64_t entry_addr; /* Physical load address / entry point of Linux */
+    uint64_t dtb_addr; /* Physical address of DTB */
+    bool is_64bit; /* True to reset VM to AArch64 mode, false for AArch32 */
+};
+
+/* start_client_reply: Response to BOOT_MGR_START_CLIENT */
+#define BOOT_MGR_START_CLIENT_REPLY 0x80420001
+/* msg_payload: bool success */
+
+/* start_self: Reset the caller and start the loaded HLOS image */
+#define BOOT_MGR_START_SELF 0x00420002
+/* msg_payload: struct boot_mgr_start_params */
+
+/*
+ * start_self_reply: Response to BOOT_MGR_START_CLIENT; sent only on
+ * failure as the caller will be reset if this call succeeds
+ */
+#define BOOT_MGR_START_SELF_REPLY 0x80420002
+/* msg_payload: bool success */
+
+
+/*
+ * Secure Camera Server API (for HLOS)
+ */
+#define RES_MGR_SECURECAM_SERVER_PROTOCOL_ID 'q'
+
+/*
+ * get_handle: Given a buffer sg list, return an SC handle.
+ *
+ * This is sent by the HLOS to the resource manager to obtain the SC handle
+ * to be used to refer to a specific camera buffer.
+ *
+ * The message payload is a list of IPA ranges in the HLOS VM's stage 2
+ * address space. These ranges must have previously been passed to a TZ secure
+ * camera map call that has been intercepted by the hypervisor and forwarded
+ * to both TZ and the resource manager.
+ *
+ * Payload: struct res_mgr_sglist securecam.sglist
+ * Note: The payload ends with a variable-length array.
+ */
+#define RES_MGR_SECURECAM_GET_HANDLE 0x00710001
+
+struct res_mgr_region {
+    uint64_t address_ipa;
+    uint64_t size;
+};
+
+struct res_mgr_sglist {
+    uint32_t region_count;
+    struct res_mgr_region regions[];
+};
+
+/*
+ * get_handle_reply: Response to a get_handle request.
+ *
+ * This is sent by the resource manager to the HLOS to return the SC handle to
+ * be used to refer to the specified buffer.
+ *
+ * If the specified sglist did not match a secure camera buffer known to the
+ * resource manager, the value 0xffffffff is returned. This value is never
+ * a valid SC handle.
+ *
+ * Payload: uint32_t securecam.handle
+ */
+#define RES_MGR_SECURECAM_GET_HANDLE_REPLY 0x80710001
+
+/*
+ * destroy_handles: Destroy all SC handles and unmap their buffers.
+ *
+ * This is sent by the HLOS to the resource manager to ask it to unmap all
+ * secure camera buffers from the ML VM and return the memory to the HLOS.
+ *
+ * Under normal operation, this message will be received by the resource
+ * manager after the ML VM has indicated that its application is complete by
+ * sending a DONE message. If this is not the case, the resource manager will
+ * wait until both this message and the DONE message have been received before
+ * destroying the buffers.
+ *
+ * Payload: void
+ */
+#define RES_MGR_SECURECAM_DESTROY_HANDLES 0x00710002
+
+/*
+ * destroy_handles_reply: Indicate that all SC handles have been destroyed.
+ *
+ * This is sent by the resource manager to the HLOS to inform it that all
+ * secure camera buffers have been unmapped from the ML VM and returned to the
+ * HLOS.
+ *
+ * Payload: void
+ */
+#define RES_MGR_SECURECAM_DESTROY_HANDLES_REPLY 0x80710002
+
+
+/*
+ * Secure Camera Client API (for ML VM)
+ */
+#define RES_MGR_SECURECAM_CLIENT_PROTOCOL_ID 'Q'
+
+/*
+ * notify_start: Tell the client that the first camera buffer has been mapped.
+ *
+ * This is sent by the resource manager to the ML VM after the first instance
+ * of a TZ map call for a secure camera buffer being intercepted.
+ *
+ * Payload: void
+ */
+#define RES_MGR_SECURECAM_NOTIFY_START 0x80510001
+
+/*
+ * ack_start: Acknowledge a notify_start message
+ *
+ * This is sent by the ML VM to the resource manager to acknowledge receipt
+ * of a notify_start message.
+ *
+ * Payload: void
+ */
+#define RES_MGR_SECURECAM_ACK_START 0x00510001
+
+/*
+ * done: Indicate that the secure camera application has terminated.
+ *
+ * This is sent by the ML VM when access to the secure camera buffers is no
+ * longer required. The resource manager will delay unmapping the buffers
+ * until this message is received.
+ *
+ * Payload: void
+ */
+#define RES_MGR_SECURECAM_DONE 0x00510002
+
+/*
+ * lookup_handle: Request physical addresses for a secure camera handle.
+ *
+ * This is sent by the ML VM when userspace code attempts to register a secure
+ * camera buffer handle.
+ *
+ * Payload: uint32_t securecam.handle
+ */
+#define RES_MGR_LOOKUP_HANDLE 0x00510003
+
+/*
+ * lookup_handle_reply: Response to lookup_handle.
+ *
+ * When the resource manager receives a lookup_handle message containing a
+ * handle that is valid and has already been mapped into the ML VM stage 2,
+ * this message is returned containing the list of IPA ranges that have been
+ * assigned to the buffer in the ML VM's address space.
+ *
+ * If the handle is unknown, or corresponds to a buffer that is not currently
+ * mapped into the ML VM stage 2, the region_count field of the result will be
+ * set to 0.
+ *
+ * Payload: struct res_mgr_sglist securecam.sglist
+ * Note: The payload ends with a variable-length array.
+ */
+#define RES_MGR_LOOKUP_HANDLE_REPLY 0x80510003
+
+/*
+ * notify_start: Tell the client that the camera buffers will be unmapped.
+ *
+ * This is sent by the resource manager to the ML VM after the first instance
+ * of a TZ unprotect call for a secure camera buffer being intercepted.
+ *
+ * Payload: void
+ */
+#define RES_MGR_SECURECAM_NOTIFY_STOP 0x80510004
+
+/*
+ * ack_start: Acknowledge a notify_stop message
+ *
+ * This is sent by the ML VM to the resource manager to acknowledge receipt
+ * of a notify_stop message.
+ *
+ * Payload: void
+ */
+#define RES_MGR_SECURECAM_ACK_STOP 0x00510004
+
+/*
+ * Top-level message structure
+ */
+struct res_mgr_msg {
+    uint32_t msg_id;
+    union {
+        bool success;
+        struct {
+            struct boot_mgr_start_params start_params;
+        } boot_mgr;
+        struct {
+            uint32_t handle;
+            struct res_mgr_sglist sglist;
+        } securecam;
+    };
+};
diff --git a/include/net/cnss2.h b/include/net/cnss2.h
index c5ccee4..e95ef8b 100644
--- a/include/net/cnss2.h
+++ b/include/net/cnss2.h
@@ -148,6 +148,7 @@
 extern void cnss_wlan_unregister_driver(struct cnss_wlan_driver *driver);
 extern void cnss_device_crashed(struct device *dev);
 extern int cnss_pci_link_down(struct device *dev);
+extern int cnss_pci_is_device_down(struct device *dev);
 extern void cnss_schedule_recovery(struct device *dev,
 				   enum cnss_recovery_reason reason);
 extern int cnss_self_recovery(struct device *dev,
diff --git a/include/net/cnss_prealloc.h b/include/net/cnss_prealloc.h
index 36de97b..5d0a612 100644
--- a/include/net/cnss_prealloc.h
+++ b/include/net/cnss_prealloc.h
@@ -15,7 +15,7 @@
 
 #define WCNSS_PRE_ALLOC_GET_THRESHOLD (4*1024)
 
-extern void *wcnss_prealloc_get(unsigned int size);
+extern void *wcnss_prealloc_get(size_t size);
 extern int wcnss_prealloc_put(void *ptr);
 extern int wcnss_pre_alloc_reset(void);
 void wcnss_prealloc_check_memory_leak(void);
diff --git a/include/soc/qcom/socinfo.h b/include/soc/qcom/socinfo.h
index d4ebb7d..2eaaaa5 100644
--- a/include/soc/qcom/socinfo.h
+++ b/include/soc/qcom/socinfo.h
@@ -134,6 +134,8 @@
 	of_flat_dt_is_compatible(of_get_flat_dt_root(), "qcom,sda429")
 #define early_machine_is_mdm9650()	\
 	of_flat_dt_is_compatible(of_get_flat_dt_root(), "qcom,mdm9650")
+#define early_machine_is_qm215()	\
+	of_flat_dt_is_compatible(of_get_flat_dt_root(), "qcom,qm215")
 #else
 #define of_board_is_sim()		0
 #define of_board_is_rumi()		0
@@ -190,6 +192,7 @@
 #define early_machine_is_sda439()	0
 #define early_machine_is_sda429()	0
 #define early_machine_is_mdm9650()     0
+#define early_machine_is_qm215()	0
 #endif
 
 #define PLATFORM_SUBTYPE_MDM	1
@@ -269,6 +272,7 @@
 	MSM_CPU_SDA439,
 	MSM_CPU_SDA429,
 	MSM_CPU_9650,
+	MSM_CPU_QM215,
 };
 
 struct msm_soc_info {
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 5da3634..435cee5 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -427,9 +427,7 @@
 header-y += stddef.h
 header-y += string.h
 header-y += suspend_ioctls.h
-header-y += sync.h
 header-y += swab.h
-header-y += sw_sync.h
 header-y += synclink.h
 header-y += sync_file.h
 header-y += sysctl.h
diff --git a/include/uapi/linux/msm_kgsl.h b/include/uapi/linux/msm_kgsl.h
index 943ba9e..8ffef59 100644
--- a/include/uapi/linux/msm_kgsl.h
+++ b/include/uapi/linux/msm_kgsl.h
@@ -332,6 +332,8 @@
 #define KGSL_PROP_UBWC_MODE		0x1B
 #define KGSL_PROP_DEVICE_QTIMER		0x20
 #define KGSL_PROP_L3_PWR_CONSTRAINT     0x22
+#define KGSL_PROP_SECURE_BUFFER_ALIGNMENT 0x23
+#define KGSL_PROP_SECURE_CTXT_SUPPORT 0x24
 
 struct kgsl_shadowprop {
 	unsigned long gpuaddr;
diff --git a/include/uapi/linux/sw_sync.h b/include/uapi/linux/sw_sync.h
deleted file mode 100644
index 9b5d486..0000000
--- a/include/uapi/linux/sw_sync.h
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Copyright (C) 2012 Google, Inc.
- *
- * This software is licensed under the terms of the GNU General Public
- * License version 2, as published by the Free Software Foundation, and
- * may be copied, distributed, and modified under those terms.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#ifndef _UAPI_LINUX_SW_SYNC_H
-#define _UAPI_LINUX_SW_SYNC_H
-
-#include <linux/types.h>
-
-struct sw_sync_create_fence_data {
-	__u32	value;
-	char	name[32];
-	__s32	fence; /* fd of new fence */
-};
-
-#define SW_SYNC_IOC_MAGIC	'W'
-
-#define SW_SYNC_IOC_CREATE_FENCE	_IOWR(SW_SYNC_IOC_MAGIC, 0,\
-		struct sw_sync_create_fence_data)
-#define SW_SYNC_IOC_INC			_IOW(SW_SYNC_IOC_MAGIC, 1, __u32)
-
-#endif /* _UAPI_LINUX_SW_SYNC_H */
diff --git a/include/uapi/linux/sync.h b/include/uapi/linux/sync.h
deleted file mode 100644
index e964c75..0000000
--- a/include/uapi/linux/sync.h
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Copyright (C) 2012 Google, Inc.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#ifndef _UAPI_LINUX_SYNC_H
-#define _UAPI_LINUX_SYNC_H
-
-#include <linux/ioctl.h>
-#include <linux/types.h>
-
-/**
- * struct sync_merge_data - data passed to merge ioctl
- * @fd2:	file descriptor of second fence
- * @name:	name of new fence
- * @fence:	returns the fd of the new fence to userspace
- */
-struct sync_merge_data {
-	__s32	fd2; /* fd of second fence */
-	char	name[32]; /* name of new fence */
-	__s32	fence; /* fd on newly created fence */
-};
-
-/**
- * struct sync_pt_info - detailed sync_pt information
- * @len:		length of sync_pt_info including any driver_data
- * @obj_name:		name of parent sync_timeline
- * @driver_name:	name of driver implementing the parent
- * @status:		status of the sync_pt 0:active 1:signaled <0:error
- * @timestamp_ns:	timestamp of status change in nanoseconds
- * @driver_data:	any driver dependent data
- */
-struct sync_pt_info {
-	__u32	len;
-	char	obj_name[32];
-	char	driver_name[32];
-	__s32	status;
-	__u64	timestamp_ns;
-
-	__u8	driver_data[0];
-};
-
-/**
- * struct sync_fence_info_data - data returned from fence info ioctl
- * @len:	ioctl caller writes the size of the buffer its passing in.
- *		ioctl returns length of sync_fence_data returned to userspace
- *		including pt_info.
- * @name:	name of fence
- * @status:	status of fence. 1: signaled 0:active <0:error
- * @pt_info:	a sync_pt_info struct for every sync_pt in the fence
- */
-struct sync_fence_info_data {
-	__u32	len;
-	char	name[32];
-	__s32	status;
-
-	__u8	pt_info[0];
-};
-
-#define SYNC_IOC_MAGIC		'>'
-
-/**
- * DOC: SYNC_IOC_WAIT - wait for a fence to signal
- *
- * pass timeout in milliseconds.  Waits indefinitely timeout < 0.
- */
-#define SYNC_IOC_WAIT		_IOW(SYNC_IOC_MAGIC, 0, __s32)
-
-/**
- * DOC: SYNC_IOC_MERGE - merge two fences
- *
- * Takes a struct sync_merge_data.  Creates a new fence containing copies of
- * the sync_pts in both the calling fd and sync_merge_data.fd2.  Returns the
- * new fence's fd in sync_merge_data.fence
- */
-#define SYNC_IOC_MERGE		_IOWR(SYNC_IOC_MAGIC, 1, struct sync_merge_data)
-
-/**
- * DOC: SYNC_IOC_FENCE_INFO - get detailed information on a fence
- *
- * Takes a struct sync_fence_info_data with extra space allocated for pt_info.
- * Caller should write the size of the buffer into len.  On return, len is
- * updated to reflect the total size of the sync_fence_info_data including
- * pt_info.
- *
- * pt_info is a buffer containing sync_pt_infos for every sync_pt in the fence.
- * To iterate over the sync_pt_infos, use the sync_pt_info.len field.
- */
-#define SYNC_IOC_FENCE_INFO	_IOWR(SYNC_IOC_MAGIC, 2,\
-	struct sync_fence_info_data)
-
-#endif /* _UAPI_LINUX_SYNC_H */
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 335b40e..0bb5046 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -6875,37 +6875,30 @@
 	return (estimated_capacity <= capacity_curr_of(target_cpu));
 }
 
-static inline bool skip_sg(struct task_struct *p, struct sched_group *sg,
-			   struct cpumask *rtg_target)
-{
-	int fcpu = group_first_cpu(sg);
-
-	/* Are all CPUs isolated in this group? */
-	if (!sg->group_weight)
-		return true;
-
-	/*
-	 * Don't skip a group if a task affinity allows it
-	 * to run only on that group.
-	 */
-	if (cpumask_subset(tsk_cpus_allowed(p), sched_group_cpus(sg)))
-		return false;
-
-	if (!task_fits_max(p, fcpu))
-		return true;
-
-	if (rtg_target && !cpumask_test_cpu(fcpu, rtg_target))
-		return true;
-
-	return false;
-}
-
-static int start_cpu(bool boosted)
+static int start_cpu(struct task_struct *p, bool boosted,
+		     struct cpumask *rtg_target)
 {
 	struct root_domain *rd = cpu_rq(smp_processor_id())->rd;
-	int start_cpu;
+	int start_cpu = -1;
 
-	start_cpu = boosted ? rd->max_cap_orig_cpu : rd->min_cap_orig_cpu;
+	if (boosted)
+		return rd->max_cap_orig_cpu;
+
+	/* A task always fits on its rtg_target */
+	if (rtg_target) {
+		int rtg_target_cpu = cpumask_first_and(rtg_target,
+						cpu_online_mask);
+
+		if (rtg_target_cpu < nr_cpu_ids)
+			return rtg_target_cpu;
+	}
+
+	/* Where the task should land based on its demand */
+	if (rd->min_cap_orig_cpu != -1
+			&& task_fits_max(p, rd->min_cap_orig_cpu))
+		start_cpu = rd->min_cap_orig_cpu;
+	else
+		start_cpu = rd->max_cap_orig_cpu;
 
 	return walt_start_cpu(start_cpu);
 }
@@ -6929,6 +6922,8 @@
 	int best_idle_cpu = -1;
 	int target_cpu = -1;
 	int cpu, i;
+	long spare_cap, most_spare_cap = 0;
+	int most_spare_cap_cpu = -1;
 	unsigned int active_cpus_count = 0;
 	int isolated_candidate = -1;
 	int prev_cpu = task_cpu(p);
@@ -6939,7 +6934,7 @@
 	schedstat_inc(this_rq()->eas_stats.fbt_attempts);
 
 	/* Find start CPU based on boost value */
-	cpu = start_cpu(boosted);
+	cpu = start_cpu(p, boosted, fbt_env->rtg_target);
 	if (cpu < 0) {
 		schedstat_inc(p->se.statistics.nr_wakeups_fbt_no_cpu);
 		schedstat_inc(this_rq()->eas_stats.fbt_no_cpu);
@@ -6960,9 +6955,6 @@
 		cpumask_t search_cpus;
 		bool do_rotate = false, avoid_prev_cpu = false;
 
-		if (skip_sg(p, sg, fbt_env->rtg_target))
-			continue;
-
 		cpumask_copy(&search_cpus, tsk_cpus_allowed(p));
 		cpumask_and(&search_cpus, &search_cpus, sched_group_cpus(sg));
 		i = find_first_cpu_bit(p, &search_cpus, sg, &avoid_prev_cpu,
@@ -6997,6 +6989,12 @@
 			 */
 			wake_util = cpu_util_wake(i, p);
 			new_util = wake_util + task_util(p);
+			spare_cap = capacity_orig_of(i) - wake_util;
+
+			if (spare_cap > most_spare_cap) {
+				most_spare_cap = spare_cap;
+				most_spare_cap_cpu = i;
+			}
 
 			/*
 			 * Ensure minimum capacity to grant the required boost.
@@ -7232,6 +7230,13 @@
 
 			target_capacity = ULONG_MAX;
 		}
+		/*
+		 * if we have found a target cpu within a group, don't bother
+		 * checking other groups.
+		 */
+		if (target_capacity != ULONG_MAX)
+			break;
+
 	} while (sg = sg->next, sg != sd->groups);
 
 	if (best_idle_cpu != -1 && !is_packing_eligible(p, target_cpu, fbt_env,
@@ -7272,10 +7277,15 @@
 		? best_active_cpu
 		: best_idle_cpu;
 
-	if (target_cpu == -1 && cpu_isolated(prev_cpu) &&
-			isolated_candidate != -1) {
-		target_cpu = isolated_candidate;
+	if (target_cpu == -1 && most_spare_cap_cpu != -1 &&
+		/* ensure we use active cpu for active migration */
+		!(p->state == TASK_RUNNING && !idle_cpu(most_spare_cap_cpu)))
+		target_cpu = most_spare_cap_cpu;
+
+	if (cpu_isolated(prev_cpu)) {
 		fbt_env->avoid_prev_cpu = true;
+		if (target_cpu == -1 && isolated_candidate != -1)
+			target_cpu = isolated_candidate;
 	}
 
 	/*
@@ -7487,7 +7497,8 @@
 
 	if (fbt_env.placement_boost || fbt_env.need_idle ||
 			fbt_env.avoid_prev_cpu || (rtg_target &&
-			!cpumask_test_cpu(prev_cpu, rtg_target))) {
+			(!cpumask_test_cpu(prev_cpu, rtg_target) ||
+				cpumask_test_cpu(next_cpu, rtg_target)))) {
 		target_cpu = next_cpu;
 		goto out;
 	}
@@ -8367,6 +8378,9 @@
 		return 0;
 	}
 
+	/* Record that we found atleast one task that could run on dst_cpu */
+	env->flags &= ~LBF_ALL_PINNED;
+
 	if (energy_aware() && !env->dst_rq->rd->overutilized &&
 	    env->idle == CPU_NEWLY_IDLE) {
 		long util_cum_dst, util_cum_src;
@@ -8380,9 +8394,6 @@
 			return 0;
 	}
 
-	/* Record that we found atleast one task that could run on dst_cpu */
-	env->flags &= ~LBF_ALL_PINNED;
-
 #ifdef CONFIG_SCHED_WALT
 	if (env->flags & LBF_IGNORE_PREFERRED_CLUSTER_TASKS &&
 			 !preferred_cluster(cpu_rq(env->dst_cpu)->cluster, p))
@@ -9643,8 +9654,23 @@
 	 * a think about bumping its value to force at least one task to be
 	 * moved
 	 */
-	if (env->imbalance < busiest->load_per_task)
+	if (env->imbalance < busiest->load_per_task) {
+		/*
+		 * The busiest group is overloaded so it could use help
+		 * from the other groups. If the local group has idle CPUs
+		 * and it is not overloaded and has no imbalance with in
+		 * the group, allow the load balance by bumping the
+		 * imbalance.
+		 */
+		if (busiest->group_type == group_overloaded &&
+			local->group_type <= group_misfit_task &&
+			env->idle != CPU_NOT_IDLE) {
+			env->imbalance = busiest->load_per_task;
+			return;
+		}
+
 		return fix_small_imbalance(env, sds);
+	}
 }
 
 /******* find_busiest_group() helpers end here *********************/
diff --git a/kernel/sched/walt.c b/kernel/sched/walt.c
index 4afefd6..269f687 100644
--- a/kernel/sched/walt.c
+++ b/kernel/sched/walt.c
@@ -370,11 +370,12 @@
 	struct task_struct *p;
 	int loop_max = 10;
 
+	rq->ed_task = NULL;
+
 	if ((!walt_rotation_enabled && sched_boost_policy() ==
 			SCHED_BOOST_NONE) || !rq->cfs.h_nr_running)
 		return 0;
 
-	rq->ed_task = NULL;
 	list_for_each_entry(p, &rq->cfs_tasks, se.group_node) {
 		if (!loop_max)
 			break;
diff --git a/kernel/time/timer.c b/kernel/time/timer.c
index d397432..af9a29e 100644
--- a/kernel/time/timer.c
+++ b/kernel/time/timer.c
@@ -1657,6 +1657,22 @@
 
 	spin_lock_irq(&base->lock);
 
+	/*
+	 * timer_base::must_forward_clk must be cleared before running
+	 * timers so that any timer functions that call mod_timer() will
+	 * not try to forward the base. Idle tracking / clock forwarding
+	 * logic is only used with BASE_STD timers.
+	 *
+	 * The must_forward_clk flag is cleared unconditionally also for
+	 * the deferrable base. The deferrable base is not affected by idle
+	 * tracking and never forwarded, so clearing the flag is a NOOP.
+	 *
+	 * The fact that the deferrable base is never forwarded can cause
+	 * large variations in granularity for deferrable timers, but they
+	 * can be deferred for long periods due to idle anyway.
+	 */
+	base->must_forward_clk = false;
+
 	while (time_after_eq(jiffies, base->clk)) {
 
 		levels = collect_expired_timers(base, heads);
@@ -1676,19 +1692,6 @@
 {
 	struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
 
-	/*
-	 * must_forward_clk must be cleared before running timers so that any
-	 * timer functions that call mod_timer will not try to forward the
-	 * base. idle trcking / clock forwarding logic is only used with
-	 * BASE_STD timers.
-	 *
-	 * The deferrable base does not do idle tracking at all, so we do
-	 * not forward it. This can result in very large variations in
-	 * granularity for deferrable timers, but they can be deferred for
-	 * long periods due to idle.
-	 */
-	base->must_forward_clk = false;
-
 	__run_timers(base);
 	if (IS_ENABLED(CONFIG_NO_HZ_COMMON))
 		__run_timers(this_cpu_ptr(&timer_bases[BASE_DEF]));
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index de11b81..2839d86 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4678,7 +4678,7 @@
 	preempt_disable();
 	arch_spin_lock(&trace_cmdline_lock);
 
-	pids = kmalloc_array(savedcmd->cmdline_num, 2*sizeof(int), GFP_KERNEL);
+	pids = kmalloc_array(savedcmd->cmdline_num, 2*sizeof(int), GFP_ATOMIC);
 	if (!pids) {
 		arch_spin_unlock(&trace_cmdline_lock);
 		preempt_enable();
diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
index d3548c4..55c38d8 100644
--- a/mm/zsmalloc.c
+++ b/mm/zsmalloc.c
@@ -352,7 +352,7 @@
 static unsigned long cache_alloc_handle(struct zs_pool *pool, gfp_t gfp)
 {
 	return (unsigned long)kmem_cache_alloc(pool->handle_cachep,
-			gfp & ~(__GFP_HIGHMEM|__GFP_MOVABLE));
+			gfp & ~(__GFP_HIGHMEM|__GFP_MOVABLE|__GFP_CMA));
 }
 
 static void cache_free_handle(struct zs_pool *pool, unsigned long handle)
@@ -363,7 +363,7 @@
 static struct zspage *cache_alloc_zspage(struct zs_pool *pool, gfp_t flags)
 {
 	return kmem_cache_alloc(pool->zspage_cachep,
-			flags & ~(__GFP_HIGHMEM|__GFP_MOVABLE));
+			flags & ~(__GFP_HIGHMEM|__GFP_MOVABLE|__GFP_CMA));
 };
 
 static void cache_free_zspage(struct zs_pool *pool, struct zspage *zspage)
diff --git a/net/core/sockev_nlmcast.c b/net/core/sockev_nlmcast.c
index f238edb..6bc3d7a 100644
--- a/net/core/sockev_nlmcast.c
+++ b/net/core/sockev_nlmcast.c
@@ -36,7 +36,6 @@
 
 static void _sockev_event(unsigned long event, __u8 *evstr, int buflen)
 {
-	memset(evstr, 0, buflen);
 
 	switch (event) {
 	case SOCKEV_SOCKET:
@@ -98,6 +97,9 @@
 	NETLINK_CB(skb).dst_group = SKNLGRP_SOCKEV;
 
 	smsg = nlmsg_data(nlh);
+
+	memset(smsg, 0, sizeof(struct sknlsockevmsg));
+
 	smsg->pid = current->pid;
 	_sockev_event(event, smsg->event, sizeof(smsg->event));
 	smsg->skfamily = sk->sk_family;
diff --git a/security/pfe/pfk.c b/security/pfe/pfk.c
index 8ad25cc..f9a6292 100644
--- a/security/pfe/pfk.c
+++ b/security/pfe/pfk.c
@@ -75,7 +75,9 @@
 	const struct inode *inode,
 	struct pfk_key_info *key_info,
 	enum ice_cryto_algo_mode *algo,
-	bool *is_pfe);
+	bool *is_pfe,
+	unsigned int *data_unit,
+	const char *storage_type);
 
 typedef bool (*pfk_allow_merge_bio_type)(const struct bio *bio1,
 	const struct bio *bio2, const struct inode *inode1,
@@ -281,21 +283,24 @@
 static int pfk_get_key_for_bio(const struct bio *bio,
 		struct pfk_key_info *key_info,
 		enum ice_cryto_algo_mode *algo_mode,
-		bool *is_pfe)
+		bool *is_pfe, unsigned int *data_unit)
 {
 	const struct inode *inode;
 	enum pfe_type which_pfe;
 	const struct blk_encryption_key *key;
+	char *s_type = NULL;
 
 	inode = pfk_bio_get_inode(bio);
 	which_pfe = pfk_get_pfe_type(inode);
+	s_type = (char *)pfk_kc_get_storage_type();
 
 	if (which_pfe != INVALID_PFE) {
 		/* Encrypted file; override ->bi_crypt_key */
 		pr_debug("parsing inode %lu with PFE type %d\n",
 			 inode->i_ino, which_pfe);
 		return (*(pfk_parse_inode_ftable[which_pfe]))
-				(bio, inode, key_info, algo_mode, is_pfe);
+				(bio, inode, key_info, algo_mode, is_pfe,
+					data_unit, (const char *)s_type);
 	}
 
 	/*
@@ -342,12 +347,13 @@
  */
 int pfk_load_key_start(const struct bio *bio,
 		struct ice_crypto_setting *ice_setting, bool *is_pfe,
-		bool async)
+		bool async, int ice_rev)
 {
 	int ret = 0;
 	struct pfk_key_info key_info = {NULL, NULL, 0, 0};
 	enum ice_cryto_algo_mode algo_mode = ICE_CRYPTO_ALGO_MODE_AES_XTS;
 	enum ice_crpto_key_size key_size_type = 0;
+	unsigned int data_unit = 1 << ICE_CRYPTO_DATA_UNIT_512_B;
 	u32 key_index = 0;
 
 	if (!is_pfe) {
@@ -370,7 +376,8 @@
 		return -EINVAL;
 	}
 
-	ret = pfk_get_key_for_bio(bio, &key_info, &algo_mode, is_pfe);
+	ret = pfk_get_key_for_bio(bio, &key_info, &algo_mode, is_pfe,
+					&data_unit);
 
 	if (ret != 0)
 		return ret;
@@ -380,7 +387,8 @@
 		return ret;
 
 	ret = pfk_kc_load_key_start(key_info.key, key_info.key_size,
-			key_info.salt, key_info.salt_size, &key_index, async);
+			key_info.salt, key_info.salt_size, &key_index, async,
+			data_unit, ice_rev);
 	if (ret) {
 		if (ret != -EBUSY && ret != -EAGAIN)
 			pr_err("start: could not load key into pfk key cache, error %d\n",
@@ -431,7 +439,7 @@
 	if (!pfk_is_ready())
 		return -ENODEV;
 
-	ret = pfk_get_key_for_bio(bio, &key_info, NULL, is_pfe);
+	ret = pfk_get_key_for_bio(bio, &key_info, NULL, is_pfe, NULL);
 	if (ret != 0)
 		return ret;
 
diff --git a/security/pfe/pfk_ext4.c b/security/pfe/pfk_ext4.c
index 0eb1225..7000b66 100644
--- a/security/pfe/pfk_ext4.c
+++ b/security/pfe/pfk_ext4.c
@@ -141,7 +141,9 @@
 	const struct inode *inode,
 	struct pfk_key_info *key_info,
 	enum ice_cryto_algo_mode *algo,
-	bool *is_pfe)
+	bool *is_pfe,
+	unsigned int *data_unit,
+	const char *storage_type)
 {
 	int ret = 0;
 
@@ -155,6 +157,19 @@
 	 */
 	*is_pfe = true;
 
+	/* Update dun based upon storage type.
+	 * For ext4 FS UFS has 4k dun whereas eMMC
+	 * uses 512Byte dun.
+	 */
+	if (storage_type && data_unit) {
+		if (!memcmp(storage_type, "ufs", strlen("ufs")))
+			*data_unit = 1 << ICE_CRYPTO_DATA_UNIT_4_KB;
+		else if (!memcmp(storage_type, "sdcc", strlen("sdcc")))
+			*data_unit = 1 << ICE_CRYPTO_DATA_UNIT_512_B;
+		else
+			return -EINVAL;
+	}
+
 	if (!pfk_ext4_is_ready())
 		return -ENODEV;
 
diff --git a/security/pfe/pfk_ext4.h b/security/pfe/pfk_ext4.h
index c33232f..e39d04d 100644
--- a/security/pfe/pfk_ext4.h
+++ b/security/pfe/pfk_ext4.h
@@ -24,7 +24,9 @@
 	const struct inode *inode,
 	struct pfk_key_info *key_info,
 	enum ice_cryto_algo_mode *algo,
-	bool *is_pfe);
+	bool *is_pfe,
+	unsigned int *data_unit,
+	const char *storage_type);
 
 bool pfk_ext4_allow_merge_bio(const struct bio *bio1,
 	const struct bio *bio2, const struct inode *inode1,
diff --git a/security/pfe/pfk_f2fs.c b/security/pfe/pfk_f2fs.c
index 8b9d515..2076267 100644
--- a/security/pfe/pfk_f2fs.c
+++ b/security/pfe/pfk_f2fs.c
@@ -116,7 +116,9 @@
 		const struct inode *inode,
 		struct pfk_key_info *key_info,
 		enum ice_cryto_algo_mode *algo,
-		bool *is_pfe)
+		bool *is_pfe,
+		unsigned int *data_unit,
+		const char *storage_type)
 {
 	int ret = 0;
 
@@ -130,6 +132,18 @@
 	 */
 	*is_pfe = true;
 
+	/* Update the dun based upon storage type.
+	 * Right now both UFS and eMMC storage uses 4KB dun
+	 * for F2FS
+	 */
+	if (storage_type && data_unit) {
+		if (!memcmp(storage_type, "ufs", strlen("ufs")) ||
+			!memcmp(storage_type, "sdcc", strlen("sdcc")))
+			*data_unit = 1 << ICE_CRYPTO_DATA_UNIT_4_KB;
+		else
+			return -EINVAL;
+	}
+
 	if (!pfk_f2fs_is_ready())
 		return -ENODEV;
 
diff --git a/security/pfe/pfk_f2fs.h b/security/pfe/pfk_f2fs.h
index 551d529..2e0c21d 100644
--- a/security/pfe/pfk_f2fs.h
+++ b/security/pfe/pfk_f2fs.h
@@ -24,7 +24,9 @@
 		const struct inode *inode,
 		struct pfk_key_info *key_info,
 		enum ice_cryto_algo_mode *algo,
-		bool *is_pfe);
+		bool *is_pfe,
+		unsigned int *data_unit,
+		const char *storage_type);
 
 bool pfk_f2fs_allow_merge_bio(const struct bio *bio1,
 	const struct bio *bio2, const struct inode *inode1,
diff --git a/security/pfe/pfk_ice.c b/security/pfe/pfk_ice.c
index a86042c..e5ed3d6 100644
--- a/security/pfe/pfk_ice.c
+++ b/security/pfe/pfk_ice.c
@@ -26,56 +26,59 @@
 #include "pfk_ice.h"
 
 
-/**********************************/
-/** global definitions		 **/
-/**********************************/
-
-#define TZ_ES_SET_ICE_KEY 0x2
-#define TZ_ES_INVALIDATE_ICE_KEY 0x3
+#define TZ_ES_SET_ICE_KEY		0x2
+#define TZ_ES_CONFIG_SET_ICE_KEY	0x4
+#define TZ_ES_INVALIDATE_ICE_KEY	0x3
 
 /* index 0 and 1 is reserved for FDE */
-#define MIN_ICE_KEY_INDEX 2
+#define MIN_ICE_KEY_INDEX	2
 
-#define MAX_ICE_KEY_INDEX 31
-
+#define MAX_ICE_KEY_INDEX	31
+#define ICE20			2
 
 #define TZ_ES_SET_ICE_KEY_ID \
-	TZ_SYSCALL_CREATE_SMC_ID(TZ_OWNER_SIP, TZ_SVC_ES, TZ_ES_SET_ICE_KEY)
+	TZ_SYSCALL_CREATE_SMC_ID(TZ_OWNER_SIP, TZ_SVC_ES, \
+		TZ_ES_SET_ICE_KEY)
 
+#define TZ_ES_CONFIG_SET_ICE_KEY_ID \
+	TZ_SYSCALL_CREATE_SMC_ID(TZ_OWNER_SIP, TZ_SVC_ES, \
+		TZ_ES_CONFIG_SET_ICE_KEY)
 
 #define TZ_ES_INVALIDATE_ICE_KEY_ID \
 		TZ_SYSCALL_CREATE_SMC_ID(TZ_OWNER_SIP, \
 			TZ_SVC_ES, TZ_ES_INVALIDATE_ICE_KEY)
 
-
 #define TZ_ES_SET_ICE_KEY_PARAM_ID \
 	TZ_SYSCALL_CREATE_PARAM_ID_5( \
 		TZ_SYSCALL_PARAM_TYPE_VAL, \
 		TZ_SYSCALL_PARAM_TYPE_BUF_RW, TZ_SYSCALL_PARAM_TYPE_VAL, \
 		TZ_SYSCALL_PARAM_TYPE_BUF_RW, TZ_SYSCALL_PARAM_TYPE_VAL)
 
+#define TZ_ES_CONFIG_SET_ICE_KEY_PARAM_ID \
+	TZ_SYSCALL_CREATE_PARAM_ID_5( \
+		TZ_SYSCALL_PARAM_TYPE_VAL, \
+		TZ_SYSCALL_PARAM_TYPE_BUF_RW, TZ_SYSCALL_PARAM_TYPE_VAL, \
+		TZ_SYSCALL_PARAM_TYPE_VAL, TZ_SYSCALL_PARAM_TYPE_VAL)
+
 #define TZ_ES_INVALIDATE_ICE_KEY_PARAM_ID \
 	TZ_SYSCALL_CREATE_PARAM_ID_1( \
 	TZ_SYSCALL_PARAM_TYPE_VAL)
 
-#define ICE_KEY_SIZE 32
-#define ICE_SALT_SIZE 32
-
-static uint8_t ice_key[ICE_KEY_SIZE];
-static uint8_t ice_salt[ICE_KEY_SIZE];
+#define ICE_BUFFER_SIZE 64
 
 int qti_pfk_ice_set_key(uint32_t index, uint8_t *key, uint8_t *salt,
-			char *storage_type)
+			char *storage_type, unsigned int data_unit,
+			int ice_rev)
 {
 	struct scm_desc desc = {0};
 	int ret, ret1;
-	char *tzbuf_key = (char *)ice_key;
-	char *tzbuf_salt = (char *)ice_salt;
 	char *s_type = storage_type;
+	char *ice_buffer = NULL;
+	char *tzbuf_salt = NULL;
+	char *tzbuf_key = NULL;
 
 	uint32_t smc_id = 0;
-	u32 tzbuflen_key = sizeof(ice_key);
-	u32 tzbuflen_salt = sizeof(ice_salt);
+	u32 size = ICE_BUFFER_SIZE / 2;
 
 	if (index < MIN_ICE_KEY_INDEX || index > MAX_ICE_KEY_INDEX) {
 		pr_err("%s Invalid index %d\n", __func__, index);
@@ -86,33 +89,59 @@
 		return -EINVAL;
 	}
 
-	if (!tzbuf_key || !tzbuf_salt) {
-		pr_err("%s No Memory\n", __func__);
-		return -ENOMEM;
-	}
-
 	if (s_type == NULL) {
 		pr_err("%s Invalid Storage type\n", __func__);
 		return -EINVAL;
 	}
 
-	memset(tzbuf_key, 0, tzbuflen_key);
-	memset(tzbuf_salt, 0, tzbuflen_salt);
+	if (ice_rev > ICE20) {
+		ice_buffer = kzalloc(ICE_BUFFER_SIZE, GFP_KERNEL);
+		if (!ice_buffer)
+			return -ENOMEM;
 
-	memcpy(ice_key, key, tzbuflen_key);
-	memcpy(ice_salt, salt, tzbuflen_salt);
+		memset(ice_buffer, 0, ICE_BUFFER_SIZE);
+		memcpy(ice_buffer, key, size);
+		memcpy(ice_buffer + size, salt, size);
 
-	dmac_flush_range(tzbuf_key, tzbuf_key + tzbuflen_key);
-	dmac_flush_range(tzbuf_salt, tzbuf_salt + tzbuflen_salt);
+		dmac_flush_range(ice_buffer, ice_buffer + ICE_BUFFER_SIZE);
 
-	smc_id = TZ_ES_SET_ICE_KEY_ID;
+		smc_id = TZ_ES_CONFIG_SET_ICE_KEY_ID;
 
-	desc.arginfo = TZ_ES_SET_ICE_KEY_PARAM_ID;
-	desc.args[0] = index;
-	desc.args[1] = virt_to_phys(tzbuf_key);
-	desc.args[2] = tzbuflen_key;
-	desc.args[3] = virt_to_phys(tzbuf_salt);
-	desc.args[4] = tzbuflen_salt;
+		desc.arginfo = TZ_ES_CONFIG_SET_ICE_KEY_PARAM_ID;
+		desc.args[0] = index;
+		desc.args[1] = virt_to_phys(ice_buffer);
+		desc.args[2] = ICE_BUFFER_SIZE;
+		desc.args[3] = ICE_CRYPTO_MODE_XTS_256;
+		desc.args[4] = data_unit;
+	} else {
+		tzbuf_key = kzalloc((ICE_BUFFER_SIZE / 2), GFP_KERNEL);
+		if (tzbuf_key) {
+			tzbuf_salt = kzalloc((ICE_BUFFER_SIZE / 2), GFP_KERNEL);
+			if (!tzbuf_salt) {
+				kfree(tzbuf_key);
+				return -ENOMEM;
+			}
+		} else {
+			return -ENOMEM;
+		}
+
+		memset(tzbuf_key, 0, size);
+		memset(tzbuf_salt, 0, size);
+		memcpy(tzbuf_key, key, size);
+		memcpy(tzbuf_salt, salt, size);
+
+		dmac_flush_range(tzbuf_key, tzbuf_key + size);
+		dmac_flush_range(tzbuf_salt, tzbuf_salt + size);
+
+		smc_id = TZ_ES_SET_ICE_KEY_ID;
+
+		desc.arginfo = TZ_ES_SET_ICE_KEY_PARAM_ID;
+		desc.args[0] = index;
+		desc.args[1] = virt_to_phys(tzbuf_key);
+		desc.args[2] = size;
+		desc.args[3] = virt_to_phys(tzbuf_salt);
+		desc.args[4] = size;
+	}
 
 	ret = qcom_ice_setup_ice_hw((const char *)s_type, true);
 
@@ -144,6 +173,13 @@
 		pr_err("%s: Error %d disabling clocks\n", __func__, ret1);
 
 out:
+	if (ice_rev > ICE20) {
+		kfree(ice_buffer);
+	} else {
+		kfree(tzbuf_key);
+		kfree(tzbuf_salt);
+	}
+
 	return ret;
 }
 
diff --git a/security/pfe/pfk_ice.h b/security/pfe/pfk_ice.h
index 31772e7..5c85349 100644
--- a/security/pfe/pfk_ice.h
+++ b/security/pfe/pfk_ice.h
@@ -26,7 +26,8 @@
 int pfk_ice_deinit(void);
 
 int qti_pfk_ice_set_key(uint32_t index, uint8_t *key, uint8_t *salt,
-			char *storage_type);
+			char *storage_type, unsigned int data_unit,
+			int ice_rev);
 int qti_pfk_ice_invalidate_key(uint32_t index, char *storage_type);
 
 
diff --git a/security/pfe/pfk_kc.c b/security/pfe/pfk_kc.c
index eecc026..33b8d3d 100644
--- a/security/pfe/pfk_kc.c
+++ b/security/pfe/pfk_kc.c
@@ -132,6 +132,16 @@
 }
 
 /**
+ * pfk_kc_get_storage_type() - return the hardware storage type.
+ *
+ * Return: storage type queried during bootup.
+ */
+const char *pfk_kc_get_storage_type(void)
+{
+	return s_type;
+}
+
+/**
  * kc_entry_is_available() - checks whether the entry is available
  *
  * Return true if it is , false otherwise or if invalid
@@ -389,13 +399,15 @@
  * @key_size: key_size
  * @salt: salt
  * @salt_size: salt_size
+ * @data_unit: dun size
  *
  * The previous key is securely released and wiped, the new one is loaded
  * to ICE.
  * Should be invoked under spinlock
  */
 static int kc_update_entry(struct kc_entry *entry, const unsigned char *key,
-	size_t key_size, const unsigned char *salt, size_t salt_size)
+	size_t key_size, const unsigned char *salt, size_t salt_size,
+	unsigned int data_unit, int ice_rev)
 {
 	int ret;
 
@@ -412,7 +424,7 @@
 	kc_spin_unlock();
 
 	ret = qti_pfk_ice_set_key(entry->key_index, entry->key,
-			entry->salt, s_type);
+			entry->salt, s_type, data_unit, ice_rev);
 
 	kc_spin_lock();
 	return ret;
@@ -478,7 +490,7 @@
  */
 int pfk_kc_load_key_start(const unsigned char *key, size_t key_size,
 		const unsigned char *salt, size_t salt_size, u32 *key_index,
-		bool async)
+		bool async, unsigned int data_unit, int ice_rev)
 {
 	int ret = 0;
 	struct kc_entry *entry = NULL;
@@ -543,7 +555,8 @@
 			break;
 		}
 	case (FREE):
-		ret = kc_update_entry(entry, key, key_size, salt, salt_size);
+		ret = kc_update_entry(entry, key, key_size, salt, salt_size,
+					data_unit, ice_rev);
 		if (ret) {
 			entry->state = SCM_ERROR;
 			entry->scm_error = ret;
diff --git a/security/pfe/pfk_kc.h b/security/pfe/pfk_kc.h
index 6adeee2..0f50a60 100644
--- a/security/pfe/pfk_kc.h
+++ b/security/pfe/pfk_kc.h
@@ -19,7 +19,7 @@
 int pfk_kc_deinit(void);
 int pfk_kc_load_key_start(const unsigned char *key, size_t key_size,
 		const unsigned char *salt, size_t salt_size, u32 *key_index,
-		bool async);
+		bool async, unsigned int data_unit, int ice_rev);
 void pfk_kc_load_key_end(const unsigned char *key, size_t key_size,
 		const unsigned char *salt, size_t salt_size);
 int pfk_kc_remove_key_with_salt(const unsigned char *key, size_t key_size,
@@ -27,6 +27,7 @@
 int pfk_kc_remove_key(const unsigned char *key, size_t key_size);
 int pfk_kc_clear(void);
 void pfk_kc_clear_on_reset(void);
+const char *pfk_kc_get_storage_type(void);
 extern char *saved_command_line;
 
 
diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
index fc9c9b0..63e40b5 100644
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -379,7 +379,7 @@
 	unsigned int rshift = mc->rshift;
 	int max = mc->max;
 	int min = mc->min;
-	unsigned int mask = (1 << (fls(min + max) - 1)) - 1;
+	unsigned int mask = (1U << (fls(min + max) - 1)) - 1;
 	unsigned int val;
 	int ret;
 
@@ -424,7 +424,7 @@
 	unsigned int rshift = mc->rshift;
 	int max = mc->max;
 	int min = mc->min;
-	unsigned int mask = (1 << (fls(min + max) - 1)) - 1;
+	unsigned int mask = (1U << (fls(min + max) - 1)) - 1;
 	int err = 0;
 	unsigned int val, val_mask, val2 = 0;
 
diff --git a/sound/usb/usb_audio_qmi_svc.c b/sound/usb/usb_audio_qmi_svc.c
index fe29aed..aa02ac7 100644
--- a/sound/usb/usb_audio_qmi_svc.c
+++ b/sound/usb/usb_audio_qmi_svc.c
@@ -450,7 +450,7 @@
 	struct uac_format_type_i_discrete_descriptor *fmt_v1;
 	struct uac_format_type_i_ext_descriptor *fmt_v2;
 	struct uac1_as_header_descriptor *as;
-	int ret = -ENODEV;
+	int ret;
 	int protocol, card_num, pcm_dev_num;
 	void *hdr_ptr;
 	u8 *xfer_buf;
@@ -465,6 +465,7 @@
 	if (!iface) {
 		pr_err("%s: interface # %d does not exist\n", __func__,
 			subs->interface);
+		ret = -ENODEV;
 		goto err;
 	}
 
@@ -483,12 +484,14 @@
 		if (!fmt) {
 			pr_err("%s: %u:%d : no UAC_FORMAT_TYPE desc\n",
 				__func__, subs->interface, subs->altset_idx);
+			ret = -ENODEV;
 			goto err;
 		}
 	}
 
 	if (!uadev[card_num].ctrl_intf) {
 		pr_err("%s: audio ctrl intf info not cached\n", __func__);
+		ret = -ENODEV;
 		goto err;
 	}
 
@@ -499,6 +502,7 @@
 				NULL, UAC_HEADER);
 		if (!hdr_ptr) {
 			pr_err("%s: no UAC_HEADER desc\n", __func__);
+			ret = -ENODEV;
 			goto err;
 		}
 	}
@@ -509,6 +513,7 @@
 		if (!as) {
 			pr_err("%s: %u:%d : no UAC_AS_GENERAL desc\n", __func__,
 				subs->interface, subs->altset_idx);
+			ret = -ENODEV;
 			goto err;
 		}
 		resp->data_path_delay = as->bDelay;
@@ -555,6 +560,7 @@
 		resp->usb_audio_subslot_size_valid = 1;
 	} else {
 		pr_err("%s: unknown protocol version %x\n", __func__, protocol);
+		ret = -ENODEV;
 		goto err;
 	}
 
@@ -568,6 +574,7 @@
 	if (!ep) {
 		pr_err("%s: data ep # %d context is null\n", __func__,
 			subs->data_endpoint->ep_num);
+		ret = -ENODEV;
 		goto err;
 	}
 	data_ep_pipe = subs->data_endpoint->pipe;
@@ -577,6 +584,7 @@
 	tr_data_pa = usb_get_xfer_ring_phys_addr(subs->dev, ep, &dma);
 	if (!tr_data_pa) {
 		pr_err("%s:failed to get data ep ring dma address\n", __func__);
+		ret = -ENODEV;
 		goto err;
 	}
 
@@ -596,6 +604,7 @@
 		if (!tr_sync_pa) {
 			pr_err("%s:failed to get sync ep ring dma address\n",
 				__func__);
+			ret = -ENODEV;
 			goto err;
 		}
 		resp->xhci_mem_info.tr_sync.pa = dma;
@@ -621,17 +630,21 @@
 			ret);
 		goto err;
 	}
+
 	xhci_pa = usb_get_sec_event_ring_phys_addr(subs->dev,
 			resp->interrupter_num, &dma);
 	if (!xhci_pa) {
 		pr_err("%s: failed to get sec event ring dma address\n",
 		__func__);
+		ret = -ENODEV;
 		goto err;
 	}
 
 	va = uaudio_iommu_map(MEM_EVENT_RING, xhci_pa, PAGE_SIZE, NULL);
-	if (!va)
+	if (!va) {
+		ret = -ENOMEM;
 		goto err;
+	}
 
 	resp->xhci_mem_info.evt_ring.va = PREPEND_SID_TO_IOVA(va,
 						uaudio_qdev->sid);
@@ -640,15 +653,19 @@
 	uaudio_qdev->er_mapped = true;
 
 	resp->speed_info = get_speed_info(subs->dev->speed);
-	if (resp->speed_info == USB_AUDIO_DEVICE_SPEED_INVALID_V01)
+	if (resp->speed_info == USB_AUDIO_DEVICE_SPEED_INVALID_V01) {
+		ret = -ENODEV;
 		goto unmap_er;
+	}
 
 	resp->speed_info_valid = 1;
 
 	/* data transfer ring */
 	va = uaudio_iommu_map(MEM_XFER_RING, tr_data_pa, PAGE_SIZE, NULL);
-	if (!va)
+	if (!va) {
+		ret = -ENOMEM;
 		goto unmap_er;
+	}
 
 	tr_data_va = va;
 	resp->xhci_mem_info.tr_data.va = PREPEND_SID_TO_IOVA(va,
@@ -661,8 +678,10 @@
 
 	xhci_pa = resp->xhci_mem_info.tr_sync.pa;
 	va = uaudio_iommu_map(MEM_XFER_RING, tr_sync_pa, PAGE_SIZE, NULL);
-	if (!va)
+	if (!va) {
+		ret = -ENOMEM;
 		goto unmap_data;
+	}
 
 	tr_sync_va = va;
 	resp->xhci_mem_info.tr_sync.va = PREPEND_SID_TO_IOVA(va,
@@ -686,14 +705,18 @@
 	}
 
 	xfer_buf = usb_alloc_coherent(subs->dev, len, GFP_KERNEL, &xfer_buf_pa);
-	if (!xfer_buf)
+	if (!xfer_buf) {
+		ret = -ENOMEM;
 		goto unmap_sync;
+	}
 
 	dma_get_sgtable(subs->dev->bus->sysdev, &sgt, xfer_buf, xfer_buf_pa,
 			len);
 	va = uaudio_iommu_map(MEM_XFER_BUF, xfer_buf_pa, len, &sgt);
-	if (!va)
+	if (!va) {
+		ret = -ENOMEM;
 		goto unmap_sync;
+	}
 
 	resp->xhci_mem_info.xfer_buff.pa = xfer_buf_pa;
 	resp->xhci_mem_info.xfer_buff.size = len;